One of the most serious vulnerabilities that affects web applications, APIs, and microservices are the Insecure Direct Object References (IDOR). It is a design flaw characterized by allowing uncontrolled access to sensitive data without proper authorization. Some recent examples of Insecure Direct Object References breaches are the USPS API bug that exposed 60 million records, […]
Over the years, Web Application Firewalls (WAF) have become a mainstream application protection mechanism and as a result they enjoy a broad market penetration. However, as we have described before, WAFs are falling out of the limelight. Research firms such as Gartner started recommending other protection alternatives in 2017. Some of the main drivers behind […]
Agile protection, and more broadly, agile application security, brings adaptability and automation to application security. It fits nicely with DevOps, one of the main trends today in application development. As you probably know, DevOps introduces automation into the SDLC by treating everything as code. This includes treating as code elements such as server infrastructure, deployment […]
Insecure Deserialization, also known as Untrusted Deserialization, is a serious category of Application Security issues potentially affecting most modern systems. In fact, Insecure Deserialization is part of the OWASP Top 10 ranking of risks, as of the current edition (2017). Some recent application security incidents involving Insecure Deserialization vulnerabilities are the following: CVE-2019-6503 Affects Chatopera, […]
In today’s complex Software Development Lifecycle practices, many of its main actors –if not all– are involved in Application Security. These actors include developers, the ops team, infosec specialists, QA, red/blue teams, etc. From all these actors, developers are surely a critical element in ensuring that the apps are free from security issues. We believe […]
For the third year in a row Hdiv participated in the RSA Conference which took place at the Moscone Center in San Francisco. As one of the leading conferences in the cybersecurity space, the event congregated around 40,000 security professionals, and around 600 companies exhibited. 1. The WAF Replacement The main message that Hdiv brought […]
Get latest developments in web application security, DevSecOps, and cloud security from the Hdiv Security blog.
