Application Security

Channel profile:

Proactively Securing Software for the Enterprise.

Listen to experts from HP, partners and customers discuss pressuring issues across application security.

Subscribers (7,143)
Think Like a Bad Guy, Act Like a Good Guy. HP Enterprise Security Watch now to learn more how the HP Enterprise Security products work together to fight off the bad guys. Read more >
May 8 2015
2 mins
Play
  • Live and recorded (84)
  • Upcoming (0)
  • Date
  • Rating
  • Views
  • Watch now to learn more how the HP Enterprise Security products work together to fight off the bad guys.
  • Higher-order features such as lambdas exist ubiquitously in web applications and frameworks. They make development easier, but at a cost of added complexity and exposure to high risk vulns and attacks. However, statically ruling out such vulnerabilities is theoretical and practically challenging, especially when high-order functions and complex control-flow collide with opaque, dynamic data structures such as objects.

    This talk aims to provide an easy-to-understand explanation of higher-order function and the difficulties involved in assessing it. We’ll include a brief report on the how HP Fortify Static Code Analyzer handles higher-order analysis and our plans for future improvements. Note: Content focused on a technical-level viewer.


    Download the SCA Solution Brief in the attachments for further reference.
  • There are a lot of reasons why you should fortify your application security to protect your business from hackers. And there are probably many reasons why you're not doing as much as you might.
    In this video, HP and Slashdot Media detail the top 10 reasons you should enhance application security. And they go on to show you how HP Fortify static and dynamic application security testing products help you do it. Fortify uses the latest security intelligence to help you cut compliance testing time in half, find and fix vulnerabilities in hours, and enable the collaboration among development, testing, and security teams that make your applications and your business more secure.
  • Greater than 80% of today’s breaches occur with application software, yet many companies continue to invest in ‘over the wire’ solutions that are not solving the problem. Runtime Application Self-Protection, or RASP, is an emerging market that promises to protect applications from the inside. Using the rich context of the application’s logic and associated core libraries, RASP identifies attacks in ‘real-time’ and stops them. Implementation is quick and requires no changes to your application’s code. Join us to learn more about what RASP can do for you.

    Learn:
    •Why context from inside the application matters
    •How easy it can be to use native capabilities of Java and .NET to protect your applications
    •Use cases to get you started.

    Help lead your enterprise to a stronger, more effective security program.
  • In the world of information security, the past isn’t dead; it isn’t even the past. The 2015 edition of HP’s annual security-research analysis reveals a threat landscape still populated by old problems and known issues, even as the pace of new developments quickens. In 2014, well-known attacks and misconfigurations existed side-by-side with mobile and connected devices (the “Internet of Things”) that remained largely unsecured. As the global economy continues its recovery, enterprises continued to find inexpensive access to capital; unfortunately, network attackers did as well, some of whom launched remarkably determined and formidable attacks over the course of the year.

    The 2015 edition of the HP Cyber Risk Report, drawn from innovative work by HP Security Research (HPSR), examines the nature of currently active vulnerabilities, how adversaries take advantage of them, and how defenders can prepare for what lies ahead. Jewel Timpe, HPSR’s senior manager of threat research, describes the report’s findings and explains how this intelligence can be used to better allocate security funds and personnel resources for enterprises looking toward tomorrow.
  • We all want our families and homes to be safe with the convenience of remote monitoring, but do these smart home security devices really make our families safer or put them at more risk by inviting easier access to our homes electronically via insecure Internet of Things? In a follow-up to HP’s 2014 report on the Internet of (Insecure) Things we explore the security of popular off-the-shelf connected Home Security Systems and discuss various testing techniques we used in our study along with recommendations for manufacturers, developers and consumers.
  • Businesses are spending so much money on security -- almost $47 billion in 2013 -- and yet the number of breaches continues to increase. To mitigate the risks of increasingly sophisticated, innovative and persistent threats, we need to change the way we think about our security programs. In this webcast, Art Gilliland, General Manager of HP Enterprise Security Products, talks about the challenges all enterprises face from the bad guys -- and the critical steps businesses must take to defend against today's most advanced threats.
  • Dynamic scanning is a staple of the web application security community. The complex nature of scanning each site and the expertise required in running the tools and interpreting the results often limits the deployment models. Development teams usually do not contain a security expert and must rely on an external team to perform their dynamic audits. This means that dynamic scans are often only performed once or twice throughout the development lifecycle, usually near the end.
    Security teams also wrestle with demand for dynamic scanning. Demand is not always consistent but hardware is expensive to purchase and maintain only to sit idle. What if there were a way to automate dynamic scanning after each build in a continuous build environment while not leaving servers idle during periods of inactivity.
    In this talk we will explain how the new WebInspect API, introduced in the 10.20 release and expanded in the recent 10.30 release, can help security teams integrate dynamic scanning with WebInspect earlier in the Security Development Lifecycle (SDL) and add flexibility and scalability into your company’s Software Security Assurance program.


    Jonathan Griggs – WebInspect Product Manager
    Brandon Spruth – Security Solutions Architect, HP Fortify
    Brooks Garrett – Manager Operations and Architecture, Fortify on Demand
    Jeremy Brooks – Senior Engineer, WebInspect Engineering
  • Many organizations have been building client-server and web applications for some time, and quite a few have reached a good level of maturity in regards to building security into their SDLC. Yet that traditional model of securing applications can’t fully address the security challenges presented by mobile and cloud infrastructures and the applications built around them. The business benefits of ubiquitous and quick data access (that come with mobile and cloud) are obvious, but the security issues are very real.

    Join this discussion to find out how internal development and security groups can update their software security assurance processes so that they are embracing AND securing mobile and cloud solutions.
  • Software Security Assurance (SSA) programs take many forms across various industries. What remains constant across all programs and industries is the challenge of choosing appropriate measurements. We often ask: “Is this the right metric?” “Am I collecting enough data?” “What should be reported to my managers and senior executives?” In this webinar we help you answer those questions, and we also show you how the right metrics mature your SSA program and keep it focused on business priorities.

Embed in website or blog