Automated Rapid7 reports with python
This blog post describes how to collect information from a popular DAST platform, create a simple report and share it with development teams using a popular collaboration platform like Slack.
2022
Detect open source vulnerabilities in Gradle projects with Github actions
Software Composition Analysis (SCA) is the automated process of analyzing libraries and open source software with the aim of identifying publicly disclosed vulnerabilities, as well as license usage for compliance reasons.
Detect hardcoded secrets using Github actions
Production passwords, tokens, AWS credentials and other types of secrets should be kept confidential and away from preying eyes of hackers or malicious insiders. In simple terms, no one should know production passwords for databases, admin passwords, AWS credentials etc unless there are legitimate business reasons that mandate to do so. Therefore, keeping these secrets hard-coded in Github repositories must be strictly prohibited.
Experiences and lessons from holding a ISC2 CSSLP certification
(ISC)² is one of the biggest organizations in education and certifications tailored for cybersecurity professionals. Their Certified Software Security Lifecycle Professional, aka CSSLP is their certification for Application Security. According to (ISC)²:
It shows employers and peers you have the advanced technical skills and knowledge necessary for authentication, authorization and auditing throughout the SDLC using best practices, policies and procedures established by the cybersecurity experts at (ISC)².
Github GraphQL for AppSec metrics
GraphQL is a powerful way of interacting with an API to fetch a data object containing all, or at least most information that you need. It resembles REST in the way it works, but it's more powerful and faster. Instead of using multiple requests to query the server for different pieces of data that need to be stitched together, GraphQL allows to fetch a single custom defined object with a single call.