Application & Platform Security
Top Stories
-
News
22 Oct 2026
PHP2Shell disclosure unravels after leaks forced early patch drop
Although website shutdowns were inevitable to patch critical PHP flaws, early leaks and a broken embargo turned routine maintenance into an emergency scramble. Continue Reading
-
News
21 Oct 2026
PHP2Shell: 22M exposed servers at risk as emergency patches released
AI gave defenders a head start, but PHP2Shell has sparked a chaotic race against automated exploits across 22 million vulnerable servers. Continue Reading
-
News
19 Jul 2017
Symantec agrees to transfer certificate issuance to third party
Symantec has agreed to a plan that would transfer its certificate issuance and validation operations to as-yet-unnamed third-party partner starting Dec. 1. Continue Reading
-
News
14 Jul 2017
AWS S3 bucket leak exposes millions of Verizon customers' data
News roundup: An AWS S3 bucket leak containing personal data of millions of Verizon customers was exposed to the public. Plus, DNC hack victims are suing the Trump campaign, and more. Continue Reading
-
Answer
14 Jun 2017
How can DevOps application lifecycle management protect digital keys?
Better DevOps application lifecycle management can help protect cryptographic and digital keys. Expert Judith Myerson explains the right approaches to secure DevOps. Continue Reading
-
News
14 Jun 2017
Symantec CA remediation plan faces more delays
The battle over Symantec CA operations continues as the antivirus vendor pushes back against a consensus remediation proposal from the web browser community. Continue Reading
-
Tip
12 Jun 2017
To secure Office 365, take advantage of controls Microsoft offers
Securing Office 365 properly requires addressing upfront any specific risks of a particular environment and taking advantage of the many security controls Microsoft offers. Continue Reading
-
Tip
12 Jun 2017
Address Office 365 security concerns while enjoying its benefits
Office 365 security concerns should worry you but not dampen your enthusiasm for the platform's potential benefits for your business. Here's what you need to consider upfront. Continue Reading
-
Tip
06 Jun 2017
How mobile application assessments can boost enterprise security
Mobile application assessments can help enterprises decide which apps to allow, improving security. Christopher Crowley of the SANS Institute discusses how to use app assessments. Continue Reading
-
News
19 May 2017
Google Play Protect looks to bolster Android app security
News roundup: The new Google Play Protect system aims to improve Android app security. Plus, Google Cloud IoT Core adds layer of device security, and more. Continue Reading
-
News
02 May 2017
Mozilla: Symantec certificate remediation plan not enough
Mozilla reviews the counterproposal from Symantec and urges the CA giant to opt for Google's recommendation to outsource its certificate activities. Continue Reading
-
News
25 Apr 2017
Symantec certificate authority issues, answered
Google and Mozilla weigh the proper response to Symantec certificate authority issues, as the CA giant prepares an alternative proposal for reinstating trust. Continue Reading
-
News
31 Mar 2017
EU encryption backdoor options for messaging apps set for June
Messaging app developers will be offered 'three or four' legislative and non-legislative options for encryption backdoor access for EU law enforcement. Continue Reading
-
Answer
31 Mar 2017
Google Cloud KMS: What are the security benefits?
Google Cloud KMS is a new encryption key management service available for Google customers. Expert Matthew Pascucci discusses how this service works and its security benefits. Continue Reading
-
Answer
28 Mar 2017
How can users tell if Windows SMB v1 is on their systems?
US-CERT encouraged users to use newer versions of Windows SMB, since version one is out of date. Expert Matthew Pascucci explains how to tell if SMB v1 is on your systems. Continue Reading
-
News
23 Mar 2017
DV certificates abused, but policing may not be possible
Research shows DV certificates can be a prime target for phishing and malware operators, but experts are unsure how certificate authorities should deal with the issue. Continue Reading
-
Podcast
09 Mar 2017
Risk & Repeat: Does the Amazon S3 outage raise security flags?
In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the recent Amazon Simple Storage Service outage and why the incident may have security implications. Continue Reading
-
Tip
07 Feb 2017
How Windows hardening techniques can improve Windows 10
Windows 10 may be the most secure Windows ever, but expert Ed Tittel explains how to use Windows hardening techniques to make systems even more secure. Continue Reading
-
Answer
06 Feb 2017
How does Overseer spyware work on infected Android apps?
