DevSec Blog

DevSecOps, Application Security technical articles and learning materials from experienced security engineers

  • All
  • Application Security
  • Vulnerability Management
Broken Function Level Authorization — Web API Security Champion Part V
July 16, 2024

Broken Function Level Authorization — Web API Security Champion Part V

Presenting an Unrestricted Resource Consumption vulnerability class using a password reset feature as an example.
June 17, 2024

Unrestricted Resource Consumption in a Password Reset — Web API Security Champion Part IV

Broken Object Property Level presented in a practical way with methods for identifying and preventing vulnerabilities based on OWASP.
May 26, 2024

Web API Security Champion Part III: Broken Object Property Level Authorization (OWASP TOP 10)

Explaining one of the most common web API vulnerability classes - Broken Authentication in a practical manner. Providing a case study example based on the Damn Vulnerable RESTaurant API, including methods for identifying and preventing these vulnerabilities.
May 6, 2024

Web API Security Champion Part II: Broken Authentication (OWASP TOP 10)

A review of DefectDojo Pro — a paid version of a well-known vulnerability management solution: Does DefectDojo Pro address all the pain points of DefectDojo OWASP Edition?
May 5, 2024

Comparing DefectDojo Pro and OWASP Edition for DevSecOps

Defect Dojo
May 5, 2024

Vulnerability Management with DefectDojo — is it great for DevSecOps?

Exploit Prediction Scoring System
April 27, 2024

Prioritising Vulnerabilities Remedial Actions at Scale with EPSS

Explaining one of the most common web API vulnerability classes - Broken Object Level Authorization in a practical manner. Providing a case study example based on the Damn Vulnerable RESTaurant API, including methods for identifying and preventing these vulnerabilities.
April 17, 2024

Web API Security Champion: Broken Object Level Authorization (OWASP TOP 10)

Introduction to a security code challenge dedicated to developers and ethical hackers. This challenge focuses on identifying and fixing web API security vulnerabilities in a Python FastAPI-based restaurant API.
April 1, 2024

Security Code Challenge for Developers & Ethical Hackers – The Damn Vulnerable RESTaurant

OSV Scanner Logo
March 28, 2024

Using osv-scanner – Software Composition Analysis from Google

Does DevSecOps Engineer need programming skills? What is the value of utilising Python for security purposes? What you need to learn to automate security at scale? This article will answer these questions.
March 27, 2024

Python for DevSecOps and Any Security Engineer

Detecting malicious Android applications
March 19, 2024

Detecting Banker Malware Installed on Android Devices

This article covers automated SBOM projects tracking with Dependency-Track. It presents how SBOM can be uploaded to Dependency-Track via API.
March 7, 2024

A Practical Approach to SBOM in CI/CD Part III — Tracking SBOMs with Dependency-Track

Dependency-Track
March 7, 2024

A Practical Approach to SBOM in CI/CD Part II — Deploying Dependency-Track

Screenshot Presenting CycloneDX JSON
March 7, 2024

A Practical Approach to SBOM in CI/CD Part I — CycloneDX

Presenting an introduction Static Application Security Testing with examples how SAST and secrets detection can be implemented in SDLC. This article covers what is SAST and its advantages. Furthermore, it describes how SAST can be included in various SDLC stages with real world examples.
February 20, 2024

Introduction to Security in SDLC with SAST for Developers and Security Engineers