| By Derek Weeks | Article Rating: |
|
| August 4, 2016 08:45 AM EDT | Reads: |
488 |
In September 2014, Apple made encryption default with the introduction of the iPhone 6. Then, in February 2016, a Los Angeles judge issued an order to Apple to help break into the encrypted iPhone belonging to a terrorist involved in a mass shooting.
Apple had used some of the strongest encryption technologies and practices to protect its users and their data. The encryption technology did not discriminate between lawful and unlawful users. While there were many sides to this issue, it surfaced many important debates on security, privacy, and civil rights.
Peekaboo
For developers wanting to add cryptographic libraries to their applications, a number of open source components are available to them. Of course, anyone seeking to add encryption to an application has an important requirement for the privacy and security it provides.
One of the more popular choices for encryption is known as the Legion of Bouncy Castle Java Cryptography library. According to the 2016 State of the Software Supply Chain report, records reveal that 17.4 million Bouncy Castle components across all versions were downloaded last year. Of these, 5.8 million (33%) were known vulnerable versions of Bouncy Castle.
It's a sobering fact, but it's true. Last year alone, organizations downloaded vulnerable versions of the Bouncy Castle cryptography library 5.8 million times. The defective components downloads occurred across 93,253 unique IP addresses from 13,824 organizations in 197 countries.
Think Different
Think about it. The Bouncy Castle project is developed by experts in cryptography. Occasionally, their crypto library is discovered to have a flaw and the project owners rapidly fix and release a new version. If you use the latest versions without known vulnerabilities, your application, your users, and your data are protected. If you use the versions that include known vulnerabilities, you have electively declined those protections.
Two of the critical principles of using open source components are to use the highest quality components and to select them from the best suppliers. In this case, the Bouncy Castle project does an excellent job of releasing new and improved versions. While flawed versions are still available, those seeking to protect applications, users, and data need to use the highest quality versions.
Which Version Are You Using?
Determining which versions of Bouncy Castle or any other open source component you are using is simple. A number of free and paid services are available to help you analyze your application and report a full list of the components, including dependencies, that are used.
Some of the free services require you to upload your application for analysis while other services are performed on-premises. One example of a free on-premises tool used to create a software Bill of Materials is the Application Health Check app from Sonatype. Another example is the OWASP Dependency Check app. Precision of these tools may vary, but regardless of the tool you use, you should use one.
More insights on the quality, security, and integrity of open source components used to build modern applications can be found in the 2016 State of the Software Supply Chain report.
Published August 4, 2016 Reads 488
Copyright © 2016 SYS-CON Media, Inc. — All Rights Reserved.
Syndicated stories and blog feeds, all rights reserved by the author.
More Stories By Derek Weeks
In 2015, Derek Weeks led the largest and most comprehensive analysis of software supply chain practices to date across 160,000 development organizations. He is a huge advocate of applying proven supply chain management principles into DevOps practices to improve efficiencies, reduce costs, and sustain long-lasting competitive advantages.
As a 20+ year veteran of the software industry, he has advised leading businesses on IT performance improvement practices covering continuous delivery, business process management, systems and network operations, service management, capacity planning and storage management. As the VP and DevOps Advocate for Sonatype, he is passionate about changing the way people think about software supply chains and improving public safety through improved software integrity. Follow him here @weekstweets, find me here www.linkedin.com/in/derekeweeks, and read me here http://blog.sonatype.com/author/weeks/.
Aug. 5, 2016 11:15 AM EDT Reads: 2,938 |
By Pat Romanski Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity.
In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet a...Aug. 5, 2016 11:00 AM EDT Reads: 1,338 |
By Liz McMillan Cloud analytics is dramatically altering business intelligence. Some businesses will capitalize on these promising new technologies and gain key insights that’ll help them gain competitive advantage. And others won’t.
Whether you’re a business leader, an IT manager, or an analyst, we want to help you and the people you need to influence with a free copy of “Cloud Analytics for Dummies,” the essential guide to this explosive new space for business intelligence.Aug. 5, 2016 10:45 AM EDT Reads: 1,364 |
By Elizabeth White Deploying applications in hybrid cloud environments is hard work. Your team spends most of the time maintaining your infrastructure, configuring dev/test and production environments, and deploying applications across environments – which can be both time consuming and error prone. But what if you could automate provisioning and deployment to deliver error free environments faster? What could you do with your free time?Aug. 5, 2016 10:00 AM EDT Reads: 1,100 |
By Pat Romanski Sauce Labs has selected Sumo Logic to troubleshoot and better track log performance issues to predict potential issues before they occur. With Sumo Logic, Sauce Labs now has the ability to better help its customers accelerate the software and development cycle.
