SCA and SAST: What do they do and how can they help developers like you?
5 minute read time
SCA and SAST tools help DevSecOps teams and application developers work together to identify vulnerabilities and improve security.
Read More...
How does developer morale affect my software supply chain?
4 minute read time
Your place in the software supply chain has a lot to do with your development staff. A look at Sonatype data on developer state-of-mind and performance.
Read More...
PGP vs. sigstore: A recap of the match at Maven Central
7 minute read time
We put code-signing tools PGP and sigstore in a head-to-head match with Maven Central users to find a winner. The results may surprise you.
Read More...
What do Log4Shell and a global pandemic have in common?
4 minute read time
A look at development through the lens of weddings, including long-term planning, contingencies, and disasters. A video talk from this years DEVOXX.
Read More...
HID Global's three pillars of operational security
5 minute read time
The foundations of security at HID Global are a balanced set of tools, policies, and expertise. A look back at a DevSecOps Leadership Forums talks in Paris.
Read More...
What constitutes a software supply chain attack?
7 minute read time
ENISA feels the term software supply chain attack is overused, so what does constitute a supply chain attack?
Read More...
Effective tools for software composition analysis (SCA)
4 minute read time
Better developer tools for the software supply chain mean a faster, more effective team.
Read More...
Breaking organizational silos for better application security
4 minute read time
Security depends on collaboration and communication. Our recent Elevate talk breaks down pillars, structure, and suggestions for organizational silos.
Read More...
SBOM – From the idea of transparency to the reality of code
4 minute read time
Allan Friedman from the NTIA has been working on SBOM standards in government and industry, for years. He spoke at ELEVATE 2021 about their status and future.
Read More...