https://rietta.com/tags/application-security/ Recent content in Application Security on Rietta Cybersecurity Hugo -- gohugo.io en-us 1999-2026 Rietta Inc. All Rights Reserved. https://rietta.com/blog/five-pillars-infosec-ada-accessibility/ Sat, 25 Jul 2026 15:00:00 +0000 https://rietta.com/blog/five-pillars-infosec-ada-accessibility/ Rietta is a cybersecurity firm. So why have the last three posts on this blog been about missing document titles, undefined languages, and metadata fields in government PDFs? My reasoning comes down to this: accessibility failures are security failures, specifically, they’re availability failures, and detecting them at scale is exactly the discipline our industry already practices. To explain why, it helps to back up and lay out the actual model we use to reason about security in the first place. https://rietta.com/blog/uuid-api-security-token-video/ Tue, 14 May 2024 22:36:00 -0500 https://rietta.com/blog/uuid-api-security-token-video/ In this video excert, I discussed the the role of the UUID as an API token and how to improve the security of an application when using them. Specifically, the RFC 4122, Section 6 Security Considerations, cautions developers to “not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example. A predictable random number source will exacerbate the situation. https://rietta.com/blog/conversation-about-cyber-security/ Tue, 28 Nov 2023 10:00:00 -0500 https://rietta.com/blog/conversation-about-cyber-security/ I recently sat down with Jeremy Duvall of 7Factor Software to discuss Cyber Security and application developers. We talk about the ins and outs of modern cyber security practices, weaknesses, how the development environment has changed and stayed the same over twenty years, and what small companies can do to impact improve security! https://rietta.com/blog/prioritizing-cybersecurity/ Wed, 27 Sep 2023 10:00:00 -0500 https://rietta.com/blog/prioritizing-cybersecurity/ Vikas Rewani and I collaborated on an article about Prioritizing Cybersecurity for the Pluralsight blog last year. I want to highlight here one of the topics that was discussed in the article, the importance of breaking down silos: The structure and siloing of a large enterprise organization can thwart security efforts. For instance, security often lives under the IT umbrella, while software development is part of R&D. Further, organizations may utilize a combination of technical resources—in-house, outsourced, onshore and offshore—all reporting to different people, who have varying business goals. https://rietta.com/blog/win-cve-race-with-hackers-on-public-vuln-disclosure/ Tue, 04 Apr 2023 10:00:00 -0500 https://rietta.com/blog/win-cve-race-with-hackers-on-public-vuln-disclosure/ My article written for security executives explaining the critical role of automated testing for long term application security is published! Those who have known and work with me know this topic has been close to my heart for while now. Most organizations are not mature enough to be able to patch within hours. However, we can do a lot better as a industry on proactive security in web app software. https://rietta.com/blog/snowfroc-2020-appsec-takeaways/ Wed, 01 Apr 2020 06:00:00 -0600 https://rietta.com/blog/snowfroc-2020-appsec-takeaways/ I recently attended the Snowfroc conference that took place in Denver early this month. There were a number of talks about creating secure software in the context of a security team working with a development team from the outside, including one by our founder, Frank Rietta. I’ll be doing my best to condense the ideas from many of these talks into a single source. My sources are the following talks: Patch Production Now by Frank Rietta, Why Appsec is Hard for Devs by Scott Gerlach, and Climbing AppSec Mountains by Adam Schaal.