Sauce Labs provides a high-performance, cloud-based automated testing platform that is optimized for Continuous Integration and Continuous Deployment (CI/CD) workflows. Catering to fast-moving companies that employ modern development tec...Aug. 5, 2016 09:45 AM EDT Reads: 771 |
By Liz McMillan There will be new vendors providing applications, middleware, and connected devices to support the thriving IoT ecosystem. This essentially means that electronic device manufacturers will also be in the software business. Many will be new to building embedded software or robust software. This creates an increased importance on software quality, particularly within the Industrial Internet of Things where business-critical applications are becoming dependent on products controlled by software. Qua...Aug. 5, 2016 09:30 AM EDT Reads: 1,988 |
By Elizabeth White SYS-CON Events announced today that MangoApps will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device.Aug. 5, 2016 08:45 AM EDT Reads: 1,772 |
By Elizabeth White In his session at Cloud Expo, Robert Cohen, an economist and senior fellow at the Economic Strategy Institute, will provide economic scenarios that describe how the rapid adoption of software-defined everything including cloud services, SDDC and open networking will change GDP, industry growth, productivity and jobs.
This session will also include a drill down for several industries such as finance, social media, cloud service providers and pharmaceuticals.Aug. 5, 2016 08:45 AM EDT Reads: 856 |
By Pat Romanski On Dice.com, the number of job postings asking for skill in Amazon Web Services increased 76 percent between June 2015 and June 2016. Salesforce.com saw its own skill mentions increase 37 percent, while DevOps and Cloud rose 35 percent and 28 percent, respectively.
Even as they expand their presence in the cloud, companies are also looking for tech professionals who can manage projects, crunch data, and figure out how to make systems run more autonomously. Mentions of ‘data science’ as a skill ...Aug. 5, 2016 08:45 AM EDT Reads: 1,065 |
By Elizabeth White Security, data privacy, reliability, and regulatory compliance are critical factors when evaluating whether to move business applications from in-house, client-hosted environments to a cloud platform. Quality assurance plays a vital role in ensuring that the appropriate level of risk assessment, verification, and validation takes place to ensure business continuity during the migration to a new cloud platform. Aug. 5, 2016 08:30 AM EDT Reads: 973 |
By Liz McMillan Up until last year, enterprises that were looking into cloud services usually undertook a long-term pilot with one of the large cloud providers, running test and dev workloads in the cloud. With cloud’s transition to mainstream adoption in 2015, and with enterprises migrating more and more workloads into the cloud and in between public and private environments, the single-provider approach must be revisited.
In his session at 18th Cloud Expo, Yoav Mor, multi-cloud solution evangelist at Cloudy...Aug. 5, 2016 08:00 AM EDT Reads: 1,163 |
By Elizabeth White The South Florida Business Journal honored Chetu Inc. with an inclusion on South Florida's Top 100 Private Companies List. Chetu ranked at number 80 amongst other private businesses who showed tremendous revenues for 2015, are native to South Florida and have verifiable revenue figures. Chetu showed $31.51 million in revenues for 2015. That figure is a 10% increase from the $29.05 million in revenue earned in 2014.Aug. 5, 2016 07:00 AM EDT Reads: 604 |
By Elizabeth White With the proliferation of both SQL and NoSQL databases, organizations can now target specific fit-for-purpose database tools for their different application needs regarding scalability, ease of use, ACID support, etc. Platform as a Service offerings make this even easier now, enabling developers to roll out their own database infrastructure in minutes with minimal management overhead. However, this same amount of flexibility also comes with the challenges of picking the right tool, on the right ...Aug. 5, 2016 06:45 AM EDT Reads: 1,788 |
By Elizabeth White "We host and fully manage cloud data services, whether we store, the data, move the data, or run analytics on the data," stated Kamal Shannak, Senior Development Manager, Cloud Data Services, IBM, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.Aug. 5, 2016 06:45 AM EDT Reads: 1,710 |
By Elizabeth White Synchronoss announced the general availability of its Secure Mobility Platform (SMP) – the combination of a highly secure application container and integrated productivity suite that together improves the productivity and performances of enterprise mobile workforces.
