Application Security

The CSO guide to top security conferences

Tracking postponements, cancellations, and conferences gone virtual — CSO Online’s calendar of upcoming security conferences makes it easy to find the events that matter the most to you.

By CSO Staff

31 Dec 20246 mins

Application SecurityEventsTechnology Industry

Securing cloud-native applications: Why a comprehensive API security strategy is essential

By Sunil Pai

05 Dec 20249 mins

Application Security

Mitel MiCollab VoIP authentication bypass opens new attack paths

By Lucian Constantin

05 Dec 20245 mins

Application SecurityThreat and Vulnerability ManagementVulnerabilities

Rising ClickFix malware distribution trick puts PowerShell IT policies on notice

By Lucian Constantin

21 Nov 20246 mins

MalwarePhishingSocial Engineering

Misconfigurations can cause many Microsoft Power Pages sites to expose sensitive data

By Lucian Constantin

15 Nov 20247 mins

Application SecuritySecurity PracticesWeb Development

Articles

Put a Stop to SaaS Sprawl without Limiting Employee Autonomy

As it becomes easier for employees to purchase apps that help them in their work, risks and costs spiral out of control. Here’s how to manage SaaS sprawl while keeping users productive.

By Softchoice

08 Nov 2024 6 mins

Application SecuritySecurity Software

Beware malicious NPM packages, Checkmarx warns

‘Package confusion’ attack against NPM used to trick developers into downloading malware

By John E. Dunn

07 Nov 2024 1 min

Application Security

Top 5 security mistakes software developers make

As attacks continue to plague cybersecurity leaders, CSO has compiled a list of common mistakes by software developers that can be prevented.

By David Strom

07 Nov 2024 10 mins

Application SecurityDevSecOps

LLMs hallucinating non-existent developer packages could fuel supply chain attacks

Large language models could be exploited to launch waves of “package confusion” attacks, first major study into package hallucination finds.

By John E. Dunn

02 Oct 2024 1 min

Application SecuritySecurity

SAP SE revamps application security scanning using simulation and automation

SAP’s award-winning FioriDAST project mimics user and attacker behavior to safeguard its web applications. While hackers target companies of all sizes, a tech giant like SAP may have a bigger bull’s eye on its back because of the sensitive data it manages and the critical role its ERP applications play in global businesses.

By Shane O'Neill

26 Sep 2024 5 mins

Application Security

Download our AI security posture management (AI-SPM) enterprise buyer’s guide

Widespread adoption of generative AI across businesses has increased the need for contingencies, including AI security software. Here, we examine nine vendors’ tools that handle AI security posture management (AI-SPM).

By David Strom

24 Sep 2024 1 min

Application SecurityEnterprise Buyer’s GuidesSecurity Monitoring Software

The 18 biggest data breaches of the 21st century

Data breaches affecting millions of users are far too common. Here are some of the biggest, baddest breaches in recent memory.

By Michael Hill, Dan Swinhoe and John Leyden

12 Sep 2024 18 mins

Data BreachMalwarePhishing

Application detection and response is the gap-bridging technology we need

There are many good reasons to embrace ADR as a security staple and a whole lot more why other technologies can’t address all the security needs of applications running out there in the wild.

By Chris Hughes

12 Sep 2024 7 mins

Application SecurityDevSecOpsEndpoint Protection

What is OWASP? A standard bearer for better web application security

The Open Web Application Security Project (OWASP) is an international nonprofit dedicated to providing free documentation, tools, videos, and forums for anyone interested in improving the security of their web applications.

By Linda Rosencrance

28 Aug 2024 8 mins

Application SecurityIT SkillsInternet Security

Bug bounty programs take root in Russia — with possible far-reaching implications

International sanctions, IT isolation, and shifting attitudes to ethical hacking have bug bounty programs on the rise in Russia, with zero-day acquisition companies potentially poised to profit.

By Sarah Wiedemar

27 Aug 2024 7 mins

Application SecurityTechnology Industry

6 hot cybersecurity trends — and 2 going cold

Artificial intelligence is altering not only the threat landscape but also how security teams can defend their organizations. But AI isn’t the only trend cybersecurity pros should be on top of.

By Neal Weinberg

06 Aug 2024 11 mins

AuthenticationPasswordsPhishing

NHIs may be your biggest — and most neglected — security hole

Because IT has so little visibility into non-human identities, attackers are increasingly seeking them out as ultra-easy onramps to everything of value in your enterprise. The solution? Stop treating NHIs as though they are another human end-user.