Spyware was found on infected Android apps, which were meant to convey embassy information and news, in the Google Play Store. Expert Michael Cobb explains how the spyware works. Continue Reading
-
Feature
01 Feb 2017
Looming cloud security threats: How attacks will follow your data
You can move your data to cloud-based systems and web services, but you can't hide it there. Hackers and predators have more ways to find it. Continue Reading
-
News
19 Jan 2017
US-CERT reminds users that Windows SMB v1 needs to die
Experts say US-CERT is taking advantage of a potential -- but unverified -- vulnerability in Windows SMB v1 to remind enterprise users the outdated service should be disabled. Continue Reading
-
News
04 Jan 2017
SSL certificate validation flaw discovered in Kaspersky AV software
Google Project Zero discovers more antivirus vulnerabilities. This time, the issues are with how Kaspersky Lab handles SSL certificate validation and CA root certificates. Continue Reading
-
Tip
21 Dec 2016
VM isolation technique considerations for enterprises
VM isolation techniques are good strategies to prevent infections from spreading to the entire cloud environment. Ed Moyle explains what enterprises need to know about isolation. Continue Reading
-
Feature
29 Nov 2016
DNS Security: Defending the Domain Name System
In this excerpt from chapter two of DNS Security: Defending the Domain Name System, authors Allan Liska and Geoffrey Stowe discuss why DNS security is important. Continue Reading
-
Tip
02 Nov 2016
Cloud DDoS protection: What enterprises need to know
DDoS attacks are a continuing problem, and enterprises should consider using cloud DDoS protection services. Expert Frank Siemons discusses the cloud options. Continue Reading
-
Feature
29 Jul 2016
Automated Security Analysis of Android and iOS Applications
In this excerpt of Automated Security Analysis of Android and iOS Applications with Mobile Security Framework, authors Ajin Abraham and Henry Dalziel discuss mobile application penetration testing. Continue Reading
-
Feature
25 Jul 2016
How to start building an enterprise application security program
Building an effective application security program can be daunting. Sean Martin talks with experts about the best first steps enterprises should take. Continue Reading
-
Tip
11 Jan 2016
Microsoft Device Guard tackles Windows 10 malware
A new Microsoft security feature takes aim at Windows 10 malware. Expert Michael Cobb explains what enterprises should know about Device Guard. Continue Reading
-
Opinion
05 Oct 2015
Can white-box cryptography save your apps?
With the Internet of Things, software-based secure elements could hold the key. Continue Reading
-
Opinion
01 Oct 2015
McGraw: Seven myths of software security best practices
According to expert Gary McGraw, you're not helping yourself by believing the things -- all seven of them -- you've heard about secure software development. Continue Reading
-
Feature
15 Sep 2015
Comparing the best Web application firewalls in the industry
Expert Brad Causey compares the best Web application firewalls on the market across three types of product types: cloud, integrated and appliance. Continue Reading
-
Feature
20 Aug 2015
Introduction to Web fraud detection systems
Expert Ed Tittel explores the purpose of Web fraud detection systems and services, which are designed to reduce the risks inherent in electronic payments and e-commerce. Continue Reading
-
Feature
17 Mar 2015
Four questions to ask before buying a Web application firewall
Web application firewalls are complex products. Expert Brad Causey explains the key criteria enterprises need to consider before investing in a WAF product. Continue Reading
-
Feature
19 Feb 2015
Business-use scenarios for a Web application firewall deployment
Web application firewalls can be a critical security layer for many companies. Expert Brad Causey explains when and how to deploy a WAF in the enterprise. Continue Reading
-
Feature
17 Feb 2015
Introduction to Web application firewalls in the enterprise
Expert Brad Causey takes a close look at Web application firewalls, explains how WAF technology can prevent Internet-based attacks from known and unknown applications threats, and offers advice on WAF management and deployment. Continue Reading
-
Definition
21 Jul 2014
Cloud Controls Matrix
The Cloud Controls Matrix is a baseline set of security controls created by the Cloud Security Alliance to help enterprises assess the risk associated with a cloud computing provider. Continue Reading
-
Feature
01 Apr 2014
How Cisco's 'Application Centric Infrastructure' differs from SDN
As Cisco rolls out a hardware-based alternative to software-defined networking approaches, what does it all mean for security? Continue Reading
-
News
31 Mar 2014
McGraw: Firewalls, fairy dust and forensics? Try software security
Gary McGraw discusses why the software security segment of the IT security industry is growing at a faster rate than the category as a whole. Continue Reading
-
Tip
31 Dec 2013
Alternatives to RESTful API for accessing object storage
This tip examines other options for connecting to object storage when an application isn't compatible with the RESTful API. Continue Reading
-
News
24 Dec 2013
McGraw: How to scale software architecture risk analysis
Software architecture risk analysis doesn't have to be hard. Gary McGraw and Jim DelGrosso discuss an easier, more scalable process. Continue Reading
-
???topicInfoType.misc_content???
