Home » Tag Archives: Security (page 8)

Tag Archives: Security

Penetration Testing Shouldn’t be a Waste of Time

software-development-2-logo

In a recent post on “Debunking Myths: Penetration Testing is a Waste of Time”, Rohit Sethi looks at some of the disadvantages of the passive and irresponsible way that application pen testing is generally done today: wait until the system is ready to go live, hire an outside firm or consultant, give them a short time to try to hack ...

Read More »

Weaknesses in Java Pseudo Random Number Generators (PRNGs)

java-logo

This will be a sum up of a Paper written by Kai Michaelis, Jörg Schwenk and me, which was  presented at the Cryptographers’ Track at RSA Conference 2013. You can get the slides of my presentation here and our full Paper here. We performed an analysis on the random sequences generated by common Java libraries shipping with PRNGs (mostly SecureRandom) ...

Read More »

Yes Small Companies Can – and Should – Build Secure Software

software-development-2-logo

‘For large software companies or major corporations such as banks or health care firms with large custom software bases, investing in software security can prove to be valuable and provide a measurable return on investment, but that’s probably not the case for smaller enterprises, said John Viega, executive vice president of products, strategy and services at SilverSky and an authority ...

Read More »

Cryptography Using JCA – Services In Providers

java-logo

The Java Cryptography Architecture (JCA) is an extensible framework that enables you to use perform cryptographic operations. JCA also promotes implementation independence (program should not care about who’s providing the cryptographic service) and implementation interoperability (program should not be tied to a specific provider of a particular cryptographic service). JCA allows numerous cryptographic services e.g. ciphers, key generators, message digests ...

Read More »

Peer reviews for security are a waste of time?

software-development-2-logo

At this year’s RSA conference, one of the panel’s questioned whether software security is a waste of time. A panellist, John Viega, said a few things that I agreed with, and a lot that I didn’t. Especially that “peer reviews for security are a waste of time.” This statement is wrong on every level. Everyone should know by now that ...

Read More »

Add RememberMe Authentication With Spring Security

spring-interview-questions-answers

I mentioned in my post Add Social Login to Jiwhiz Blog that the RememberMe function was not working with Spring Social Security. Well, it is because the application is not authenticating the user by username and password now, and is totally depending on social websites (like Google, Facebook and Twitter) to do the job. The default Spring Security configuration cannot ...

Read More »

Your Password Is No Longer Secret, Part 1

software-development-2-logo

Of course, the title is a trick. Your password is still secret, for now. To be sure that it will remain so, try to answer the following questions to yourself: How strong are your passwords? How strong they should be in order to prevent other people from revealing them? Are your password habits really adequate? Here, I assume that you ...

Read More »

Appsec at RSA 2013

software-development-2-logo

This was my second time at the RSA conference on IT security. Like last year, I focused on the appsec track, starting with a half-day mini-course on how to write secure applications for developers, presented by Jim Manico and Eoin Keary representing OWASP. It was a well-attended session. Solid, clear guidance from people who really do understand what it takes ...

Read More »

How To Secure an Organization That Is Under Constant Attack

software-development-2-logo

There have been many recent security incidents at well-respected organizations like the Federal Reserve, the US Energy Department, the New York Times, and the Wall Street Journal. If these large organizations are incapable of keeping unwanted people off their systems, then who is? The answer unfortunately is: not many. So we must assume our systems are compromised. Compromised is the ...

Read More »
Do you want to know how to develop your skillset and become a ...

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!
Get ready to Rock!
To download the books, please verify your email address by following the instructions found on the email we just sent you.

THANK YOU!

Close