Include Security’s Post

This topic is never discussed publicly; there are dozens of "secret lists" of approved vendors in the industry for service vendors. Entry to these lists is not often merit based, but primarily "connections" based i.e. You get on it if you take the right CISO out for golf & fancy dinner, or your company appears on the list purely because of alumni allegiance. There is no well-defined or merit based vetting process for the vendors. These secret lists dominate the decision process of many of the biggest US companies when it comes to vendor selection. Include Security is found on many of these lists, but we would rather be on public lists! As seen below, it is great to see the industry shift to public vendor lists and marketplaces. At IncludeSec we believe more transparency will ensure the best companies who provide value are being justly awarded work in our industry, not the companies with the most sales people. CC folks leading the charge on security/vendor transparency Lisa Hall James Berthoty Robert Hansen

Latio Tech List version 1.16 is live! Here are the changes: 1. Added Traceable to API security and ADR. When talking to the "networky" API Security providers, Traceable always comes up as the scary guy in the room, and now I understand why. They started with the hard stuff (tracing) and backfilled the easy stuff (network logs) and showed some examples that were truly innovative in helping teams research and respond to events like fraud detection. The hard part is just assessing how integrated you need to be to see some of that stuff - but either way they're incredibly well positioned for the future of the market. 2. Added Include Security to pentest. Pentests are a hard category for me to evaluate, so I mostly have to go on public research information to get a sense of how in depth certain providers go. Include gives a lot of confidence in their technical ability for a pentest aimed at real security rather than check the box. 3. Added NightVision to DAST and API Security - scans you code, builds API docs based on the code, then scans your APIs from the outside 4. Added Kloudle to CSPM - a simple on demand CSPM scanning tool, unique for its ability to scan Digital Ocean.

If you are curious on how to utilize the deny permission in D365FO from the AOT, this blog post shows how you can perform this and some things to look out for! #msdyn365fo #xppgroupies #security

💡Wrapped up an informative session at #BSides London, where Anant shared valuable insights on #SupplyChainSecurity. Have a sneak peek at what he unveiled: https://lnkd.in/dVTniQHg Stay tuned for more event highlights and cybersecurity tips! . . . #cyfinoid #supplychaininnovation #CybersecurityTalk #cloudsecurity

Intelmq leverages Shadowserver’s APIs. This is a way to check out the APIs. https://lnkd.in/gt4Q9ckx The APIs open synergistic opportunities. You can use the APIs to intergrate Shadowserver’s data with your other telemetry and risk indicators.

🔐 Security in CI/CD: Why it's Essential in 2023! Have you noticed the rise in security threats targeting software delivery? The vulnerability of our software supply chains is alarming, with CI/CD tools being a prime attack vector. Our latest blog dives deep into: 💡 Why security should never be an afterthought in CI/CD tool evaluation 💡How CI/CD tools and pipelines are susceptible to threats 💡 Real consequences of ignoring security in your CI/CD process Also, get insights on how OpsMx can help you bolster your security in CI/CD! 🔗 https://lnkd.in/gmjGQKDP #DevSecOps #CICD #SoftwareSecurity

On Tuesday, August 22nd, join Medcrypt's Om Mahida in a special joint webinar with Tidelift VP of Product Lauren Hanford. Together they will review government product security requirements, in particular Software Bills of Materials (SBOMs). Attendees will learn about critical considerations in building a vulnerability management program, as well as discover benefits from the Medcrypt and Tidelift partnership. Interested? Click the link below to register for this webinar. https://bit.ly/3OoV5a4

Just finished the course “Building an Application Security Program” by Tim Chase! From this course I was able to grasp knowledge on topics such as DAST, SAST that relates with application security. Check it out: https://lnkd.in/g_P47Nq5 #applicationsecurity #programdevelopment.

Parallels Awingu 5.5 is now available, offering improved security enhancements. This update provides a new level of control over certificates for external HTTPS requests, bolstering both security and flexibility. We're also already setting our sights on the next release. Intrigued? Delve deeper in our blog post: https://allu.do/3Diip49