DevSecOps Best Practices
You’ve decided to integrate DevSecOps into your software development operations. That’s an important first step to improving your product’s overall security by including it into the development...
Security Journey Blog
Here you’ll find the latest news, information, and trends in application security and compliance, plus tips and strategies for writing safer code and building a security culture.
Stay Up-to-Date on all Security Journey news and events.
Featured Articles
Security Journey Unveils Developer Manifesto as the Foundation for a Reimagined Platform in the Age of AI
The manifesto guides a developer-first platform experience with hands-on AI/LLM security training, GitHub-driven risk...
5 Types of Data You Should NEVER Share with AI
Large language models (LLMs) like ChatGPT are powerful tools, but it's crucial to remember that data privacy is paramount.
Read More
What Is DevSecOps?
DevOps, that combination of software development and IT operations, is designed to improve the development life cycle, getting software to market quicker and improve overall deployment.
What is PCI Compliance?
If your organization accepts credit card payments, you should be familiar with PCI DSS compliance. No matter your company size -- or how many credit card transactions you process - you are required...
What Are Security Champion Responsibilities?
Your company has decided to add security champions to improve your overall security postures, and you’ve chosen great candidates to take on this role.
Drupalgeddon2 (CVE-2018-7600) Vulnerability
Drupal is the second most popular Content Management System (CMS) in the world. According to BuiltWith, more than 637,360 websites currently use Drupal.
Apache Struts 2 Namespace (CVE-2018-11776) Vulnerability
On 22 August 2018, a Semmle security researcher disclosed a critical vulnerability affecting the versions
2.3 to 2.3.34 and 2.5 to 2.5.16 of Apache Struts 2, one of the most used Java-based web application frameworks.
How Do You Select Security Champions?
Security champions should be an integral part of your security team. When this position was first introduced five or so years ago as part of the cybersecurity structure, the security champion was...
HackEDU Partners with HackerOne to Expand Hacker101 Training
Software Developer Accountability
Many of our customers have used other secure development training in the past. One of the biggest complaints we hear is that developers just click through the slides or fast forward the videos and don’t really pay attention.
Public Vulnerability Sandboxes
HackEDU has added a new Public Vulnerabilities offering to enhance the training experience. Public vulnerabilities are sandboxes with vulnerabilities that have been disclosed in popular software products such as Drupal, Struts 2, Wordpress, etc.
Top 6 Application Security Must Dos with Limited Resources
The vast majority of application security teams are under resourced. The ideal is that application security teams will scale with development teams, but this rarely happens. Given this disadvantage,...
OWASP Top 10 Mini Series - Command Injection Cheat Sheet
Command injection is similar to SQL injection, but instead of injecting into a SQL query, you are injecting a command into the Operating System. User data can be input to alter the intent of the command that is being executed.