Willkommen bei der CloudSec Academy, Ihrem Leitfaden zum Navigieren in der Buchstabensuppe der Cloud-Sicherheitsakronyme und des Branchenjargons. Heben Sie sich von der Masse ab mit klaren, prägnanten und fachmännisch gestalteten Inhalten, die von den Grundlagen bis hin zu Best Practices reichen.
Application security refers to the practice of identifying, mitigating, and protecting applications from vulnerabilities and threats throughout their lifecycle, including design, development, deployment, and maintenance.
Strengthen applications with secure coding to fix injection flaws, enforce access controls, and follow OWASP best practices.
Explore how IaC security protects cloud environments by embedding protection into code templates to catch vulnerabilities early.
Shift-Left-Sicherheit ist die Praxis, Code- und Software-Sicherheitssicherungsprozesse so früh wie möglich im Softwareentwicklungslebenszyklus (SDLC) durchzuführen.
Erfahren Sie, wie eine Software Bill of Materials (SBOM) die Sicherheit stärkt, indem sie Komponenten verfolgt, Schwachstellen identifiziert und die Einhaltung von Vorschriften sicherstellt.
Cloud IDEs allow developers to work within a web browser, giving them access to real-time collaboration, seamless version control, and tight integration with other cloud-based apps such as code security or AI code generation assistants.
Secure SDLC (SSDLC) is a framework for enhancing software security by integrating security designs, tools, and processes across the entire development lifecycle.
DAST, or dynamic application security testing, is a testing approach that involves testing an application for different runtime vulnerabilities that come up only when the application is fully functional.
IAST (Interactive Application Security Testing) is a security testing method that monitors applications in real-time during runtime to detect vulnerabilities by analyzing code behavior and data flow in live environments.
API-Sicherheit umfasst die Strategien, Verfahren und Lösungen zum Schutz von APIs vor Bedrohungen, Schwachstellen und unbefugten Zugriffen.
Source code security refers to the practice of protecting and securing the source code of an application from vulnerabilities, threats, and unauthorized access.
Infrastructure as code (IaC) scanning is the process of analyzing the scripts that automatically provision and configure infrastructure.
SecDevOps is essentially DevOps with an emphasis on moving security further left. DevOps involves both the development team and the operations team in one process to improve deployment performance and service customers faster.
In this blog post, we’ll explore security measures and continuous monitoring strategies to prevent these leaks, mitigating the risks posed by security vulnerabilities, human error, and attacks.
Secrets detection is the process of identifying and managing sensitive information like API keys, passwords, and tokens within codebases to prevent unauthorized access and data breaches.
Beim Schwachstellen-Scanning werden Sicherheitslücken in IT-Systemen, Netzwerken und Software erkannt und bewertet.
The top 14 open-source application security tools—including SCA, secrets scanning, and application security testing tools—to help you streamline the critical process of securing your apps from threats and vulnerabilities.
A guide on the 9 best OSS API security tools that protect sensitive data, infrastructure, and business logic from unauthorized access, data theft, and other attacks.
Software supply chain security describes the set of processes that ensure the integrity, authenticity, and security of software components throughout their lifecycle.
Cloud app security involves ensuring that both cloud-native and cloud-based apps are protected from vulnerabilities through the use of proper tools and practices.
NIST’s Secure Software Development Framework (SSDF) is a structured approach that provides guidelines and best practices for integrating security throughout the software development life cycle (SDLC).
Application security posture management entails continuously assessing applications for threats, risks, and vulnerabilities throughout the software development lifecycle (SDLC).
SAST (Static Application Security Testing) analyzes custom source code to identify potential security vulnerabilities, while SCA (Software Composition Analysis) focuses on assessing third-party and open source components for known vulnerabilities and license compliance.
Static Application Security Testing (SAST) is a method of identifying security vulnerabilities in an application's source code, bytecode, or binary code before the software is deployed or executed.
In this Academy article, we'll dig into SAST and DAST security testing methods, exploring how they work and their core aspects
In this article, we’ll explore the step-by-step process of code scanning, its benefits, approaches, and best practices.
Open-source security is the collection of tools and processes used to secure and manage the lifecycle of open-source software (OSS) and dependencies from development to production.
Security as Code (SaC) is a methodology that integrates security measures directly into the software development process. It involves codifying security policies and decisions, and automating security checks, tests, and gates within the DevOps pipeline.
The OWASP DevSecOps Maturity Model (DSOMM) is a framework for assessing and improving DevSecOps practices.
Policy as code (PaC) is the use of code to define, automate, enforce, and manage the policies that govern the operation of cloud-native environments and their resources.
While DevOps delineates collaboration and automation practices that emphasize infrastructure provisioning and continuous monitoring, GitOps extends its concepts by employing Git as the single source of truth for both application and infrastructure settings.
Secret scanning is the practice of running automated scans on code repositories, execution pipelines, configuration files, commits, and other data sources to prevent potential security threats posed by exposed secrets.
Security by design is a software development approach that aims to establish security as a pillar, not an afterthought, i.e., integrating security controls into software products right from the design phase.
Two major formats dominate the SBOM ecosystem: Software Package Data Exchange (SPDX) and CycloneDX (CDX). Let’s review!
Code-Sicherheit, auch bekannt als sichere Codierung, bezieht sich auf die Praktiken, Methoden und Tools, die sicherstellen sollen, dass der für Anwendungen und Systeme geschriebene Code vor Schwachstellen und Bedrohungen geschützt ist.
20 essential security best practices every DevOps team should start with
DevSecOps, which stands for Development, Security, and Operations, is a software development practice that emphasizes integrating security considerations throughout the entire development lifecycle, from initial design to deployment and ongoing maintenance.
In this article, we’ll look at the emergence of DevSecOps and then discuss actionable best practices for integrating DevSecOps into your workflows.
Read on for a roundup of top open-source tools that are game-changers when it comes to securing your development and operations pipeline.
SCA-Tools (Software Composition Analysis) indizieren Ihre Softwareabhängigkeiten, um Ihnen einen Überblick über die von Ihnen verwendeten Pakete und alle darin enthaltenen Schwachstellen zu geben.
In this blog post, we’ll take a deep dive into software supply chains and discuss effective strategies for reducing security risks.
This article will give you a refresher on code security and review the most popular open-source code security tools available.
This article will start with a quick refresher on SBOMs and then list the top SBOM-generation tools available.
Malicious code is any software or programming script that exploits software or network vulnerabilities and compromises data integrity.
Continuous integration and continuous delivery (CI/CD) have become the backbone of modern software development, enabling rapid, reliable, and consistent delivery of software products. To bolster your CI/CD pipeline, ensuring resilience against ever-evolving threats, follow the best practices in this guide.
11 essential API security best practices that every organization should start with
The best Infrastructure as Code (IaC) tools, curated by use case and categorized into CSP-specific and CSP-neutral providers.
