Sven Ruppert on foojay.io - Friends of OpenJDK

SolarWinds Hack: What Does This Mean For Us?

Thu, 19 Aug 2021 08:19:56 +0000

In the past two years, we have had to learn a lot about cybersecurity. New attack vectors are becoming more and more sophisticated and are directed more and more against the value chain in general.

But what does that mean for us? What can be done about it, and what reactions have the state already taken?

Let’s start with the story that got all of this rolling and made sure that the general attention was drawn to the vulnerabilities of the available IT infrastructure.

Introducing SAST, DAST, IAST and RASP

Thu, 05 Aug 2021 08:28:52 +0000

In this article, we’re going to look at the differences between the various cybersecurity defence techniques. Here you can identify four main groups, which we will go through briefly one after another to illustrate the advantages and disadvantages.

SAST: Static Application Security Testing

SAST describes the process in which the components of an application are subjected to a static analysis. This approach not only searches for security gaps but also determines the licenses for the individual elements. In the following, however, I will only deal with the consideration of vulnerabilities.

CVSS 101: First Steps with Common Vulnerability Scoring System

Wed, 14 Jul 2021 06:56:13 +0000

What is the Common Vulnerability Scoring System (CVSS), who is behind it, what are we doing with it, and what does a CVSS Value mean for you?

On Foojay, you can apply the insights below to understand the Security/CVE Views in the OpenJDK Update & Release Details pages , such as the one shown here:

I will explain how a CVSS Score is calculated, what the different elements of it mean, and what are the differences between the different CVSS versions.

About The Lifecycle of a Security Vulnerability

Thu, 08 Jul 2021 08:40:56 +0000

Again and again, we read in the IT news about new security gaps that have been identified. The more severe the classification of the loophole, the more attention the information receives in the general press. Most of the time, you don’t even hear or read anything about all the security holes found that are not as well known as the SolarWinds Hack, for example.

But what is the typical lifecycle of such a security gap?

Delegation vs. Inheritance in Graphical User Interfaces

Wed, 24 Feb 2021 16:07:53 +0000

In this article, we will look at the difference between inheritance and delegation concepts.

Or, to put it in another way, why I prefer delegation and why I want to emphasize this rarely-used feature in Java.

The Challenge

The challenge we face today is quite common in the field of graphic user interfaces like desktop- or web-apps: Java is widely used as the development language for both worlds and it does not matter if we are in the classic fields of Swing or JavaFX or in the field of web frameworks like Vaadin. Explicitly, I’ve opted for a pseudo-class model in core Java, as I’d like to look at the design patterns here without any technical details.

Quick Security Wins and Getting Started with DevSecOps

Wed, 03 Feb 2021 17:41:45 +0000

Hello and welcome to my first DevSecOps article! Here in Germany, it’s winter right now, and the forests are quiet. The snow slows down everything and it’s a beautiful time to move undisturbed through the woods. Here you can pursue your thoughts, and I started thinking about a subject that customers or participants at conferences ask me repeatedly.

The question I am asked is almost always: “What are the quick wins or low hanging fruits if you want to deal more with the topic of security in software development? And I want you to answer this question right now!”