appsec Archives - Page 3 of 5

Software Cybersecurity Podcast

Posted on February 9, 2016 by Code Curmudgeon

My friend Kevin Greene is devoted to improving the state of software security in the United States and he’s passionate about it. Kevin now...

AutoSec Automotive CyberSecurity

Posted on February 2, 2016 by Code Curmudgeon

Last week with Alan Zeichick and I did a webinar for Parasoft on automotive cybersecurity. Now Alan thinks that cybersecurity is an odd term,...

IoT Security – A Contradiction in Terms

Posted on November 10, 2015 by Code Curmudgeon

The internet of things aka IoT has become the internet of hacks. More and more devices are being internet enabled. While this makes many...

Halloween Security Slashers Webinar

Posted on October 28, 2015 by Code Curmudgeon

I’m doing a Halloween themed Parasoft webinar this Friday on Stopping Software Security Slashers with Static Analysis. As always it’s a free webinar and...

‹ Prev 1 2 3 4 5 Next ›

Definitioner

CWE: CWE stands for "Common weakness enumeration" and is a way to define a particular security issue in programming code. CWE is a security effort lead by the US government and industry to define a taxonomy for coding problems that lead to security vulnerabilities. Each vulnerability reported has an CVE ID and should be linked to the underlying CWEs that lead to the issue. There are currently approximately 800 items defined in CWE and efforts are underway to map their technical impacts to what kinds of problems the weakness may cause, as well as ISO 27010. CWE is often known for it's CWE Top 25 and On the Cusp lists of the most common software security problems. See https://cwe.mitre.org
CAN (Controller Area Network): Controller Area Network aka CAN aka CAN Bus is a wiring standard for vehicles that enables communication between various components and devices without having a host computer. For example doors, brakes, transmission.
static analysis: Any form of software analysis that can be done on the code without actually executing the code. Encompasses techniques like pattern-based analysis, metrics, code review, etc.