Security is Everyone's Business
Security is Everyone's Business
Security is Everyone's Business
Explore software security best practices to enhance user trust in digital services and ensure data safety. Join us in prioritizing security.
Security, Regulation & Compliance
Security testing and regulatory, standards-based, and compliance requirements for software quality.
Articles
Security Tests with Static Analysis
Security Tests with Static Analysis
Security Tests with Static Analysis
Enhance your code's security with static analysis security testing to detect flaws early and ensure quality software development.
Testing Complex E-Government Systems
Testing Complex E-Government Systems
Testing Complex E-Government Systems
Explore E-Government Systems Testing strategies to enhance software quality and usability for optimal user experiences.
Podcast Episodes
Strategy First: How AI Enters Regulated Medical Labs
AI in a regulated medical lab sounds like a compliance nightmare. Here is how a strategy-first approach made it work without breaking the rules.
Developing security requirements as a team
Security requirements remain abstract as long as it is clear what the system is supposed to protect. CIA goals, asset analysis and threat modeling as a card game make it tangible.
Security tests for AI systems
AI systems can be tricked into revealing protected data through clever prompts. Where the points of attack lie and what OWASP recommends.
Practical and safe development with IEC 62443-4-1
Standards do not make secure software by themselves - but 62443-4-1 shows how security really belongs in the process from the very first design step.
From Nokia to iPhone: What Pen Testers Learned
From analog eavesdropping to overlay attacks on banking apps, mobile security has never stopped failing users in new ways.
AI-generated test cases in a regulated environment
AI-generated test cases in the medical technology environment: how a RAG system remains regulatory clean without tool validation.
Legal pitfalls in software contracts
Two missing sentences in a contract can drive a company into bankruptcy. Why agile software contracts often end up as contracts for work, and what protects freelancers.
Using open source securely
Anyone who installs open source components needs a bill of materials - because 80 to 95 percent of modern software is in them. What licenses, security vulnerabilities and the Cyber Resilience Act have to do with it.
Stop Inventing Your Own Encryption
Security built in from the start beats security bolted on at the end. Here is why threat modeling, defense in depth, and secure defaults change everything.
Fuzzy Testing
Fuzzing sounds like chaos, but it's a method: How random input systematically reveals security vulnerabilities and why targeted test data is more useful than pure chance.
Nudging for more security
85 percent of cyberattacks start with a human error. How nudging leads users to safe behavior without forcing them.
Automated security checks
Pen tests at the end of a project always find the same things: headers, misconfigurations, standard gaps. Integrating security into the pipeline reduces this to 4 to 5 really critical findings.
Cyber Resilience Act (CRA)
Mechanical engineers and the Cyber Resilience Act: What companies can expect, where the real hurdles lie and why early action brings a concrete cost advantage.
Secure by Design
Security is often the last item on the agenda - and that is precisely the problem. What defense in depth, threat modeling and secure defaults really mean.
Security analyses
Why security in the development team hardly gets through despite a high level of awareness, and which approach really works in practice.
Court expert
Those who accept software usually only test functions. Whether up to 12,000 undiscovered bugs are normal and what "state of the art" really means in legal terms.
Zero Trust at Deutsche Telekom
Zero Trust is more than just a buzzword: if you don't define it yourself, you're talking past each other. What it means in concrete terms and where to start.
Automotive testing
Automotive testing: a windshield wiper is already considered a safety-critical system. What this means for test methods, standards and everyday life as a tester.
Criminals find every loophole
Out of 73 universities audited, they had to abandon one in five because there were too many gaps. What this means for software security.