CARVIEW |
Select Language
HTTP/2 200
x-vhost: blackduck
content-security-policy: default-src 'self' 'unsafe-hashes' 'unsafe-inline' 'unsafe-eval' data: blob: edge.adobedc.net adobedc.demdex.net *.adobe.com *.adobe.io cdn.cookielaw.org assets.adobedtm.com kit.fontawesome.com ka-p.fontawesome.com munchkin.marketo.net adobedc.demdex.net snap.licdn.com *.drift.com js.driftt.com js.zi-scripts.com j.6sc.co geolocation.onetrust.com ipv6.6sc.co c.6sc.co b.6sc.co epsilon.6sense.com px.ads.linkedin.com static.cloud.coveo.com boards.greenhouse.io *.mktoresp.com ws.zoominfo.com job-boards.greenhouse.io api.company-target.com *.org.coveo.com synopsysnonproduction2yln023as.analytics.org.coveo.com *.brighttalk.com brighttalk.com js.zi-scripts.com *.blackduck.com blackduck.com players.brightcove.net *.brightcove.com manifest.prod.boltdns.net *.brightcovecdn.com googletagmanager.com *.googletagmanager.com *.google.com *.google.ca *.google.co.uk google.co.in google.com *.google-analytics.com google-analytics.com googleads.g.doubleclick.net td.doubleclick.net *.googleapis.com *.gstatic.com *.leadspace.com *.clarity.ms *.bing.com *.bing.net *.bing-int.com *.6sc.co *.6sense.co 846-esg-342.mktoutil.com *.youtube.com;
cache-control: max-age=300
expires: Fri, 10 Oct 2025 23:36:20 GMT
content-encoding: gzip
x-frame-options: SAMEORIGIN
content-type: text/html;charset=utf-8
x-content-type-options: nosniff
accept-ranges: bytes
age: 0
date: Fri, 10 Oct 2025 23:31:22 GMT
strict-transport-security: max-age=31557600
set-cookie: affinity="311e4db193331b60"; Path=/; HttpOnly; secure
x-served-by: cache-bom-vanm7210042-BOM
x-cache: MISS
x-timer: S1760139080.889388,VS0,VS0,VE2375
vary: Accept-Encoding,User-Agent
content-length: 32279
Manage Security Risks | Black Duck Blog
Manage Security Risks
How can teams ensure that their software is secure? When security teams collaborate with DevOps to shift application security testing earlier in development, they can minimize security-related risks, costs, and time. Read the latest articles from Black Duck cyber security experts to learn how to manage security risks using today’s leading application security testing tools and services.
Last Published
224
Stories
52
Writers
Get the best from AI in software development without risking the worst
Sep 15, 2025
|
5 min read
What you need to know about the NIST Secure Software Development Framework
Aug 12, 2025
|
5 min read
Faster, Smarter Vulnerability Alerts: AI in Black Duck Security Advisories
Jul 31, 2025
|
5 min read
Q&A: What You Need to Know About Open Source Software Risk in 2025
May 22, 2025
|
5 min read
BSIMM15: New focus on securing AI and the software supply chain
Jan 14, 2025
|
5 min read
SANS report: Securing the shifting landscape of application development
Apr 03, 2024
|
2 min read
2024 OSSRA report: Open source license compliance remains problematic
Mar 19, 2024
|
4 min read
Consolidate security tools and vendors to enhance risk management
Nov 27, 2023
|
4 min read
Secure cloud-native apps and APIs at the speed your business demands
Oct 30, 2023
|
6 min read
Bridging the gap between pentesting and automated scanners with business logic assessments
Oct 23, 2023
|
7 min read
The hidden business risks of technical debt in mergers and acquisitions
Oct 13, 2023
|
3 min read
Preparing for critical libcurl and curl vulnerabilities (CVE-2023-38545)
Oct 09, 2023
|
2 min read
CyRC Vulnerability Analysis: XML external entity injection vulnerability in OpenNMS
Oct 04, 2023
|
8 min read
Software Risk Is Business Risk. It’s Time for the C-Suite to Act.
