Avatao Blog

Cybersecurity best practices, tips, and the latest news discussed by security professionals. Read on to find the topic that interests you the most!

blog avatao

Featured article

Security Champions: Interview with Alexander Antukh, CISO of Glovo

Security Champions: Interview with Alexander Antukh, CISO of Glovo

Reading Time: 7 minutes Security champions represent an essential part of any security programs. They lead their teams on security projects, ensure internal security and help keeping security on the top of your mind. But how exactly they operate in a business? We asked Alexander Antukh, Director of Security at Glovo for professional insights.

read more

Latest posts

Security Champions: Interview with Alexander Antukh, CISO of Glovo

Security Champions: Interview with Alexander Antukh, CISO of Glovo

Reading Time: 7 minutes Security champions represent an essential part of any security programs. They lead their teams on security projects, ensure internal security and help keeping security on the top of your mind. But how exactly they operate in a business? We asked Alexander Antukh, Director of Security at Glovo for professional insights.

Why do you need a security champions program?

Why do you need a security champions program?

Reading Time: 6 minutes As the company grows the leadership wants to establish a security program to ensure the solid and undisrupted operation of the business. Security at this point is essential, especially when calculating the loss from a halted business, even for a few hours.

5 Key Challenges When Building a Security Training Program

5 Key Challenges When Building a Security Training Program

Reading Time: 6 minutes To build an enterprise security program, one has to go back to the well-known fundamentals of organizational change: People, Process, and Technology (originates from Harold Leavitt’s “Applied Organization Change in Industry”, 1964).

Getting started with Kotlin

Getting started with Kotlin

Reading Time: 10 minutes If you are working on Java projects you might have heard about other languages that run on the JVM, like Clojure, Kotlin, or Scala. Programmers like to try new things out but is it worth it to pick one of them over Java?

Life Before Docker and Beyond – A Brief History of Container Security

Life Before Docker and Beyond – A Brief History of Container Security

Reading Time: 11 minutes Containers have been around for over a decade. Yet before Docker’s explosive success beginning in 2013 they were not wide-spread or well-known. Long gone are the days of chroot, containers are all the rage, and with them, we have a whole new set of development and security challenges.

Why cybersecurity is important for business

Why cybersecurity is important for business

Reading Time: 5 minutes Cybersecurity is an inherently negative asset. As with any protective measure, the major challenge is to measure the value (or Return on Investment, ROI) of cybersecurity. It is significantly more difficult to make this value apparent to stakeholders: customers, users and decision-makers in the company.

XSS Case Study

XSS Case Study

Reading Time: 6 minutes Explore the key elements of this Cross-Site Scripting vulnerability in the Google search engine.

A quantitative approach to Data Protection Impact Assessment

A quantitative approach to Data Protection Impact Assessment

Reading Time: 7 minutes Ever-increasing amounts of information are produced, stored, processed, and transferred enabling products and services across all industries. A substantial amount of this information relates to an identified or identifiable natural person i.e., its personal data. The processing of personal data can, unfortunately, also summon risks to individuals’ rights and freedoms, sometimes materializing in real harm.

DNS security and privacy issues and how to avoid them

DNS security and privacy issues and how to avoid them

Reading Time: 7 minutes Even if you use HTTPS, your browsing habits can still be tracked by observing your DNS queries. Besides the lack of confidentiality, plain old DNS doesn’t provide data integrity and authenticity either. This article discusses DNS security and privacy and points out the problems that can arise from lacking in these attributes and gives some tips on how to remedy them.

API vulnerability: Wild card to win USPS customer data

API vulnerability: Wild card to win USPS customer data

Reading Time: 3 minutes The US Postal Service launched its Informed Visibility program last year to provide better insight into their mailstream service. For example, one can obtain near real-time notifications about delivery dates and identify trends. However, they have made much more data available than intended, at least 60 million customers were exposed to anyone who is registered on http://www.usps.com.

An overview of Linux container security

An overview of Linux container security

Reading Time: 5 minutes Containers are often treated as if they were virtual machines which are far from the truth, they are a lot less isolated from the host system. However, there is a myriad of ways to enhance isolation. This blog post will give you an overview of Linux container security.

Not so smart pointers

Not so smart pointers

Reading Time: 5 minutes Even though modern C++ ( the standard since C++11) has made programming in this language much more secure, it also introduced new vulnerabilities hidden under its layers of abstractions. In C and older versions of C++, the concept of pointers wasn’t easy to grasp for beginners. You had to worry about null dereference, dangling pointers, deallocation, etc. However, the Middle Ages are over, we have smart pointers now.

