Security | Threat Detection | Cyberattacks | DevSecOps | Compliance



Understanding the hows and whys of open source audits

Learn who needs open source audits, why you might need one, who and what is involved, and how an open source audit can help you in an M&A. If you’re part of a modern business that does any software development, your dev teams are using open source components to move quickly, save money, and leverage community innovation. If you’re a law firm or a consultant, your clients use open source.


How to Perform a Cybersecurity Audit for Colleges & Universities

‍Cybersecurity audits are essential for any organization to review, analyze, and update its current IT infrastructure, information security policies (ISP), and overall cybersecurity risk management protocols. Audits are a critical part of information security and should be performed annually to ensure that new policies are implemented properly, potential vulnerabilities are identified, and the school maintains compliance with regulatory standards.


How Penetration Testing Can Better Prepare You for a SOC 2 Audit

The goal of a SOC 2 audit is to evaluate and verify how a service provider, whether an IT provider, Software-as-a-Service (SaaS) platform, or other outsourced solution, handles sensitive customer data. Companies are pursuing SOC 2 certification because it is an industry-recognized way to show customers that their security program is worthy of their trust. When thinking about how to prepare for a SOC 2 audit, cyber risk assessment and penetration testing should be on your list.


The four most important aspects of software due diligence audits

Understanding the key aspects of software due diligence audits will help you know what to look for in a trusted M&A partner. At some level, the pitch for any software-related service is the same: We have the expertise to provide high-quality solutions to your challenging problems. Sometimes that expertise is “powered by” proprietary technology. That’s well-aligned to what prospective clients look for in most software service scenarios.


Ensure compliance, governance, and transparency across your teams with Datadog Audit Trail

In order to maintain compliance, enforce governance, and build transparency, teams across your organization need deep insight into how their users and automation interact with Datadog. For stakeholders in leadership roles, such as CIOs and CDOs, knowing what actions users took and when is essential for spotting gaps in enablement, budgeting, and reporting, as well as building a modern compliance strategy for the organization as a whole.


NERC CIP Audits: Top 8 Dos and Don'ts

My time at NERC had me involved with quite a few projects over my seven-year career there. I was involved with CIP compliance audits, investigations, auditor training, and many advisory sessions. Typically, I was advising entities across North America on different tactics, techniques, and insight from best practices I have seen. I wanted to share a few of the dos and don’ts during my experience out in the field.


Black Duck Open Source Audits: Working through licensing issues like a pro

It’s critical to have the right people and approach when it comes to understanding and resolving licensing issues in open source audits. Many of our regular Black Duck Audit customers have well-honed processes that kick in after we deliver reports. We’ve gleaned some ideas and approaches from working with these clients and the biggest pro tip? You need a pro, i.e., make sure you have an open source-savvy attorney involved.


How to Hack Kubernetes (and How to Protect It)

Kubernetes is a valuable resource and a leading container management system in development pipelines across the world, but it’s not exempt from malicious attacks. Using Kubernetes requires a deep understanding of Kubernetes’ environment—including the different vulnerabilities you can be exposed to while creating, deploying, or running applications in your clusters.