Aug 01, 2023
|
2 min read
Defending against malicious packages in the npm ecosystem and beyond
Jun 30, 2023
|
2 min read
Enhancing cloud security posture with an effective cloud governance framework
Jun 05, 2023
|
4 min read
Connecting the dots: Development + business risk + due diligence
May 26, 2023
|
2 min read
AppSec Decoded: Evaluating threats with threat modeling risk analysis
Apr 25, 2023
|
1 min read
Fast application security testing with the Polaris platform
Apr 25, 2023
|
3 min read
AppSec Decoded: Creating an attack model in threat modeling
Apr 20, 2023
|
1 min read
Polaris integrations: Secure development at the speed of business
Apr 18, 2023
|
3 min read
AppSec Decoded: Creating a system model in threat modeling
Apr 13, 2023
|
1 min read
AppSec Decoded: Scoping + data gathering in threat modeling
Apr 03, 2023
|
1 min read
AppSec Decoded: Takeaways from the 2022 “Software Vulnerability Snapshot” report
Feb 26, 2023
|
1 min read
Spotlight on CRED: Benchmarking security with a BSIMM assessment
Feb 08, 2023
|
3 min read
Scalable SAST and SCA in a single solution with Polaris fAST services
Nov 08, 2022
|
5 min read
The four most important aspects of software due diligence audits
Aug 18, 2022
|
3 min read
Secure SDLC 101: Mastering software development life cycle security
Aug 08, 2022
|
4 min read
Bridging the security gap in continuous testing and the CI/CD pipeline
Jul 24, 2022
|
7 min read
AppSec Decoded: Application security orchestration and correlation
Jul 18, 2022
|
1 min read
OWASP API Security Top 10: Security risks that should be on your radar
Jul 05, 2022
|
5 min read
Enterprise applications run your business, so how can you secure them?
Jun 15, 2022
|
3 min read
AppSec Decoded: Security at the speed of DevOps
Jun 09, 2022
|
1 min read
Tech tales: Achieving PCI compliance with application security testing
May 18, 2022
|
5 min read
Black Duck Open Source Audits: Working through licensing issues like a pro
May 10, 2022
|
3 min read
BYOD in the workforce: MDM and MAM with Microsoft Intune
Mar 31, 2022
|
4 min read
Navigating the road ahead for automotive cybersecurity
Feb 20, 2022
|
10 min read
Scale and mature your AppSec program with a managed services partner
Jan 23, 2022
|
3 min read
Strengthen your cloud security posture with Azure Sentinel
Sep 10, 2021
|
4 min read
ASOC series part 2: How to scale AppSec with application security automation
Sep 08, 2021
|
5 min read
AppSec Decoded: New executive order changes dynamic of software security standards
Jul 28, 2021
|
1 min read
Data privacy laws drive urgency to create a data security strategy
Jun 14, 2021
|
3 min read
Web application security testing at scale with Coverity SAST
Jun 05, 2021
|
3 min read
How to protect your Wi-Fi devices from new FragAttacks vulnerabilities
May 24, 2021
|
2 min read
Biden on cyber security after 100 days: A good start, but now comes the hard part
May 02, 2021
|
6 min read
Get earlier, actionable vulnerability insights from Black Duck Security Advisories
Mar 10, 2021
|
4 min read
AppSec Decoded: Manufacturing more-secure IoT devices
Jan 31, 2021
|
1 min read
Securing your code: GDPR best practices for application security
Jan 26, 2021
|
7 min read
How to evaluate the ROI of your software security program
Jan 21, 2021
|
6 min read
How to cyber security: Software security is everyone’s responsibility
Dec 16, 2020
|
4 min read
The roles and responsibilities that lead to better software security initiatives
Nov 09, 2020
|
6 min read
Cyber security assurance levels in the automotive supply chain
Nov 04, 2020
|
4 min read
AppSec Decoded: The security dilemma of IoT devices
Oct 20, 2020
|
1 min read
Are you ready for ISO SAE 21434 Cybersecurity of Road Vehicles?
Oct 11, 2020
|
3 min read
TANSTAAFL! The tragedy of the commons meets open source software
Sep 10, 2020
|
4 min read
Open source audits: The secret ingredient for successful M&A
Jul 04, 2020
|
5 min read
Are you following the top 10 software security best practices?
Jun 28, 2020
|
4 min read
How to overcome the top 6 application security challenges
Jun 03, 2020
|
2 min read
How to Cyber Security: Application security is critical for data security
Apr 13, 2020
|
5 min read
How 5G and IoT devices open up the attack surface on enterprises
Apr 07, 2020
|
3 min read
Ask the Experts: What’s most rewarding about your career in cyber security?
Feb 02, 2020
|
5 min read
How to Cyber Security: Software is critical infrastructure
Dec 08, 2019
|
3 min read
What are the different types of security vulnerabilities?
Aug 26, 2019
|
3 min read
The license and security risks of using Node.js
Aug 11, 2019
|
6 min read
Why hackers are targeting your web apps (and how to stop them)
Jul 14, 2019
|
4 min read
Web AppSec interview questions every company should ask
Jun 18, 2019
|
7 min read
Q&A: Interactive application security testing (IAST) and Seeker
Jun 17, 2019
|
6 min read
Ask the Experts: Should the US have a data privacy law similar to GDPR?
