Fortress Information Security’s Post

Just came across a 2024 Checkmarx study shows SAST, even today, has only about a 60% true positive rate and hovering just below a 40% false positive rate. Sit on that for a second: about 40% of the things SAST tells you aren't real problems, and you're suppose to run a business prioritizing fixing security. How do you do that? We created Mayhem to solve this problem. There isn't any magic pill that will improve things for SAST; the accuracy problem is rooted in the approach. So we had to take a different approach at Mayhem You can find the checkmarx study here: https://lnkd.in/eg7YNuhJ P.S. - This is why hackers don't use SAST, and they use technology like #mayhem. #sast #hacking #cybersecurity

4th July weekend reading: SolarWinds, Kaseya, Codecov. What do they have in common? They’ve all suffered software supply chain attacks. Explore how to beef up your secure software supply chain with 9 killer strategies #applicationsecurity #softwaredevelopment #supplychainsecurity #supplychain #cybersecurity #codesigning https://lnkd.in/dx2Hqsee

Software supply chain security is undergoing a significant shift. While the number of compromised software packages has decreased, the impact on customers has surged. Recent statistics show a 20% drop in affected packages from 2022 to 2023, yet the number of impacted customers has skyrocketed by 392%. Our Founder and CEO, Joe Saunders Saunders, was featured in an IT Brew article discussing this alarming trend. He emphasizes that attackers are becoming more strategic, focusing on popular libraries to maximize their impact. Read the full story here: https://lnkd.in/ebt54Hee #CyberSecurity #SupplyChainSecurity #CyberResilience 

Recent CrowdStrike Falcon sensor issues causing BSODs highlight the critical importance of robust testing. A "confluence" of vulnerabilities and testing gaps led to this incident. It's essential to allocate adequate resources for rigorous patch testing to prevent unintended consequences. #cybersecurity #ITsecurity #patchmanagement https://lnkd.in/dyChTc-A

Ready to enhance your web application security? Dive into our latest blog post, "Fortifying Your Web Applications," where we explore essential strategies and best practices to protect against evolving threats. 🛡️⚙️ #WebSecurity #SecureCoding #Cybersecurity https://lnkd.in/gays89X7

Upgrade your AppSec approach with Fortify on Demand—your ultimate #AppSec solution. Secure your applications and #data today. Don't wait for a security breach to act! 🔒 #Cybersecurity

The term #FatClients refers to desktop applications which, unlike web applications, are installed on the user's local end device. #Vulnerabilities in such applications can give attackers access to the server-side business logic of a user's entire application landscape - including all of the data stored there. In our news blog we take a look at the vulnerabilities that our security analysts repeatedly encounter in their #pentests of fat clients and give tips on how to avoid them. #Pentest #Penetrationtest #CyberSecurity #ThickClient #moresecurity

Third-party software supply chains still keep CISOs up at night! Modern software development, with frequent updates and reliance on open-source code, creates a complex web of security vulnerabilities for CISOs. This insightful CSO Online article written by David Strom explores the challenges and the need for innovative solutions. Give it a read >> https://lnkd.in/eQswaCMP #SoftwareSecurity #SupplyChainRisk #OpenSourceSecurity #DevSecOps #Cybersecurity #CloudSecurity

Memory safety issues, a long-standing problem in software, are a focus of the Cybersecurity and Infrastructure Security Agency's secure-by-design initiative, advocating for memory safe languages like Rust. But Google Chromium and Microsoft report 70% of their high severity issues are memory safety related. The Horizon3.ai Attack Team has analyzed all critical vulnerabilities from the CISA #KEV catalog over the past year, categorized the vulnerability root causes, and analyzed if efforts in the #infosec industry match the threat vectors being abused. Visit https://lnkd.in/gRGjrhX7 for more. #NodeZero #cybersecurity #pentesting