Designed and built using secure enterprise mobility technology contributed by Goldman Sachs through the venture announced last November, Synchronoss SMP consists of:
Synchronoss Lagoon – a secure device container which encrypts ...Aug. 5, 2016 06:30 AM EDT Reads: 669 |
By Elizabeth White Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations.
In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to imp...Aug. 5, 2016 05:45 AM EDT Reads: 2,811 |
By Pat Romanski Extreme Computing is the ability to leverage highly performant infrastructure and software to accelerate Big Data, machine learning, HPC, and Enterprise applications. High IOPS Storage, low-latency networks, in-memory databases, GPUs and other parallel accelerators are being used to achieve faster results and help businesses make better decisions.
In his session at 18th Cloud Expo, Michael O'Neill, Strategic Business Development at NVIDIA, focused on some of the unique ways extreme computing is...Aug. 5, 2016 05:45 AM EDT Reads: 1,217 |
By Liz McMillan Personalization has long been the holy grail of marketing. Simply stated, communicate the most relevant offer to the right person and you will increase sales. To achieve this, you must understand the individual. Consequently, digital marketers developed many ways to gather and leverage customer information to deliver targeted experiences.
In his session at @ThingsExpo, Lou Casal, Founder and Principal Consultant at Practicala, discussed how the Internet of Things (IoT) has accelerated our abil...Aug. 5, 2016 05:15 AM EDT Reads: 395 |
By Liz McMillan “delaPlex Software provides software outsourcing services. We have a hybrid model where we have onshore developers and project managers that we can place anywhere in the U.S. or in Europe,” explained Manish Sachdeva, CEO at delaPlex Software, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.Aug. 5, 2016 05:00 AM EDT Reads: 1,920 |
By Pat Romanski In today's uber-connected, consumer-centric, cloud-enabled, insights-driven, multi-device, global world, the focus of solutions has shifted from the product that is sold to the person who is buying the product or service. Enterprises have rebranded their business around the consumers of their products. The buyer is the person and the focus is not on the offering. The person is connected through multiple devices, wearables, at home, on the road, and in multiple locations, sometimes simultaneously...Aug. 5, 2016 05:00 AM EDT Reads: 1,235 |

Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity.
In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet a...
Cloud analytics is dramatically altering business intelligence. Some businesses will capitalize on these promising new technologies and gain key insights that’ll help them gain competitive advantage. And others won’t.
Whether you’re a business leader, an IT manager, or an analyst, we want to help you and the people you need to influence with a free copy of “Cloud Analytics for Dummies,” the essential guide to this explosive new space for business intelligence.
Deploying applications in hybrid cloud environments is hard work. Your team spends most of the time maintaining your infrastructure, configuring dev/test and production environments, and deploying applications across environments – which can be both time consuming and error prone. But what if you could automate provisioning and deployment to deliver error free environments faster? What could you do with your free time?
Sauce Labs has selected Sumo Logic to troubleshoot and better track log performance issues to predict potential issues before they occur. With Sumo Logic, Sauce Labs now has the ability to better help its customers accelerate the software and development cycle.
Sauce Labs provides a high-performance, cloud-based automated testing platform that is optimized for Continuous Integration and Continuous Deployment (CI/CD) workflows. Catering to fast-moving companies that employ modern development tec...
There will be new vendors providing applications, middleware, and connected devices to support the thriving IoT ecosystem. This essentially means that electronic device manufacturers will also be in the software business. Many will be new to building embedded software or robust software. This creates an increased importance on software quality, particularly within the Industrial Internet of Things where business-critical applications are becoming dependent on products controlled by software. Qua...
SYS-CON Events announced today that MangoApps will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device.
In his session at Cloud Expo, Robert Cohen, an economist and senior fellow at the Economic Strategy Institute, will provide economic scenarios that describe how the rapid adoption of software-defined everything including cloud services, SDDC and open networking will change GDP, industry growth, productivity and jobs.
This session will also include a drill down for several industries such as finance, social media, cloud service providers and pharmaceuticals.
On Dice.com, the number of job postings asking for skill in Amazon Web Services increased 76 percent between June 2015 and June 2016. Salesforce.com saw its own skill mentions increase 37 percent, while DevOps and Cloud rose 35 percent and 28 percent, respectively.
Even as they expand their presence in the cloud, companies are also looking for tech professionals who can manage projects, crunch data, and figure out how to make systems run more autonomously. Mentions of ‘data science’ as a skill ...
