Search

Application Security

121 posts

AppSec vendors and CISOs: a love-hate relationship? ⎜Olivia Rose

Podcast

AppSec vendors and CISOs: a love-hate relationship? ⎜Olivia Rose

Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're joined by an amazing guest, Olivia Rose. Olivia is an executive leader with more than 20 years of dedicated experience, having served as the former CISO at Amplitude and Mailchimp and currently as the Founder of the Rose CISO Group. Her company offers virtual Chief Information Security Officer (CISO) services, boardroom and leadership communications, assessment

Alexandra Charikova

Alexandra Charikova

1 min read

4 lessons from recent application security case studies

Application Security

4 lessons from recent application security case studies

Every organization, no matter how big or small, if it's dependent on the software (which is impossible not to be in the modern world), must prioritize software security. Interested in enhancing yours? Want to know how real-world application security challenges are tackled? Let's get straight to the point by examining real-life application security case studies. Dive into our latest blog post, and uncover invaluable insights collected from the recent security incidents. As we can see, a vast ra

Alexandra Charikova

Alexandra Charikova

6 min read

Methodology: How we discovered over 18,000 API secret tokens

API Security

Methodology: How we discovered over 18,000 API secret tokens

Hey there! It's just the beginning of the year, but our security research team has been working hard to identify current API security challenges. So for the Escape team, January went under the tagline "API secret sprawl" (we thought it was more fun than"Dry January", and we hope you agree with us 😉). If you're in the security field, you might mention that the beginning of the year usually marks the release of all "State of.. " reports, taking a look at the past year's trends. Instead of coll

Swan BeaujardAlexandra Charikova

Swan Beaujard, Alexandra Charikova

6 min read

Security training: Necessary investment or overrated expense?⎥Mel Reyes (Global CEO, CIO, CISO, & CTO with 30 years of experience)

Podcast

Security training: Necessary investment or overrated expense?⎥Mel Reyes (Global CEO, CIO, CISO, & CTO with 30 years of experience)

Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we’re excited to have an amazing guest, Mel Reyes, join us. Mel has navigated through two IPOs and three M&As, worked with several startups, Pepsi and Mercedes, and accumulated a bunch of patents along the way. With more than 30 years of experience in various leadership, advising, and coaching roles, he enjoys building and empowering security teams within organization

Alexandra Charikova

Alexandra Charikova

1 min read

Best Django security practices

Django security

Best Django security practices

Learn to secure your Django applications effectively with our expert hands-on tutorial.

Alexandre Tang

Alexandre Tang

13 min read

How to secure APIs built with Express.js

API Security

How to secure APIs built with Express.js

Want to know how to secure your Express.js APIs? Dive into our latest blog post, where we guide you through the best practices for Express.js security.

Alexandre Tang

Alexandre Tang

14 min read

What is ASPM: A breakdown of the current state and its future⎥James Berthoty (Security at PagerDuty)

Podcast

What is ASPM: A breakdown of the current state and its future⎥James Berthoty (Security at PagerDuty)

Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're excited to have an amazing guest, James Berthoty, joining us. James has been in technology for over 10 years across engineering and security. An early advocate for DevSecOps, he has a passion for driving security teams as contributors to products. With all his experience, he's currently building Latio tech = a platform helping organizations find the best securit

Alexandra Charikova

Alexandra Charikova

18 min read

How to build secure APIs with Ruby on Rails: Security guide

API Security

How to build secure APIs with Ruby on Rails: Security guide

Are your Ruby on Rails APIs as secure as they could be? In today's world, where digital security is no longer an option, ensuring the robustness of your APIs is crucial. If you find yourself uncertain when attempting to answer this question, then this guide is for you. In this guide, we will be exploring how you can build a secure API on Ruby on Rails that prioritizes the safety and security of your users' data. Whether you are a seasoned developer or just starting out on your coding journey, w

Alexandre Tang

Alexandre Tang

13 min read

Best practices to protect your Flask applications

Flask security

Best practices to protect your Flask applications

Want to know how to protect your Flask applications? Dive into our latest blog post, where we guide you through the best practices for Flask security. Explore how these techniques can not only enhance the security of your web applications but also bring tangible benefits to your development journey. In this guide, Escape's security research team has gathered the most crucial tips to protect your Flask applications from potential breaches, including how to implement CSRF protection for Flask. Ou

Alexandre Tang

Alexandre Tang

12 min read

SCADA systems: How secure are the systems running our infrastructure?⎥Malav Vyas (Security Researcher at Palo Alto Networks)

Podcast

SCADA systems: How secure are the systems running our infrastructure?⎥Malav Vyas (Security Researcher at Palo Alto Networks)

Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're excited to have an amazing guest, Malav Vyas, joining us. Malav is a security researcher at Palo Alto Networks, passionate about exploiting and securing systems. Security research is an important part of our day-to-day at Escape. That's why we were very curious when Malav reached out to us and brought up the topic of SCADA systems. In our latest episode with Tr

Alexandra Charikova

Alexandra Charikova

14 min read

Threat modeling: the future of cybersecurity or another buzzword⎥Derek Fisher (author of The Application Security Handbook)

Application Security

Threat modeling: the future of cybersecurity or another buzzword⎥Derek Fisher (author of The Application Security Handbook)

Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today we’re excited to have an amazing guest, Derek Fisher, joining us.  Derek is a cybersecurity leader, a speaker on various cybersecurity topics, and author of the famous “The Application Security Handbook.” Having been a developer before shifting to application security more than a decade ago, Derek has had the unique opportunity of seeing the industry from the perspectiv

Alexandra Charikova

Alexandra Charikova

25 min read

ASP.NET security best practices

API Security

ASP.NET security best practices

Curious about the key strategies to ensure the security and reliability of your ASP.NET applications, including building APIs? Dive into our latest blog post, where we guide you through ASP.NET security best practices. Explore how these practices can not only enhance the security of your web applications but also bring tangible benefits to your development journey. In this guide, Escape's security research team has gathered 10 crucial ASP.NET security best practices that empower you to create m

Tristan Kalos

Tristan Kalos

7 min read

What is business logic, and why it's important for application security

Application Security

What is business logic, and why it's important for application security

Is understanding business logic a critical component of application security? Absolutely. In the world of cybersecurity, business logic is more than just a set of operational directives. It serves as the crucial bridge between an application's technical function and its alignment with strategic business goals. More than that, it's important not only to understand but also to properly secure applications from business logic attacks. A striking example of this was the breach experienced by USPS,

Alexandra Charikova

Alexandra Charikova

6 min read

SAST vs DAST: how to make the choice and combine them effectively

Application Security

SAST vs DAST: how to make the choice and combine them effectively

Should you choose between SAST and DAST? Perhaps the real question is, why not use both in your application security strategy? Let's be honest—vulnerabilities are often discovered when it's too late. No matter how well developers follow secure coding guidelines, it's impossible to keep an eye on every detail. Business teams frequently put additional pressure to deliver within tight deadlines. As pressure mounts, stakes rise, and, oops, a small mistake leads to a SQL injection in production. Th

Elliot Négrel-Jerzy

Elliot Négrel-Jerzy

8 min read

Vulnerability Management Lifecycle: 5 Steps and Best Practices

Application Security

Vulnerability Management Lifecycle: 5 Steps and Best Practices

Maintaining robust security of your organization is not just crucial in 2023 – it's a survival strategy. The recent data breach at 23andMe in October 2023 is a case in point. This incident, where a credential-stuffing attack led to unauthorized access to customer accounts, underscores a harsh reality. Even biotech companies, handling sensitive genetic data, aren't immune to cyber threats. It shows us how vulnerabilities, if left unchecked, can compromise not just data but also customer trust. Th

Alexandra Charikova

Alexandra Charikova

15 min read

How to establish an application security policy

Application Security

How to establish an application security policy

As organizations increasingly rely on web and mobile applications to conduct business, robust application security has become paramount. Cyberattacks are on the rise, and without adequate protection, businesses risk losing sensitive data, revenue, and reputational damage. Having an application security policy in place is the first line of defense against such threats. To give you an example: just a month ago, MGM Resorts’ Las Vegas area operations to took $100M hit from social engineering cyber

Escape - Offensive Security

Escape - Offensive Security

14 min read

Escape API Security Checklist

API Security

Escape API Security Checklist

Are you looking to make your API security program stronger? Do you sometimes find it challenging to spot and address security vulnerabilities effectively? You're not alone! Many security professionals like you face challenges in improving API security because technology and cyber threats keep changing. This makes ensuring strong API security a complex but vital task. This checklist can help. You can use these guidelines to improve your API security posture. Feel free to adapt these guidelines t

Tristan Kalos

Tristan Kalos

1 min read

What is API discovery, and how does it work?

API Discovery

What is API discovery, and how does it work?

Ever wondered how applications effortlessly communicate and collaborate, seamlessly sharing data and functionalities? Enter API discovery – the game-changer in modern development. What if finding and connecting with APIs was as intuitive as flipping a switch? As the newly appointed security engineer, you quickly realize the sprawling web of APIs that power the company's services and pose unseen vulnerabilities. Every undocumented API feels like a ticking time bomb, a potential gateway for malic

Sophie Boulaaouli

Sophie Boulaaouli

6 min read