Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

To keep up with the ever-evolving cyber threat landscape, application security is a big challenge. Unfortunately, security is often overlooked in the modern software development and delivery framework and assumed as a luxury. Rather than taking a proactive approach, security is incorporated as a reactive approach that increases costs and makes the company suffer losses.

Static Application Security Testing (SAST) is one of the principal techniques for assessing the source code of applications to detect possible vulnerabilities. SAST enhances application security during the early stages of the development life cycle and plays an important role in shifting security left. However, there are quite a few myths that are often associated with implementing SAST security tools. Let’s run through the big three.

SAST is one of the matured security testing methods. In the SAST, the source code is examined from the inside out while components are in a static position. It performs scanning in-house code and design to identify flaws that are reflective of weaknesses, and that could invite security vulnerabilities. The scans performed by SAST tools are dependent upon prior identification of rules that specify coding errors to examine and address.

Organizations that develop mobile apps need to be aware of the potential cyber security threats. These threats can lead to the loss of users' private data, which can have serious repercussions for industries like fintech, healthcare, ecommerce, etc. In order to prevent these malicious practices, Dynamic Application Security Testing (DAST), a security testing tool, has been introduced. It helps to weed out specific vulnerabilities in web applications whenever they run in the production phase.

Golang was the first programming language to support fuzzing as a first-class experience in version 1.18. This made it really easy for developers to write fuzz tests. Golang 1.14 introduced native compiler instrumentation for libFuzzer, which enables the use of libFuzzer to fuzz Go code. libFuzzer is one of the most advanced and widely used fuzzing engines and provides the most effective method for Golang Fuzzing.

We are thrilled to announce that we secured our Series A funding round of $12 Million to fulfill our vision of a world where security is a given, not a hope. The round was led by US-based Tola Capital and introduced experienced business angels such as Thomas Dohmke. We will use the funds to add support for more programming languages, provide further dev tool integrations and grow the team.

For consecutive years, applications have remained the top attack vector for black hats, with supply chain attacks not far behind. At the same time, market research indicates that enterprise security managers and software developers continue to complain that their application security tools are cumbersome. When asked, many developers admit that they don’t run security tests as often as they should, and they push code to production even when they know it has security flaws.

Coverage-guided fuzzers, like Jazzer, maximize the amount of executed code during fuzzing. This has proven to produce interesting findings deep inside the codebase. Only checking validation rules on the first application layer isn’t providing great benefits, whereas verifying logic in and interactions of deeply embedded components is. To extend the amount of covered code, the fuzzer tries to mutate its input in such a way that it passes existing checks and reaches yet unknown code paths.

Application innovation, design, development, quality assurance, and security testing have changed dramatically over the past decade. Engineering teams are leveraging agile development processes, modern cloud platforms, reusable microservices, and extensible APIs, enabling them to shift to more frequent deployments more easily.