The Regulators Are Coming for Your Washing Machine App

The Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and the Security Requirements for Relevant Connectable Products Regulations 2023 are setting new standards for IoT device security in the UK. These regulations mandate manufacturers to secure hardware, software, and APIs against breaches, prohibit default passwords, ensure secure storage of API keys, and implement vulnerability management processes. Learn how these laws impact IoT manufacturers and the steps needed for compliance.

Service Now RCE - The Three Keys to ServiceNow's Data Vault

ServiceNow recently patched critical vulnerabilities (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) that allow remote code execution and sensitive file reads. Exploits involve server-side template injection using Apache Jelly. Traceable has deployed protection mechanisms to safeguard against these threats.

Who Owns API Security? Introducing the Key Players

In modern application development, APIs (Application Programming Interfaces) are pivotal for connectivity and functionality. However, with their rising usage, API security risks also escalate. Ensuring API security isn't the duty of a single individual or team; it necessitates collaboration among multiple stakeholders. From CISOs to heads of enterprise architecture and product security, this blog delves into the key players and their roles in crafting a robust API security program.

Traceable API Security Platform Updates - June & July 2024

This past month’s releases include major improvements to data classification, UX improvements for API catalog, AST changes, and a new threat activity UI for improved visibility and more efficient analysis.

Recent Posts

Securing Generative AI-Enabled Applications: Crawl - Walk - Run Strategy for Product Security

Service Now RCE - The Three Keys to ServiceNow's Data Vault

How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System

Organizing API Security Around the NIST Cybersecurity Framework

The Regulators Are Coming for Your Washing Machine App

Navigating the Road to Automotive Security

API Security

Organizing API Security Around the NIST Cybersecurity Framework

Explore how the NIST Cybersecurity Framework 2.0 can revolutionize your API security strategy. This guide outlines key functions and activities for securing APIs, including risk identification, protection measures, real-time detection, incident response, and recovery processes. Enhance your organization's API security posture and protect critical data with actionable insights and best practices.

Organizing API Security Around the NIST Cybersecurity Framework

Explore how the NIST Cybersecurity Framework 2.0 can revolutionize your API security strategy. This guide outlines key functions and activities for securing APIs, including risk identification, protection measures, real-time detection, incident response, and recovery processes. Enhance your organization's API security posture and protect critical data with actionable insights and best practices.

API Security: What Every Developer Needs to Know

APIs are the backbone of modern apps. Learn crucial API security principles to defend against OWASP Top 10 vulnerabilities, implement robust authentication, and ensure data protection.

API Summit 2024: Security Challenges, AI, and What's Next

API security isn't always top of mind. Here's what I learned about the challenges and the latest trends from the API Summit.

Context-Aware Security as the Key Driver for Enhancing API Security in 2024

APIs are evolving, and so is API security. Context-aware security analyzes user behavior, data sensitivity, and environmental factors for real-time threat responses. Discover why it's the future of API protection in this comprehensive blog post.

Traceable ASPEN

Service Now RCE - The Three Keys to ServiceNow's Data Vault

ServiceNow recently patched critical vulnerabilities (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) that allow remote code execution and sensitive file reads. Exploits involve server-side template injection using Apache Jelly. Traceable has deployed protection mechanisms to safeguard against these threats.

Navigating the Road to Automotive Security

In today's connected world, automobiles are complex systems driven by APIs, but this brings risks; Traceable ASPEN's latest research highlights urgent automotive security needs by analyzing recent vulnerabilities, including real-time vehicle tracking and data breaches.

Critical PHP CGI Argument Injection Vulnerability (CVE-2024-4577) Leads to Remote Code Execution

Researchers have identified a critical remote code execution vulnerability in PHP, known as CVE-2024-4577. This flaw, affecting PHP installations on Windows, exploits a Unicode processing oversight, allowing attackers to inject arbitrary command-line arguments. With a CVSS score of 9.8, it poses a severe threat to server security. Read on to understand the vulnerability, its impact, and essential protective measures.

Service Now RCE - The Three Keys to ServiceNow's Data Vault

ServiceNow recently patched critical vulnerabilities (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) that allow remote code execution and sensitive file reads. Exploits involve server-side template injection using Apache Jelly. Traceable has deployed protection mechanisms to safeguard against these threats.

How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System

APIs are essential for modern web applications, but they also introduce significant security challenges. Even large enterprises can fall prey to simple API vulnerabilities, as demonstrated by Traceable's discovery of a critical security flaw in Honeywell’s BEDQ system. This incident underscores the importance of robust API security measures.

Navigating the Road to Automotive Security

In today's connected world, automobiles are complex systems driven by APIs, but this brings risks; Traceable ASPEN's latest research highlights urgent automotive security needs by analyzing recent vulnerabilities, including real-time vehicle tracking and data breaches.

Product Updates

Traceable API Security Platform Updates - June & July 2024

This past month’s releases include major improvements to data classification, UX improvements for API catalog, AST changes, and a new threat activity UI for improved visibility and more efficient analysis.

December Software Release

December was an extremely busy month for Traceable as we worked with customers to protect their environments from the Log4Shell vulnerability.

Traceable API Security Platform Updates - May 2024

Traceable, a leading API security platform, has released major updates in May 2024, including new compliance policies and issues dashboard, fine-grained filters for targeted API security testing, and enhancements to credential stuffing and volumetric attack detection. These updates empower organizations to maintain API compliance, conduct targeted security testing, and combat advanced API threats effectively.

March | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, local hosting for EU/Asia and support for agentless deployments.

February | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, new support for AWS Lambda serverless architecture and new privacy features for managing sensitive data.

Traceable Defense AI M8 Released

Easier deployment process, extended agent support, extended API Intelligence, easier to find problems, protection additions, improved UX around threat hunting, ability to isolate per environment