Security
Articles
 |
DevSecOps: Incorporate Security into DevOps to Reduce Software Risk DevSecOps is a growing movement to incorporate security into DevOps practices in order to ensure flaws and weaknesses are exposed early on through monitoring, assessment, and analysis, so remediation can be implemented far earlier than traditional efforts. By failing fast with security testing, organizations reduce risk of a security incident and decrease the cost of rework. |
|
 |
Conducting Security Testing for Web Applications As cyber attacks continue to create panic, the threat to our applications and data in the digital sphere grows stronger. Enterprises in the connected world need to realize that security testing is essential for their web applications. They need modern, all-inclusive security testing plans from the inception of their projects to ensure a secure user experience. Here's how to get started. |
|
 |
IoT Security Should Start with the UI Setup IoT security is a large and changing topic, but there is one basic starting point where device security can be improved during development and testing: the user interface. The UI should be the first line of defense, but it’s currently weak in most IoT devices. Implementing better practices during the initial UI setup will go a long way toward improving security. |
|
 |
What IoT and Embedded Device Testers Can Learn from the Volkswagen Emissions Scandal In 2015, it was discovered that Volkswagen had equipped millions of its cars with software to cheat on diesel emissions tests. It was a team of independent testers that uncovered the fraud. Jon Hagar tells testers what they can take away from the scandal and gives some recommendations to consider in order to improve the test industry for IoT and embedded systems. |
Interviews
 |
Automated Security Scanning in Your Delivery Pipeline: An Interview with Matt Grasberger
Video
Matt Grasberger, a software consultant at Coveros Inc., discusses shifting left security scans that you can do quickly and easily and the open source tools that are available to utilize early in the application development process to ensure you are not introducing new vulnerabilities. |
|
 |
Security Testing for Test Professionals: An Interview with Jeff Payne
Video
Jeff Payne, CEO and founder of Coveros Inc., discusses the need for testers to incorporate security testing into development from the beginning. He also details some of the open source and commercial tools available for finding and resolving security problems. |
|
 |
Understanding the Role of QA in DevOps: An Interview with Gene Gotimer
Video
Gene Gotimer, senior architect at Coveros Inc., discusses understanding the role of QA in DevOps, DevOps educational tools, trusting your team, and paid and open source security tools. |
|
 |
Giving Control Back to Software Developers: An Interview with Mike Faulise
Video
In this interview, Michael Faulise, the founder and managing partner at tap|QA, explains how the move toward DevOps and away from release management is giving control back to developers, then details why major companies often need partners to leverage CI, CD, and other modern techniques. |
Better Software Magazine Articles
 |
What if Someone Steals Your Code? Bob Zeidman, an expert in software forensics, provides a great overview of how to protect your software from predators. You'll learn the difference between copyrights, trade secrets, and patents. |
|
 |
Pitfalls of Developing for the IoT The Internet of Things (IoT) enables amazing software-powered devices designed to make our business and personal lives easier. Lev Lesokhin discusses four fundamental practices you'll need when developing sophisticated software for the IoT. |
|
 |
Your Professional Responsibility for Security and Performance It is Johanna Rothman's belief that security and performance are no longer nonfunctional requirements in modern-day software development. Instead, we must prepare to accommodate security and performance needs in all projects. |
|
 |
A Radical View of Software Licensing and Piracy Software vendors are making extraordinary efforts to protect the installation and use of apps, but have they gone too far? Preventing software piracy can have an adverse effect on genuine users. Software licensing technology, according to Steve, needs to strike the best balance of protecting the asset while trusting the customer. |
Conference Presentations
 |
Security Partners or Security Police?
Slideshow
It’s often said that with great power comes great responsibility. As technology becomes more powerful, security becomes a great responsibility. You’ve read all the books, followed the latest updates on all the blogs and forums, or maybe you just have a gut feeling that there’s a potential for disaster. As software testers, is it our job to be the security police? If you don’t protect the public, who will? Then there is the business—who is going to protect them from themselves? You go into meetings ready to save the day only to be shot down or, even worse, ignored. What went wrong? Why were you so easily dismissed? Join Janna Loeffler and Yesenia Yser as they talk about how to be the Secret Service of software security instead of the security police. They’ll talk about some simple actions you can take to increase the security of your software without policing it. |
Janna Loeffler
|
 |
Visual Regression Testing: A Critical Part of a Mobile Testing Strategy
Slideshow
There are many types of testing that companies need to perform in order to have confidence in their product: security testing, integration testing, system testing, performance testing, and more. Often, mobile developers focus on ensuring that main end-to-end flows of their applications work by relying on frameworks like Appium or Robotium. However, in the mobile domain, visual testing is essential because mobile devices differ drastically in capabilities, display dimensions, and even operating systems. Visual regression testing targets specific areas of visual concepts like layouts, responsive design, graphics, and CSS. Because modern mobile applications are built as hybrid and native applications, there is no way to scale this sort of testing using manual resources, so visual test automation must be a crucial piece of the testing stack. |
Dmitry Vinnik
|
 |
Serverless Security: Overcome Architectural Security Challenges
Slideshow
Serverless architectures take the idea of microservices to the extreme. To implement secure serverless architectures, you have to understand how to compartmentalize programs at the function level. You also need to factor in security practices: Serverless architectures are susceptible to traditional attacks such as SQL injection and command injection, along with a wide variety of privilege escalation and sensitive data disclosure attacks. Developers must consider what would happen if an attacker attempted to invoke each of their functions directly. What if one of those functions were to become nonresponsive? Designing, implementing, and maintaining serverless architectures dramatically increases the complexity of security. Join Eric Sheridan as he discusses how to implement distributed, secure identity management and entitlement enforcement across 250+ functions. |
Eric Sheridan
|
 |
DevSecOps in the Age of Containers
Slideshow
As IT shops look to move their workloads into containers and the cloud, their initial concerns often center around the security implications. Containers do force us to change how we think about securing our application, but they also offer exciting new opportunities. Curtis Yanko will explore the security concerns that come along with containers and take a deep dive into container composability and how modern tooling makes it possible to automate security and compliance concerns across the entire application stack. Curtis will share a project via GitHub that has a reference Jenkins pipeline demonstrating how to automate security and compliance at build time. You will take home ideas for minimizing attack surface, avoiding known bad libraries and frameworks, validating your configuration, and using machine learning to model application behavior. |
Curtis Yanko
|
Recommended Web Seminars
Featured Resources
Visit Our Other Communities
StickyMinds is a TechWell community.
Through conferences, training, consulting, and online resources, TechWell helps you develop and deliver great software every day.