Jun 10, 2019
|
8 min read
It’s not just autonomous cars of the future that need security
Jun 04, 2019
|
6 min read
Are you making these software standards compliance mistakes?
Apr 18, 2019
|
2 min read
Want to secure your apps? Build security in with the right toolchain
Mar 20, 2019
|
4 min read
Advances in healthcare security since the Anthem data breach
Feb 20, 2019
|
4 min read
3 takeaways from “Managing the Business Risks of Open Source” webinar
Feb 10, 2019
|
2 min read
Shared responsibility model: Who owns cloud security?
Nov 06, 2018
|
2 min read
The intersection between IAST and SCA and why you need both in your security toolkit
Aug 28, 2018
|
3 min read
The Apache Software Foundation can take a joke, but not when it comes to licensing
Aug 14, 2018
|
3 min read
How RASP complements application security testing to minimize risk
Jul 14, 2018
|
2 min read
The what, why, and who of runtime application self-protection (RASP)
Jun 14, 2018
|
3 min read
Navigating responsible vulnerability disclosure best practices
Nov 29, 2017
|
4 min read
Why do companies need a software security program?
Sep 21, 2017
|
3 min read
Did lack of visibility into Apache Struts lead to the Equifax breach?
Sep 10, 2017
|
6 min read
A journey through the secure software development life cycle phases
Sep 05, 2017
|
6 min read
Is threat modeling compatible with Agile and DevSecOps?
Jul 07, 2017
|
3 min read
When should threat modeling take place in the SDLC?
May 24, 2017
|
2 min read
Node.js: Preventing common vulnerabilities in the MEAN stack
May 16, 2017
|
2 min read
ExpressJS: Preventing common vulnerabilities in the MEAN stack (Part 1)
Apr 20, 2017
|
2 min read
Attributes of secure web application architecture
Apr 04, 2017
|
7 min read
Does software quality equal software security? It depends
Mar 26, 2017
|
4 min read
Cloudbleed, like Heartbleed, may affect millions
Feb 22, 2017
|
3 min read
Examining vulnerability criticality when risk ranking vulnerabilities
Feb 16, 2017
|
2 min read
3 things to consider when risk ranking your applications
Jan 23, 2017
|
2 min read
How much do bugs cost to fix during each phase of the SDLC?
Jan 10, 2017
|
3 min read
Here are the top 10 best practices for securing Android apps
Nov 28, 2016
|
3 min read
How to respond to application security incidents
Nov 12, 2016
|
7 min read
Synopsys expands security signoff solution with Cigital and Codiscope acquisition
Nov 05, 2016
|
2 min read
Identifying and resolving software vulnerabilities: A balancing act
Sep 26, 2016
|
2 min read
The Complete Security Vulnerability Assessment Checklist
Sep 07, 2016
|
2 min read
Recognizing Another Type of Threat: Non-targeted Attacks
Aug 31, 2016
|
3 min read
Avoiding false positives in application security through customization
Aug 08, 2016
|
3 min read
Web application security threats and countermeasures
Jul 18, 2016
|
2 min read
4 threat modeling questions to ask before your next Agile sprint
Jun 01, 2016
|
3 min read
What are the real security implications of the Hillary Clinton email scandal?
May 26, 2016
|
6 min read
10 ways to infuse security into your software development life cycle
May 17, 2016
|
4 min read
Man in the middle: When Bob met Alice, and Eve heard everything
Apr 28, 2016
|
3 min read
The complete web application security testing checklist
Apr 25, 2016
|
3 min read
How to do static analysis testing in 6 easy steps
Mar 15, 2016
|
3 min read
Do you believe the 7 myths of software security?
Feb 04, 2016
|
2 min read
When and how to support static analysis tools with manual code review
Jan 27, 2016
|
5 min read
5 essentials of cloud-based application security testing
Jan 14, 2016
|
2 min read
3 ways abuse cases can drive security requirements
Dec 05, 2015
|
3 min read
Software security myth #3: Penetration testing solves everything
Oct 22, 2015
|
5 min read
3 fundamentals of a software security initiative
Oct 07, 2015
|
4 min read
Serving resources over SSL with CSP upgrade-insecure-requests
Aug 06, 2015
|
1 min read
3 reasons software security governance is essential to your business
Jul 27, 2015
|
3 min read
Is conventional penetration testing enough to secure e-commerce applications?
Mar 30, 2015
|
3 min read
Last Published