Magecart, a consumer payment credentials stealing operation, has been one of the most effective cybercrime attacks of 2018 and 2019. Often defined as a loosely coordinated group of hackers or as a particular exploit or attack, Magecart has managed to steal millions of consumer credit card information records across dozens of separate campaigns all against […]
DevSecOps, also known as Continuous Application Security, is vastly different from legacy application security programs. This approach essentially requires embedding security practices across the SDLC, rather than running them as a deployment gate or as a purely post-deployment monitoring mechanism. Such integration of security across the SDLC is made possible by incorporating security tools. Traditionally, […]
XML External Entity injection risks, also known as XXE attacks, are one of the most common security issues across applications, APIs, and microservices. Although the XXE family of vulnerabilities is not as popular as SQL injection or XSS attacks, it is present in the OWASP Top 10 ranking of risks, at the 2017:A4 position of […]
One of the most serious vulnerabilities that affects web applications, APIs, and microservices are the Insecure Direct Object References (IDOR). It is a design flaw characterized by allowing uncontrolled access to sensitive data without proper authorization. Some recent examples of Insecure Direct Object References breaches are the USPS API bug that exposed 60 million records, […]
Over the years, Web Application Firewalls (WAF) have become a mainstream application protection mechanism and as a result they enjoy a broad market penetration. However, as we have described before, WAFs are falling out of the limelight. Research firms such as Gartner started recommending other protection alternatives in 2017. Some of the main drivers behind […]
Agile protection, and more broadly, agile application security, brings adaptability and automation to application security. It fits nicely with DevOps, one of the main trends today in application development. As you probably know, DevOps introduces automation into the SDLC by treating everything as code. This includes treating as code elements such as server infrastructure, deployment […]
Get latest developments in web application security, DevSecOps, and cloud security from the Hdiv Security blog.