Security, data privacy, reliability, and regulatory compliance are critical factors when evaluating whether to move business applications from in-house, client-hosted environments to a cloud platform. Quality assurance plays a vital role in ensuring that the appropriate level of risk assessment, verification, and validation takes place to ensure business continuity during the migration to a new cloud platform.
Up until last year, enterprises that were looking into cloud services usually undertook a long-term pilot with one of the large cloud providers, running test and dev workloads in the cloud. With cloud’s transition to mainstream adoption in 2015, and with enterprises migrating more and more workloads into the cloud and in between public and private environments, the single-provider approach must be revisited.
In his session at 18th Cloud Expo, Yoav Mor, multi-cloud solution evangelist at Cloudy...
The South Florida Business Journal honored Chetu Inc. with an inclusion on South Florida's Top 100 Private Companies List. Chetu ranked at number 80 amongst other private businesses who showed tremendous revenues for 2015, are native to South Florida and have verifiable revenue figures. Chetu showed $31.51 million in revenues for 2015. That figure is a 10% increase from the $29.05 million in revenue earned in 2014.
With the proliferation of both SQL and NoSQL databases, organizations can now target specific fit-for-purpose database tools for their different application needs regarding scalability, ease of use, ACID support, etc. Platform as a Service offerings make this even easier now, enabling developers to roll out their own database infrastructure in minutes with minimal management overhead. However, this same amount of flexibility also comes with the challenges of picking the right tool, on the right ...
"We host and fully manage cloud data services, whether we store, the data, move the data, or run analytics on the data," stated Kamal Shannak, Senior Development Manager, Cloud Data Services, IBM, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Synchronoss announced the general availability of its Secure Mobility Platform (SMP) – the combination of a highly secure application container and integrated productivity suite that together improves the productivity and performances of enterprise mobile workforces.
Designed and built using secure enterprise mobility technology contributed by Goldman Sachs through the venture announced last November, Synchronoss SMP consists of:
Synchronoss Lagoon – a secure device container which encrypts ...
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations.
In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to imp...
Extreme Computing is the ability to leverage highly performant infrastructure and software to accelerate Big Data, machine learning, HPC, and Enterprise applications. High IOPS Storage, low-latency networks, in-memory databases, GPUs and other parallel accelerators are being used to achieve faster results and help businesses make better decisions.
In his session at 18th Cloud Expo, Michael O'Neill, Strategic Business Development at NVIDIA, focused on some of the unique ways extreme computing is...
Personalization has long been the holy grail of marketing. Simply stated, communicate the most relevant offer to the right person and you will increase sales. To achieve this, you must understand the individual. Consequently, digital marketers developed many ways to gather and leverage customer information to deliver targeted experiences.
In his session at @ThingsExpo, Lou Casal, Founder and Principal Consultant at Practicala, discussed how the Internet of Things (IoT) has accelerated our abil...
“delaPlex Software provides software outsourcing services. We have a hybrid model where we have onshore developers and project managers that we can place anywhere in the U.S. or in Europe,” explained Manish Sachdeva, CEO at delaPlex Software, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.
In today's uber-connected, consumer-centric, cloud-enabled, insights-driven, multi-device, global world, the focus of solutions has shifted from the product that is sold to the person who is buying the product or service. Enterprises have rebranded their business around the consumers of their products. The buyer is the person and the focus is not on the offering. The person is connected through multiple devices, wearables, at home, on the road, and in multiple locations, sometimes simultaneously...
More than 95 percent of the world’s enterprises rely on SSH user keys to provide administrators and developers an effective means of gaining encrypted access to critical infrastructure: operating systems, applications, payment processing systems, databases, human resource and financial systems, routers, switches, firewalls and other network devices. It is a lifeline of traffic flow within our data centers, our cloud environments and how our third-party vendors and supply chain access our environments. It has done its job quietly and efficiently over the last two decades. Unfortunately, the acc...
Experts are debating whether the Democratic National Committee’s (DNC) email system was hacked by the Russian military intelligence service (G.R.U.) or Guccifer 2.0, a lone wolf Romanian hacker. While this is a very important question, the answer will not change the results: over 20,000 DNC emails ended up on WikiLeaks. How did this happen? How likely is it to happen to you or your company? What can you do to protect your email system from a similar fate?
In this blog I’ll show you how to guard routes in Angular 2 Router (currently at 3.0.0-beta.2).
