Cloud Native Security

DevSecOps

OpenID Connect: Let’s Talk Security

OpenID Connect (OIDC) is a modern authentication and authorization protocol built on top of the 0Auth 2.0 framework. OIDC enables secure and standardized authentication in applications, particularly web and mobile applications.

But while OIDC improves security, minimizing user credential exposure, it can introduce security risks such as misconfigured identity and access manag...

AppSec

DevSecOps

Sep 12, 2023

By Steve Giguere

Cloud Native Security

Cloud Native Application Protection Platform

Cloud Workload Protection Platform

Cloud Security Posture Management

Cloud Network Security

Cloud Infrastructure Entitlement Management

DevSecOps

Partners

Announcement, DevSecOps

Securing Golden Images at Build Using Prisma Cloud

Organizations often have a preferred base image from which they create virtual machines or instances. Base images are generally made up of a specific OS build and patch level, along with any software, configura...

Jul 26, 2023

By Dennis Schmidt, Kyle Butler and Dan Barr

DevSecOps, Secure the Cloud

Top 3 IAM Risks in Your GitHub Organization

Identity and access management (IAM) has always been an area of focus for organizations, particularly when it comes to source control management systems (SCM). And rightly so — inadequate identity and access ma...

Jul 18, 2023

By Omer Gil and Yaron Avital

DevSecOps, Secure the Cloud

ChatGPT and Checkov: Fix IaC Security Issues Fast

Infrastructure as code (IaC) offers a robust method for managing cloud resources. Developers use IaC to describe their infrastructure in code format, which can then undergo versioning, testing and deployment li...

Jun 27, 2023

By Steve Giguere

DevSecOps, Secure the Cloud

How To Prevent the 5 Most Common Software Supply Chain Weaknesses

All software supply chain attacks share a core trait: they allow a threat actor to break into an organization’s IT estate by exploiting software vulnerabilities created by entities...

Jun 13, 2023

By Chris Tozzi

Application Security, AppSec, DevSecOps

Application Security in the Cloud: Introducing a Modern Framework

As engineering becomes increasingly fast-paced, dynamic and influential across organizations, AppSec must evolve. Agile development methodologies — su...

Jun 06, 2023

By Daniel Krivelevich

Application Security, DevSecOps

Shift Left Secrets Security: How to Prioritize Secrets Risks

As you start developing your secrets security strategy, it’s likely that GitHub repositories’ secrets aren’t top of mind. GitHub — unarguably the de f...

Jun 01, 2023

By Steve Giguere

DevSecOps, Secure the Cloud

Achieving Comprehensive Cloud Security: The Power of Consolidation

Relying on cloud technology to drive innovation, streamline operations, and stay competitive comes with challenges — namely, maintaining a robust and unified security posture in an...

May 08, 2023

By Martijn Baecke

DevSecOps, Secure the Cloud

Top 6 Considerations for Integrating Cloud Security and GitOps

Since the term was first coined in 2017, GitOps has provided a new operating model for developing, delivering, testing, and deploying cloud-native infrastructure. GitOps and infras...

Apr 27, 2023

By Taylor Smith

Announcement, Cloud Native Application Platform, Cloud Security, DevOps, DevSecOps, Must-Read Articles

Cloud-Native Security Survey: Patterns and Tipping Points in New Report

Did you know that 72% of organizations from around the world moved 30% or more of their workloads to the cloud in the la...

Mar 07, 2023

By Bob West

DevSecOps, Secure the Cloud

Crawl, Walk, Run: Operationalizing Your IaC Security Program

You’ve decided to shift your cloud security left. You researched vendors, evaluated solutions, did a proof of concept and now you’re off the IaC security races.

Jan 10, 2023

By Mike Urbanski

DevSecOps, Secure the Cloud

How To Prevent the IaC Misconfiguration Snowball Effect

The goal with infrastructure as code (IaC) frameworks such as Terraform and CloudFormation is to make infrastructure provisioning more efficient. Through a combination of automation and either imperative or dec...

Jan 03, 2023

By Payton O’Neal

DevSecOps, Secure the Cloud

You Must Comply! Why You Need Proactive Open Source License Compliance

As vulnerabilities in open source code continue to play a prominent role in headline-grabbing exploits, such as Heartbleed and Log4Shell, a hidden source of open source risk flies...

Dec 06, 2022

By Steve Giguere

Cloud Computing, DevSecOps

Using Your Pipelines To Harden Your Pipelines: The Importance of CI/CD Secu...

As the systems we use to deliver software to the cloud get more complex and reliant on third-party components, they also leave more opportunities for attacks. Just last year, softw...

Dec 01, 2022

By Idan Tendler

Containers, DevSecOps

Infrastructure Security Advantages of Leveraging Kubernetes

As more and more organizations move away from traditional virtual machines for developing applications, containerization has become the new norm. Containers offer a more modern app...

Nov 22, 2022

By Faith Kilonzi

DevSecOps, Secure the Cloud

Infrastructure as Code Security and AppSec: Streamlined DevSecOps From App ...

Infrastructure as code (IaC) has fundamentally changed the way we build and manage infrastructure. By transforming cloud resources and their configurations into code, IaC allows us...

Nov 15, 2022

By Chris Tozzi

DevSecOps, Secure the Cloud

6 Key Kubernetes DevSecOps Principles: People, Processes, Technology

Container-based application deployment is at its peak, as is the popularity of orchestration platforms like Kubernetes that form the underlying infrastructure for containerized app...

Nov 08, 2022

By Faith Kilonzi

Announcement, Cloud Workload Protection Platform, DevSecOps

Prisma Cloud Analysis of CVE-2022-42889: Text4Shell Vulnerability

A critical vulnerability with a CVSS score of 9.8 was recently discovered in Apache Commons Text, identified as CVE-2022-42889 and more commonly known...

Oct 25, 2022

By Artur Oleyarsh and Leo Juszkiewicz

DevSecOps, Secure the Cloud

9 Essential Infrastructure Security Considerations for Kubernetes

Part of the reason why securing Kubernetes can be challenging is that Kubernetes isn’t a single, simple framework. It’s a complex, multi-layered beast. Each layer — from code and c...

Oct 20, 2022

By Chris Tozzi

DevSecOps, Secure the Cloud

Secure Vulnerable Images Found in IaC Templates With Prisma Cloud

Image Referencer extends Prisma Cloud’s existing scanning capabilities to provide more complete visibility into all images that may exist in an application.

Oct 18, 2022

By Taylor Smith

DevSecOps, Secure the Cloud

Software Composition Analysis (SCA): How Does It Help Keep Cloud Applicatio...

In this cloud-native world, applications are more assembled than built. Instead of starting from scratch, developers leverage ready-made code components that were previously built...

Oct 11, 2022

By Tohar Zand

Load more blogs