Vulnerability Scanning: How it Works, Why it Matters, and What You’ll Find
Wiz Experts Team
Vulnerability scanning is the process of detecting and evaluating security flaws in IT systems, networks, and software.
CloudSec Academy
Welcome to CloudSec Academy, your guide to navigating the alphabet soup of cloud security acronyms and industry jargon. Cut through the noise with clear, concise, and expertly crafted content covering fundamentals to best practices.
Top 14 OSS Application Security Tools by Use Case
The top 14 open-source application security tools—including SCA, secrets scanning, and application security testing tools—to help you streamline the critical process of securing your apps from threats and vulnerabilities.
Top 9 OSS API Security Tools
Wiz Experts Team
A guide on the 9 best OSS API security tools that protect sensitive data, infrastructure, and business logic from unauthorized access, data theft, and other attacks.
Cloud Application Security: Basics and Best Practices
Cloud app security involves ensuring that both cloud-native and cloud-based apps are protected from vulnerabilities through the use of proper tools and practices.
The Secure Software Development Framework (SSDF)
NIST’s Secure Software Development Framework (SSDF) is a structured approach that provides guidelines and best practices for integrating security throughout the software development life cycle (SDLC).
What is ASPM? [Application Security Posture Management]
Application security posture management entails continuously assessing applications for threats, risks, and vulnerabilities throughout the software development lifecycle (SDLC).
SAST vs. SCA: What's the Difference?
SAST (Static Application Security Testing) analyzes custom source code to identify potential security vulnerabilities, while SCA (Software Composition Analysis) focuses on assessing third-party and open source components for known vulnerabilities and license compliance.
Static Application Security Testing (SAST) Explained
Static Application Security Testing (SAST) is a method of identifying security vulnerabilities in an application's source code, bytecode, or binary code before the software is deployed or executed.
SAST vs. DAST: What’s the difference?
In this Academy article, we'll dig into SAST and DAST security testing methods, exploring how they work and their core aspects
Secure Code Scanning: Basics & Best Practices
In this article, we’ll explore the step-by-step process of code scanning, its benefits, approaches, and best practices.
Open-source security: Best practices and tools
Open-source security is the collection of tools and processes used to secure and manage the lifecycle of open-source software (OSS) and dependencies from development to production.
What is Security as Code (SaC)?
Security as Code (SaC) is a methodology that integrates security measures directly into the software development process. It involves codifying security policies and decisions, and automating security checks, tests, and gates within the DevOps pipeline.
The OWASP DevSecOps Maturity Model (DSOMM)
Wiz Experts Team
The OWASP DevSecOps Maturity Model (DSOMM) is a framework for assessing and improving DevSecOps practices.
What is Policy as Code?
Policy as code (PaC) is the use of code to define, automate, enforce, and manage the policies that govern the operation of cloud-native environments and their resources.
What is SecDevOps? + How It Differs From DevSecOps
SecDevOps is essentially DevOps with an emphasis on moving security further left. DevOps involves both the development team and the operations team in one process to improve deployment performance and service customers faster.
GitOps vs. DevOps
While DevOps delineates collaboration and automation practices that emphasize infrastructure provisioning and continuous monitoring, GitOps extends its concepts by employing Git as the single source of truth for both application and infrastructure settings.
Secret scanning: How it works and best practices
Secret scanning is the practice of running automated scans on code repositories, execution pipelines, configuration files, commits, and other data sources to prevent potential security threats posed by exposed secrets.
What is Security by Design?
Wiz Experts Team
Security by design is a software development approach that aims to establish security as a pillar, not an afterthought, i.e., integrating security controls into software products right from the design phase.
Guide to Standard SBOM Formats
Wiz Experts Team
Two major formats dominate the SBOM ecosystem: Software Package Data Exchange (SPDX) and CycloneDX (CDX). Let’s review!
Code Security
Code security, also known as secure coding, refers to the practices, methodologies, and tools designed to ensure that the code written for applications and systems is secure from vulnerabilities and threats.
SBOM Security
A Software Bill of Material (SBOM) is a comprehensive inventory that details every software component that makes up an application.
DevOps Security Best Practices
20 essential security best practices every DevOps team should start with
What is DevSecOps?
DevSecOps, which stands for Development, Security, and Operations, is a software development practice that emphasizes integrating security considerations throughout the entire development lifecycle, from initial design to deployment and ongoing maintenance.
DevSecOps Best Practices Checklist
Wiz Experts Team
In this article, we’ll look at the emergence of DevSecOps and then discuss actionable best practices for integrating DevSecOps into your workflows.
Secure Coding Explained
Secure coding is the practice of developing software that is resistant to security vulnerabilities by applying security best practices, techniques, and tools early in development.
DevSecOps Tools: 11 Open-Source Tools By Use Case
Wiz Experts Team
Read on for a roundup of top open-source tools that are game-changers when it comes to securing your development and operations pipeline.
Software Composition Analysis (SCA)
Wiz Experts Team
Software composition analysis (SCA) tools index your software dependencies to give you visibility into the packages you're using and any vulnerabilities they contain.
Software Supply Chain Security Best Practices
Wiz Experts Team
In this blog post, we’ll take a deep dive into software supply chains and discuss effective strategies for reducing security risks.
The Open-Source Code Security Tool Roundup
Wiz Experts Team
This article will give you a refresher on code security and review the most popular open-source code security tools available.
The Top 11 Open-Source SBOM tools
This article will start with a quick refresher on SBOMs and then list the top SBOM-generation tools available.
IaC Scanning: Concepts, Process, and Tools
Infrastructure as code (IaC) scanning is the process of analyzing the scripts that automatically provision and configure infrastructure.
Malicious Code Explained
Wiz Experts Team
Malicious code is any software or programming script that exploits software or network vulnerabilities and compromises data integrity.
Secure SDLC
Secure SDLC (SSDLC) is a framework for enhancing software security by integrating security designs, tools, and processes across the entire development lifecycle.
Software Supply Chain Security Explained
Software supply chain security describes the set of processes that ensure the integrity, authenticity, and security of software components throughout their lifecycle.
CI/CD Pipeline Security Best Practices
Continuous integration and continuous delivery (CI/CD) have become the backbone of modern software development, enabling rapid, reliable, and consistent delivery of software products. To bolster your CI/CD pipeline, ensuring resilience against ever-evolving threats, follow the best practices in this guide.
11 API Security Best Practices
11 essential API security best practices that every organization should start with
IaC Security Explained
Infrastructure as Code (IaC) security is the practice of securing cloud infrastructure by embedding security controls into IaC templates and scripts.
Shift Left Explained: What It Means to Shift Security Left
Wiz Experts Team
Shift-left security is the practice of performing code and software security assurance processes as early as possible in the software development lifecycle (SDLC).
What is API security?
API security encompasses the strategies, procedures, and solutions employed to defend APIs against threats, vulnerabilities, and unauthorized intrusion.
Best Infrastructure as Code (IaC) Tools [By Use Case]
The best Infrastructure as Code (IaC) tools, curated by use case and categorized into CSP-specific and CSP-neutral providers.