Jazzer: Back to Open Source!
We are beyond excited to share some fantastic news with our community: Jazzer is now fully open source again under the Apache 2.0 license!
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Open Source
2024 Open Source Security Report: Slowing Progress and New Challenges for DevSecOps
Trust is the foundation of the open source community — but what happens when that trust is betrayed? When a backdoor vulnerability was found in a widespread Linux-based data compression tool, it nearly created an opportunity for malicious actors to seize control of countless computers worldwide. The vulnerability was introduced by a trusted contributor who, after years of building rapport with maintainers, ultimately exploited that trust.
Falco vs. Sysdig OSS: Choosing the Right Tool for the Job
The open-source ecosystem is rich with tools that empower developers and security practitioners alike. Two standout projects are Sysdig OSS and Falco, both of which leverage deep system-level instrumentation to provide insights and enhance security. However, while they share a common foundation, they serve distinct purposes. This blog explores the strengths of Sysdig OSS and Falco, how they differ, and how they can complement each other.
Balancing Security: When to Leverage Open-Source Tools vs. Commercial Tools
When deciding what approach to use for security tooling, it seems like there are two choices. Like everything in security, there is more to unpack in reality. In this article I want to explore when open-source security tools should be used, when commercial tools are more effective, and if we can trust tools built from an open-source core.
Secure Python code faster with Code Sight: Real-time issue detection in Visual Studio | Black Duck
Join David Bohannan, an R&D engineer at Black Duck, as he demonstrates using Black Duck's IDE plug-in, Code Sight to run static analysis on Python code within Visual Studio. Watch as Code Sight instantly detects vulnerabilities like OS command injection and cross-site request forgery while code is being written, helping developers fix issues early in the software lifecycle. David will demonstrate how leveraging Coverity's Rapid Scanning engine through Code Sight can allow developers to tackle issues such as secret scanning and ensure hardcoded secrets are flagged before they become risks to applications further downstream.
Chris Hughes Reviews Jit's Open ASPM Platform
Chris provides his perspective on Jit's approach to unifying leading open source product security scanners in one place to consolidate scanning, prioritization, and remediation.
OpenRelik - OSS platform for collaborative digital forensic investigations with Johan Berggren
Johan Berggren, Staff Security Engineer at Google, joined Defender Fridays to discuss OpenRelik - an OSS platform designed for collaborative digital forensic investigations.
SOSS Fusion 2024: Uniting Security Minds for the Future of Open Source
Discover key takeaways from SOSS Fusion 2024, where security experts gathered to learn from one another about improving our world, AI, and the future of open-source security.
Open Source Security for Hardening
OS hardening refers to the process of enhancing the security of an operating system by implementing various measures and practices to minimize vulnerabilities and strengthen its resistance against potential cyber threats and attacks. This involves configuring the OS settings, applying security patches, disabling unnecessary services, and implementing access controls to create a more robust and secure computing environment.
Going beyond reachability to prioritize what matters most
Most modern applications contain a substantial number of open source packages, libraries, and frameworks. In fact, it's estimated that at least 80% of the source code in modern applications is from open source. In addition to relying heavily on commodity components to build applications, development teams often deploy these apps and services via community-sourced container base images.