Love them or hate them, large language models (LLM) are here to stay. After opening the Pandora’s Box of ChatGPT in late 2022, everyone from developers to grandmas began using the tool to get the answers they wanted – and fast. As with every other new technology, ChatGPT created a new set of security risks, […]
READ MOREImagine yourself standing in a local fair at night. The bright lights from the games beckon you, and you see your favorite game, the one you’re best at – Whack-A-Mole. You excitedly walk up to the booth, plunk down your few dollars, and get ready to whack a bunch of plastic, animatronic moles back into […]
Introduction In the world of software development, managing dependencies is like keeping the gears of a well-oiled machine running smoothly. Get ready to dive deep into practical strategies and tools that streamline your development process, ensuring your projects are as efficient and error-free as possible. This is your guide to mastering dependency management, making every […]
Introduction SQL Injection: It’s like the pesky mosquito of web security, always buzzing around, looking for a way to suck the life out of your database. But don’t break out the bug spray just yet; we’ve got two powerful tools to swat this bug: Parameterized Queries and Stored Procedures. So, let’s roll up our sleeves […]
Imagine an application that doesn’t contain any data. You most likely read that sentence and thought, “Then that application is pretty pointless from a business perspective.” Business applications offer value precisely because users can ask questions and get answers. However, the application typically needs to query a database to get those answers and SQL is […]
While Bugs Bunny and company may be part of your favorite childhood memories, the Looney Tunables vulnerability could become one of your worst nightmares. CVE-2023-4911 remains under analysis but comes with a base Common Vulnerability Scoring System (CVSS) score of 7.8 (high). Primarily impacting Fedora, Ubuntu, and Debian, the easily exploitable buffer overflow vulnerability gives […]
As a developer, you know that the first rule of secure code club is to use trusted third-party repositories. However, threat actors engaging in software supply chain attacks target the trusted sources precisely because they know that developers are likely to use them. For example, in a recent blog post, a security researcher explained how […]
Software and application development has changed significantly with the introduction of cloud-based services. Historically, developers write code on local desktops or laptops, meaning attackers needed to compromise the physical device. Further, this limited malicious actors’ ability to compromise the entire source code because no single developer had it stored on their device in its entirety. […]
“It was a dark and stormy night…” While this introduction works for spooky stories, no developer wants their app to become nightmare fuel. While you might be able to grab a flashlight to comfort yourself around a campfire, you don’t have the same protection when you’re working on an application. Increasingly, developers use third-party code […]
Containers are your continuous integration and deployment (CI/CD) workhorse. Your software development processes could exist without them, but the question becomes, “Do you really want to though?” Typically, the answer to that question is “no.” Simultaneously, as you shift security left, your DevOps processes increasingly transform into DevSecOps, adding new responsibilities. Your container runtime is […]
Introduction Let’s dive into the fascinating world of web security, specifically discussing a notorious threat – clickjacking. Imagine a user clicking on a button thinking they like a photo but instead transferring money from their bank account. Scary, right? That’s clickjacking for you. This threat not only compromises user trust but can also deal a […]
As the neverending stream of publications implementing Executive Order (EO) 14028 continue to drop, the National Institute of Standards and Technology (NIST) continues to provide additional guidance. At the end of August 2023, NIST released its most recent draft Special Publication (SP) 800-204D “Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD […]
© 2024 Qwiet. All rights reserved.