22 Jul 2013
Slideshow: Five common Web application vulnerabilities
Expert Michael Cobb analyzes five common Web application vulnerabilities from the OWASP top 10 list and provides mitigations for enterprises. Continue Reading
-
Tip
31 May 2013
Amazon S3 encryption overview: How to secure data in the Amazon cloud
Learn details for employing Amazon S3 encryption features. Expert Dave Shackleford compares S3 encryption to other cloud provider offerings. Continue Reading
-
News
19 Mar 2013
McGraw: Don't 'hack back'; instead, build security in
Hacking back isn't the way to win the cyberwar. Gary McGraw says building software and systems with fewer vulnerabilities is stronger protection. Continue Reading
-
News
02 Aug 2012
Congress should support software fixes, expert says
Cybersecurity policy should encourage bug fixes instead of simply recording and reporting attacks, software security expert Gary McGraw explains. Continue Reading
-
News
24 May 2012
Hot security storylines offer unconventional wisdom
Editor Eric B. Parizo says controversies involving Oracle security patches and InfoSec World 2012 prove the importance of differing opinions. Continue Reading
-
News
27 Jan 2012
Time to ban dangerous apps? Exploring third-party app security
Column: Third-party applications are notoriously hard to patch and often easy to exploit. Is it time to ban applications, or can they be secured with a new approach? Continue Reading
-
Tip
11 Mar 2011
Securing a multi-tenant environment
Learn some of the key elements for secure multi-tenancy. Continue Reading
-
Answer
22 Sep 2009
How to prevent ActiveX security risks
Application expert Michael Cobb explains why ActiveX security relies entirely on human judgment. Continue Reading
-
Answer
26 May 2009
Comparing an application proxy firewall and a gateway server firewall
There are many types of firewalls in use in today's enterprises, so it's easy to get confused about the functions of each. In this expert response, learn the difference between a proxy server firewall and a gateway server firewall. Continue Reading
-
Answer
11 Feb 2009
How does a Web server model differ from an application server model?
A Web server model and an application server model share many similarities but require different defense methods. Each model, for example, calls for distinct placement of application servers. Continue Reading
-
Feature
18 Aug 2008
Securing Windows Server 2008: Installing and turning on BitLocker
Aaron Tiensivu covers steps for installing and turning on BitLocker in Windows Server 2008 in this chapter excerpt. Continue Reading
-
Tip
11 Oct 2007
Preparing for uniform resource identifier (URI) exploits
URIs have always been a user-friendly way to recognize and access Web resources. By crafting malicious URLs and manipulating protocol handlers, however, attackers have devised new attacks that take advantage of the URI's locator functionality. Web security expert Michael Cobb explains how the identifier exploits may start a fresh round of problems for developers and users alike. Continue Reading
-
Answer
31 Jul 2007
How does SSL 'sit' between the network layer and application layer?
SSL is neither a network layer protocol nor an application layer protocol. In this SearchSecurity.com Q&A, Michael Cobb explains how SSL "sits" between both layers. Continue Reading
-
Answer
31 May 2007
What are the drawbacks to application firewalls?
Application-layer firewalls examine ingoing and outgoing traffic more carefully than traditional packet-filtering firewalls, so why are some holding back on deployment? In this SearchSecurity.com Q&A, Michael Cobb reveals some cost and performance issues. Continue Reading