Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Synopsys

Uncover vulnerabilities in C# applications using Coverity Rapid Scan Static | Synopsys

In this video you will discover how Coverity’s Rapid Scan Static Analysis can help developers find and fix vulnerabilities in their code early in the development cycle by providing quick feedback on the most impactful issues. This new update in the Coverity 2024.6.0 release highlights how developers can run quick scans for C# applications via the Coverity Rapid Scan Static engine; returning quick and accurate static analysis results related to issues such as deserialization, hardcoded secrets, unsafe API calls, single-file data flow, etc. at record speeds.

SSDF BSIMM mapping updated for BSIMM14

In early March 2024, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released its final Secure Software Development Attestation Form instructions, sparking a renewed urgency around understanding and complying with 31 of the 42 tasks in NIST SP 800-218 Secure Software Development Framework (SSDF) version 1.1.

Is AI-generated code secure? Maybe. Maybe not.

Generative AI has emerged as the next big thing that will transform the way we build software. Its impact will be as significant as open source, mobile devices, cloud computing—indeed, the internet itself. We’re seeing Generative AI’s impacts already, and according to the recent Gartner Hype Cycle for Artificial Intelligence, AI may ultimately be able to automate as much as 30% of the work done by developers.

CyRC Vulnerability Advisory: CVE-2024-5184s prompt injection in EmailGPT service

The Synopsys Cybersecurity Research Center (CyRC) has exposed prompt injection vulnerabilities in the EmailGPT service. EmailGPT is an API service and Google Chrome extension that assists users in writing emails inside Gmail using OpenAI's GPT models. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts.

CyRC Vulnerability Advisory: CVE-2024-5185 Data Poisoning Vulnerability in EmbedAI Application

The Synopsys Cybersecurity Research Center (CyRC) has exposed a data poisoning vulnerability in the EmbedAI application. EmbedAI allows users to interact with documents by utilizing the capabilities of large language models (LLMs). This vulnerability could result in an application becoming compromised, leading to unauthorized entries or data poisoning attacks.

The changing face of software supply chain security risk

Released by the Ponemon Institute and sponsored by Synopsys, the 2024 “The State of Software Supply Chain Security Risks” report surveys over 1,200 global IT and security practitioners on challenges their organizations face in securing the software supply chain. Here are six key findings from the report every cybersecurity professional should know.

Accelerate application code fixes with AI-powered Polaris Assist

We're excited to announce the availability of Polaris Assist, our AI-powered application security assistant that combines decades of real-world insights with a powerful large language model (LLM). Polaris Assist gives security and development teams easy-to-understand summaries of detected vulnerabilities and code fix recommendations to help them build secure software faster.

Introducing Polaris Assist: Your virtual security assistant | Synopsys

Polaris Assist is a virtual assistant that combines generative AI with decades of Synopsys curated real-world vulnerability, risk, and secure coding data to simplify and streamline application security. Polaris Assist AI capabilities will first be introduced on the Polaris Software Integrity Platform by analyzing static analysis data.

Building a software Bill of Materials with Black Duck

A necessary step in securing an application is evaluating the supply chain of each component used to create the application—no matter how many hands were involved in its development. If any links in the supply chain are obscured, it can be difficult to confidently assess the amount of risk that an application is susceptible to.