Let’s consider some scenarios that require a certain validation to be performed to decide if the user (or a program) is allowed to navigate to or leave the route:
Allowed to open the route only if the user is authenticated and authorized to do so.
Implement a multi-part form that consists of several components, and the user is allowed to navigate to the next form section only if the data entered in the current one is valid.
Tangerine Bank in Toronto has improved end-user experiences for online banking and made data more secure across its lifecycle, speeding the delivery of a new credit card offering.
We'll now learn how improving end-user experiences for online banking and making data more secure across its lifecycle has helped speed the delivery of a new credit card offering.
It took some time but the need for Total Security Management is slowly starting to sink in. With regard to quality it took the western manufacturing industry several decades before it realized that a separate quality department – standing at the end of the production line to check which products did not meet the mandated specs – was a costly and disastrous path to take. And slowly but surely we are seeing similar thinking with regard to cyber and cloud security emerge.
Conjecture, an opinion or conclusion formed on the basis of incomplete information.
All digital transformation initiatives introduce new problems, software bugs, guaranteed network vulnerabilities, new competitors; new business challenges and new stresses. The elimination of all negative consequences and vulnerabilities are impossible, so our focus should be on limiting and containing it, not eliminating it.
The convergence of cloud, mobility, and Big Data analytics has prompted companies to innovate and produce new levels of award-winning productivity.
To learn how these trend-setters create innovation value, we're joined by some finalists from the Citrix Synergy 2016 Innovation Awards Program: Olaf Romer, Head of Corporate IT and group CIO at Bâloise in Basel, Switzerland; Alan Crawford, CIO of Action for Children in London, and Craig Patterson, CEO of Patterson and Associates in San Antonio, Texas. The discussion is moderated by me, Dana Gardner, Principal Analyst at Interarbor Solutions.
Purdue University has created a strategic IT environment to support dynamic workload requirements. The next BriefingsDirect Voice of the Customer IT infrastructure thought leadership case study explores how Purdue University has created a strategic IT environment to support dynamic workload requirements.
We'll now hear how Purdue extended a research and development IT support infrastructure to provide a common and "operational credibility" approach to support myriad types of compute demands by end users and departments.
After Internet of Things (IoT), Connected Cars is the most used buzzword in the industry. From automobile manufacturers to software vendors to telecom operators to consumer electronic companies, everyone is excited about the connected vehicle phenomenon. With the power of 20 modern PCs, contemporary cars pack more punch than any another computing device. They contain more
My friend Dan sent me this press release (since he knows that I like all things “Data Analytics” related). In the press release, “Boeing Announces Data Analytics Agreements with Six Airlines,” Boeing announces that they are providing advanced analytic solutions to several airline customers including:
All Nippon Airways (ANA) signed a renewal contract for Airplane Health Management (AHM) on its entire future fleet of Boeing 787 aircraft. ANA uses AHM tools to monitor their aircraft in real time and proactively manage maintenance operations more efficiently.
More than with previous technological (r)evolutions a side effect of cloud computing seems to be an increase in the degree of centralisation and concentration, not just within company organisations, but particularly in the wider commercial market. This is the most obvious with Software as a Service, where providers such as AirBNB, Uber, but also earlier cloud services such as LinkedIn and Google Search quickly established a ‘winner takes all’ distribution of market share and thus market power. And also in Infrastructure as a Service, we see an quickly diminishing number of suppliers still hav...
Okay, okay, that seems like an odd thing to say. But at a recent keynote, that came out of my mouth. But that’s a confusing statement, so let me share the entirety of what I said:
Big Data is about getting small; it’s about getting down to the level of the individual.
Sometimes the Big Data conversation gets too fixated on the “big” part of the conversation: Is my data big enough? Is my company big enough? Is my analytics team big enough?
While API virtualization is already over a decade old, many developers, testers, and decision-makers still misunderstand it.
Virtual APIs create an environment that teams can use to mimic the characteristics of the production environment and create simulated responses from all APIs the application relies on.
API virtualization is a single technique that pays off in several distinct roles. Let's take a look at a few examples to help illustrate the benefits attached to virtual APIs.
The Citrix Technology Professionals Program, or CTP, gives participants a larger say in essential strategy initiatives such as enabling mobile work styles.
As an example, we will explore how the Citrix Technology Professionals Program, or CTPs as they are referred to, gives participants a larger say in essential strategy initiatives such as enabling mobile work styles.





















