Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Shandra Gemmiti
Software Composition Analysis (SCA) Archives
Understanding Application Detection and Response (ADR) | Contrast Security | | ADR, API security, Application Detection and Response (ADR), Application Security (AppSec), Cybersecurity, Data breach, DevSecOps, Incident Response, Runtime Application Security Protection (RASP), Security Operations Center (SOC), Software Composition Analysis (SCA), Threat Detection and Response, vulnerability, Web Application Firewall (WAF), zero-days The Application Security (AppSec) landscape is changing fast.
The Synopsys Integrated DevSecOps Playbook: Steps for Successful DevSecOps
In late 2023, Synopsys released the “Global State of DevSecOps” report. The report explored crucial topics in the realm of DevSecOps and outlined practical approaches for implementing effective, resilient, and scalable application security (AppSec) approaches. These approaches can help organizations strengthen their AppSec programs in 2024.
Integrating AI in the SDLC: Opportunities & Concerns
In the ever-evolving landscape of software development, artificial intelligence (AI) is emerging as a transformative force, reshaping the software development lifecycle. While AI use is still not without risk, it's time to reframe the conversation and explore how AI can enhance and streamline various stages of the SDLC. Let’s take a look at how you can strategically incorporate AI in the SDLC and address lingering concerns. What is AI?
DevSecOps Best Practices - Strategy Guide
There is a need for a new approach to AppSec—one that handles business risk without obstructing company growth, eliminates the tradeoff between speed and security, and fulfills the DevSecOps promise. Here are four DevSecOps best practices to help your organization realize this vision with an efficient, effective DevSecOps strategy.
Test Mode Enhancements to Defensics Fuzz Testing | Synopsys
Defensics® is the leading fuzz testing solution for discovering unknown vulnerabilities and ensuring system robustness. The tool has been widely adopted across industrial Internet of Things (IoT) and medical devices, as well as telecom network environments to mitigate risks when deploying embedded software. Defensics offers powerful capabilities out of the box for testers to perform protocol testing and hardening checks.
Essential Guide to Container Security
As cloud-native applications continue to proliferate, containers are becoming the preferred option to package and deploy these applications because of the agility and scalability they offer. In fact, that 75% of global organizations are running containerized applications in production. The popularity of containers has also attracted hackers looking for new ways to exploit applications. Containers expand an organization’s attack surface and increase the risk to the applications they house.
How to implement security in Devops
In the world of software development, the need for speed often clashes with the need for security. The concept of DevSecOps aims to bridge this gap by integrating security practices into DevOps processes. In a discussion with Steven Zimmerman, a DevSecOps security solutions manager at the Synopsys Software Integrity Group, he explores the challenges and solutions related to implementing effective DevSecOps. The perception that security testing slows down the development process is a common one.
Tips for reaching DevSecOps maturity
In a recent episode of AppSec Decoded, Taylor Armerding, a security advocate with the Synopsys Software Integrity Group, spoke with resident expert Stephen Zimmerman about DevSecOps. Zimmerman discusses the common perception among developers and operations teams alike that security testing adds friction, hindering development velocity. He offers insights and recommendations on how to properly plan and implement a DevSecOps strategy.
Mobile App Security Testing for Flutter Framework & Dart Programming Language
Synopsys recently introduced static application security testing (SAST) support for the Dart programming language and the Flutter application frameworkto expand our coverage for mobile development teams that are tasked with delivering secure apps on multiple platforms. This builds on our support of more than 20 programming languages and 200 frameworks, and complements our existing Kotlin, Swift, and React Native support with another option for those focused on secure mobile app development.
DevSecOps Practices To Maintain Developer Velocity
By introducing a culture of security into DevOps environments, DevSecOps is designed to address security risks early and consistently. According to the SANS 2023 DevSecOps survey, DevSecOps is a business-critical practice and risk management concern in all organizations focused on software development.
How to Consolidate Effort for Enhanced Application Security
Scattered effort leads to scattered security Navigating the complexities of modern application security presents a formidable challenge for organizations. The multitude of security tools and the effort to implement and maintain them often creates a tangled web of processes, which can result in inconsistent implementations, resource inefficiencies, and a fractured view of risk. Enterprise organizations can have hundreds of developers spread across multiple business units.
Consolidate with Application Security Posture Management
In our previous article, “AppSec Consolidation for Developers: Why You Should Care,” we introduced the reasons why the industry is talking about consolidation. Specifically, we looked at the ways that rapid proliferation of software solutions, including digitalization, cloud adoption and the rise of AI, have become the backbone of business and have posed significant new challenges for development teams.
Shandra Gemmiti
What job role will grow the most in the near term due to increased use of large language models (LLMs) and generative AI? AI engineering is being posited as a new profession that will surpass many existing job roles.
Security Boulevard
The COVID-19 pandemic has driven the world online in remarkable ways, forever changing the way we work, learn, and interact. The increased reliance on mobile applications is starkly apparent; mobile app usage grew 40% year-over-year in the second quarter of 2020, according to App Annie.
Security Boulevard
Open source risk goes beyond application security. Legal, operational, and supply chain implications demand a capable solution like Black Duck SCA. Open source can be found in everything; nearly all applications in all industries are composed to some degree of open source. The introduction of more cloud-native applications, more open source usage as a whole, and the creation of more-complex applications mean organizations are facing increasing levels of risk.
How to manage open source risks using Black Duck SCA
Posted by Shandra Gemmiti on Monday, January 25th, 2021 Open source risk goes beyond application security. Legal, operational, and supply chain implications demand a capable solution like Black Duck SCA. Open source can be found in everything; nearly all applications in all industries are composed to some degree of open source.