Security and usability: How to find a good balance

Security and usability: How to find a good balance

Reading Time: 8 minutes How would you like the idea of being escorted by armed security staff from the grocery store to your home in order to protect the valuable air fresheners you have just bought? Would you be confused, would you visit the store again?

Smart Contract Security

Smart Contract Security

Reading Time: 6 minutes Blockchain-based platforms are becoming increasingly popular due to their ability to maintain a public distributed ledger, providing reliability, integrity, and auditability for transactions without a trusted entity.

Secure development with Spring Boot

Secure development with Spring Boot

Reading Time: 10 minutes In the past decade, Spring Framework became a well established and prominent web framework for developing Java applications. The most exciting and essential changes in the Spring ecosystem was the birth and progression of Spring Boot. No matter what you need, Spring Boot provides comprehensive, easy-to-use, and interdisciplinary development environment tools for deployment and assists in the whole development lifecycle.

The three fatal bugs behind the Facebook breach

The three fatal bugs behind the Facebook breach

Reading Time: 5 minutes The Facebook breach was discovered after the social media company saw an unusual spike of user activity that began on September 14, 2018. A few days later, on Tuesday, September 25, Facebook’s engineering team discovered an unprecedented security issue, that affected about 30 million users. The social media giant says the flaw has been patched, but the people behind this attack are still unknown.

How to dive into web-security as a developer

How to dive into web-security as a developer

Great developers possess a wide variety of skills, from technological expertise to product thinking. You need some of these for your current job, others you just picked up over the years....

Semancat versioning

Semancat versioning

Tackling the versioning pains of a greenfield project with cats. New projects can force us, developers to face certain challenges that we won’t even have to think about when working on an already...

Git security best practices

Git security best practices

In this article we will discuss different methods to avoid common pitfalls in terms of Git security. We live in a world where it is hard not to know Git, the most popular Distributed Version Control...

Using cloud-services, security is your job too

Using cloud-services, security is your job too

Being cloud native won’t save you from external threats if you as a user are not aware of basic security needs – cloud providers simply cannot do everything for you while due to the heavy demand to...

Report a vulnerability in a responsible way!

Report a vulnerability in a responsible way!

If you have found a vulnerability and you want to act responsibly, discretion is most important. Always remember you have information that can be exploited by black-hats putting not only the...

Broken Access Control

Broken Access Control

In this article we cover examples of broken access control, how to find it in your application and possible consequences. Access control, or authorization, is how a web application grants access to...

Learn about CSP-based XSS protection

Learn about CSP-based XSS protection

The security model of web is rooted in the same-origin policy. Each origin is isolated from the rest of the web and codes should only have access to their origin’s data. Because of this model,...

Learn to build secure software

Learn to build secure software

We are writing millions of lines of code day by day, but only a few of us take security into account. We exactly know that it’s really easy to put security aside as it takes more investment than...

Parse your binaries with Kaitai WebIDE

Parse your binaries with Kaitai WebIDE

Binary analysis starts with the understanding of different file formats. Fortunately, there are several tools (e.g., CFF explorer, FileAlyzer) which help you to understand their internal structure,...

Interview with Chris Wysopal, CTO of Veracode

Interview with Chris Wysopal, CTO of Veracode

We are more than happy to welcome Chris Wysopal, (also on Twitter) as the next security expert on our blog. Chris, the CTO of Veracode, is one of the key influencers in IT security today. He is a...

Interview with Zoltán Balázs, security expert

Interview with Zoltán Balázs, security expert

We are more than happy to welcome Zoltán Balázs, (also on Twitter) as the next security expert on our blog. Zoli has long track records in bypassing security defense products. He regularly gives...

avataoTools introduces popular security tools

avataoTools introduces popular security tools

One of the most difficult parts in IT security is to get started. There are zillions of interesting topics all around, but if you are completely new in this area you can easily get lost....

Interview with Charlie Miller, security researcher

Interview with Charlie Miller, security researcher

Charlie Miller, (also on Twitter) is well-known in the security community for his exceptional hacking results. He won the Pwn2Own contest at CanSecWest 4 times by exploiting various Apple products...

Reverse engineering tutorial and challenge

Reverse engineering tutorial and challenge

So here we are again with your next avatao Tuesday challenge. Today, we are delving a bit into reverse engineering by providing a small tutorial and a challenge to solve. A decent definition for...

Test your secure coding skills with Avatao