By Evan Schuman

23 Jul 2024 9 mins

Application SecurityIdentity and Access ManagementNetwork Security

View all

Explore a topic

Show me more

Critical Windows LDAP flaw could lead to crashed servers, RCE attacks

By Lynn Greiner

03 Jan 20253 mins

Active DirectoryVulnerabilitiesWindows Security

US government sanctions Chinese cybersecurity company linked to APT group

By Lucian Constantin

03 Jan 20254 mins

Advanced Persistent ThreatsGovernmentHacker Groups

Secure by design vs by default – which software development concept is better?

By Chris Hughes

03 Jan 202511 mins

DevSecOpsDevelopment ApproachesSecurity Practices

CSO Executive Sessions: Guardians of the Games – How to keep the Olympics and other major events cyber safe

07 Aug 202417 mins

CSO and CISO

CSO Executive Session India with Dr Susil Kumar Meher, Head Health IT, AIIMS (New Delhi)

17 Jul 202417 mins

CSO and CISO

CSO Executive Session India with Charanjit Bhatia, Head of Cybersecurity, COE, Bata Brands

08 Jul 202418 mins

CSO and CISO

CSO Executive Sessions: Open Source Institute’s Eric Nguyen on supply chain risks to critical infrastructure (Part 2)

14 Nov 202415 mins

Critical InfrastructureIT GovernanceSupply Chain

CSO Executive Sessions: Open Source Institute’s Eric Nguyen on supply chain risks to critical infrastructure (Part 1)

04 Nov 202419 mins

Critical InfrastructureSecuritySupply Chain

CSO Executive Sessions: Standard Chartered’s Alvaro Garrido on cybersecurity in the financial services industry

23 Oct 202410 mins

Financial Services IndustrySecurity

The CSO guide to top security conferences

Black Hat: Latest news and insights

Amazon refuses Microsoft 365 deployment because of lax cybersecurity

How to turn around a toxic cybersecurity culture

The 7 most in-demand cybersecurity skills today

Securing cloud-native applications: Why a comprehensive API security strategy is essential

Mitel MiCollab VoIP authentication bypass opens new attack paths

Rising ClickFix malware distribution trick puts PowerShell IT policies on notice

Misconfigurations can cause many Microsoft Power Pages sites to expose sensitive data

Articles

Put a Stop to SaaS Sprawl without Limiting Employee Autonomy

Beware malicious NPM packages, Checkmarx warns

Top 5 security mistakes software developers make

LLMs hallucinating non-existent developer packages could fuel supply chain attacks

SAP SE revamps application security scanning using simulation and automation

Download our AI security posture management (AI-SPM) enterprise buyer’s guide

The 18 biggest data breaches of the 21st century

Application detection and response is the gap-bridging technology we need

What is OWASP? A standard bearer for better web application security

Bug bounty programs take root in Russia — with possible far-reaching implications

6 hot cybersecurity trends — and 2 going cold

NHIs may be your biggest — and most neglected — security hole

Resources

The 15 Top Data Detection and Response Use Cases

2024 True Cost of a Security Breach

The Future of Access Management: Identity Security Requirements for a Modern Application Process

Podcasts

A Hard Look at Software Security

Frequency matters: the case for scanning early and often, part 2

Unresolved flaws: security debt grows deeper

Video on demand

What’s ahead for cybersecurity in 2019: TECH(talk)

6 security reasons to upgrade to Windows 10

Don’t ignore application security | Salted Hash Ep 35

The difference between red team engagements and vulnerability assessments | Salted Hash Ep 34

Explore a topic

Show me more

Critical Windows LDAP flaw could lead to crashed servers, RCE attacks

US government sanctions Chinese cybersecurity company linked to APT group

Secure by design vs by default – which software development concept is better?

CSO Executive Sessions: Guardians of the Games – How to keep the Olympics and other major events cyber safe

CSO Executive Session India with Dr Susil Kumar Meher, Head Health IT, AIIMS (New Delhi)

CSO Executive Session India with Charanjit Bhatia, Head of Cybersecurity, COE, Bata Brands

CSO Executive Sessions: Open Source Institute’s Eric Nguyen on supply chain risks to critical infrastructure (Part 2)

CSO Executive Sessions: Open Source Institute’s Eric Nguyen on supply chain risks to critical infrastructure (Part 1)

CSO Executive Sessions: Standard Chartered’s Alvaro Garrido on cybersecurity in the financial services industry