Things to consider when choosing a software composition analysis tool
Posted by Shandra Gemmiti on Monday, December 21st, 2020 The rise of open source software is not without risks for today’s applications. Use a software composition analysis tool to mitigate these risks. Gartner, in its “Market Guide for Software Composition Analysis,” details the need to make software composition analysis (SCA) part of your application security testing tool suite. We discussed the what and why in a recent blog post; today let’s discuss the how.
Security Boulevard
Most applications contain open source code, which can expose companies to risks if left unchecked. Make the most of your open source vulnerability management with the right approach and tooling. The post Four requirements for open source vulnerability management in a DevOps environment appeared first on Software Integrity Blog. *** This is a Security Bloggers Network syndicated blog from Software Integrity Blog authored by Shandra Gemmiti.
Four requirements for open source vulnerability management in a DevOps environment
Most applications contain open source code, which can expose companies to risks if left unchecked. Make the most of your open source vulnerability management with the right approach and tooling. Open source software continues to solidify its role in a successful DevOps environment. It offers many unique benefits to the CI/CD pipeline that make it attractive to developers, such as the ability to be customized and ease of integration.
Security Boulevard
When you don’t have any time or resources to spare, Black Duck Audits provide a deep, accurate, rapid vulnerability assessment, plus remediation guidance. The massive popularity of open source is due not only to its cost-effectiveness but also to its many other advantages. Open source offers accessibility, customization, decentralization, and rapid development cycles. However, the explosive adoption of open source isn’t without growing pains.
Security Boulevard
Open source license noncompliance can have severe implications. Here are four advanced license compliance features that help protect your proprietary code. The Black Duck product team has been hard at work developing advanced functionality for the Black Duck product. A key area of progress is open source license compliance. Open source license risks may not be as headline-grabbing as a big security breach, but their implications can still be severe.
Security Boulevard
If you don’t have an SCA tool, a software audit can give you a bill of materials needed for product releases, vendor requirements, and procuring insurance. The post Black Duck Audits: Not just for M&A appeared first on Software Integrity Blog. *** This is a Security Bloggers Network syndicated blog from Software Integrity Blog authored by Shandra Gemmiti.
Security Boulevard
With applications containing more and more open source, and 40+ open source vulnerabilities disclosed daily, how do you prioritize your remediation efforts? What’s the problem? If there’s one conclusion we can all agree on about open source software, it’s that it has blown way past the tipping point in terms of usage. Development teams have embraced open source for its inherent strengths: efficiency, speed, quality, and innovation.
Cybersecurity for open source should top due-diligence audits
Cybersecurity is an emerging issue across a range of industries including mining. It can have direct implications for the safety of workers. Shandra Gemmiti, Product Marketing Lead at Synopsys Software Integrity Group shares a piece on technical due diligence and why open source audits for cybersecurity should be at the top of the checklist. Technical due diligence is given in almost every acquisition or investment involving technology companies.
Security Boulevard
In a study by (ISC)2, all executives and M&A professionals surveyed agreed that cyber security audits have become standard practice in tech due diligence. The post Cyber security audits top due diligence checklists appeared first on Software Integrity Blog. *** This is a Security Bloggers Network syndicated blog from Software Integrity Blog authored by Shandra Gemmiti.
Security Boulevard
What sets Black Duck apart from other SCA solutions? Industry-leading innovation, extensive vulnerability detection, and a broad range of integrations. The post Top 3 reasons to choose Black Duck appeared first on Software Integrity Blog. *** This is a Security Bloggers Network syndicated blog from Software Integrity Blog authored by Shandra Gemmiti.
The License and Security Risks of Using Node.js
Open source software could make your application open for exploitation Open source software now dominates application development. Open source represented 60% of the code analyzed during Black Duck Audits in 2018, up from 57% in 2017 and 35% in 2016. When a codebase contains open source software, it takes advantage of development work that someone else has already completed for free.
Three Use Cases Where Source Code Scanning Doesn’t Cut it
Save {{ articles[0].views | formatCount}} Views Join the DZone community and get the full member experience. Join For Free Binary code analysis tools are essential when you don’t have access to a build environment or source code. Here are some use cases for scanning binary code. The 2019 Open Source Security and Risk Analysis report noted that 60% of the code analyzed by the Black Duck Audits team in 2018 was open source. This finding reinforces what we already know.
Security Boulevard
Binary code analysis tools are essential when you don’t have access to a build environment or source code. Here are some use cases for scanning binary code. The 2019 Open Source Security and Risk Analysis report noted that 60% of the code analyzed by the Black Duck Audits team in 2018 comprised open source. This finding reinforces what we already know: Companies are harnessing the power of open source software as they build applications.
Security Boulevard
Identifying open source in the target’s codebase is essential to M&A transactions involving software. Open source audits go far beyond what SCA can provide. Open source is everywhere. Researchers have been tracking its growth for years, but because open source is now so pervasive, they are increasingly concerned about the security of applications built on the foundation of open source components.
Security Boulevard
I have blogged before about the pervasiveness of open source in applications today. Synopsys and other organizations have been tracking its growth for years, particularly as it relates to the amount of open source code we find in the applications we scan. Our Black Duck On-Demand Audit team scans thousands of applications every year, mostly […] The post Open source security risk: Managing the threat in mergers and acquisitions appeared first on Software Integrity.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Shandra
Contact Shandra, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack