;
;

DZone Security Zone

Recent posts in Security on DZone.com

Your Email Security Is a DNS Configuration Problem

Every email authentication control you deploy is a DNS record. Not "backed by" DNS, not "uses" DNS. It is a DNS record, and when email security bre...
Posted on 8 September 2026 | 12:00 pm

The Bottleneck of Scaling

Any input/output operation, be it accessing a file, handling an HTTP request, or a database connection, is based on 3 fundamental system concepts —...
Posted on 3 September 2026 | 4:00 pm

Gossip on Cryptography: Part 3

In this blog, we will continue our discussion from the previous blog, Parts 1 and 2. If you have not read it, please read it once. So far, we have ...
Posted on 3 September 2026 | 1:00 pm

Beyond Agent-Washing: The Engineering Principles Behind Production-Ready AI Agents

An AI agent is not defined by how intelligently it talks. It's defined by what it's trusted to do. Give a language model a chat window, and you hav...
Posted on 2 September 2026 | 12:00 pm

Designing a Dynamic Multi-Hierarchy Security Model for Analytics and Decision Support Systems

A simple access check uncovered something alarming: several dashboards still showed employee compensation based on an organizational hierarchy that...
Posted on 31 August 2026 | 7:00 pm

Securing Database Connections With Mutual TLS

Stolen credentials served as the entry point in 22% of breaches last year, and in attacks on basic web applications that figure climbs to 88%. Thos...
Posted on 31 August 2026 | 5:00 pm

Secure AI Systems: Defending Enterprise Applications Against Agent-Era Threats

The rise of autonomous AI agents within business software demands a fresh approach to security. Unlike earlier chatbot tools, modern agents act wit...
Posted on 31 August 2026 | 12:00 pm

Making User-Generated Sites Embeddable: X-Frame-Options vs CSP Frame-Ancestors

If you let users publish something, such as a page, prototype, or dashboard, sooner or later you want an "embed this" button so they can drop it in...
Posted on 28 August 2026 | 1:00 pm

Why Your Terraform Drift Alerts Are Useless (And How to Fix Them)

Let me describe a workflow that exists in thousands of engineering organizations right now. Somebody sets up a cron job. It runs terraform plan aga...
Posted on 27 August 2026 | 7:00 pm

When Guest Access Becomes an Attack Surface: A Technical Analysis of the City-Forum Campaign

Learn how attackers enumerated Salesforce Experience Cloud and ServiceNow portals — and how defenders can detect and prevent the same abuse. When G...
Posted on 27 August 2026 | 4:00 pm

Multi-Account AWS Architecture: Isolating PHI Workloads Without Slowing Down Engineering Teams

Most engineering teams working on healthtech applications reach a point where someone asks a question that sounds simple but isn't: How do we make ...
Posted on 24 August 2026 | 7:00 pm

How to Secure Fintech REST APIs Against BOLA Vulnerabilities

Broken Object Level Authorization (BOLA) occurs when a REST API exposes an object identifier—such as an account, transaction, or loan ID — without ...
Posted on 24 August 2026 | 12:00 pm

Why DAST Findings Are Hard to Fix and How to Make Them Actionable

Dynamic testing is essential because it uncovers vulnerabilities in running applications. But while SAST gets the attention because it’s shift-left...
Posted on 20 August 2026 | 12:00 pm

Future-Proofing JWT Security: Crypto-Agility, Post-Quantum Signatures, and IAM Migration

Today, applications are built around identity systems. All API gateways, microservices, mobile backends, and single sign-on flows require some form...
Posted on 17 August 2026 | 5:00 pm

5 Infrastructure Controls for Securing AI Agents

The Disturbing Discovery In July 2026, the AI Red Team at NVIDIA published findings of a six-month assessment review of enterprise AI agents, rangi...
Posted on 14 August 2026 | 6:00 pm

Why AWS and Azure Handle Data Perimeter Differently

AWS can send audit logs to an attacker’s account unless denials are enforced at the network layer, while Azure doesn’t log network-block requests a...
Posted on 13 August 2026 | 1:00 pm

The AI Memory Security Blueprint

Designing Context Isolation, Retrieval Trust, and Vector Database Governance for Enterprise RAG Systems Part 1 — Five Documents Can Hijack a Fronti...
Posted on 12 August 2026 | 5:00 pm

The Agent in Your Pipeline Doesn't Have a Manager. That's the Problem.

AI coding tools made developers faster. Nobody asked what happened when the tools started making decisions. I want to start with a question that m...
Posted on 11 August 2026 | 4:00 pm

Uncover Security Risks in Your Agent Skills Before Deploying

This tutorial explains how to catch a dangerous agent skill before an agent ever runs it: review it automatically, block it in CI if it fails, and ...
Posted on 11 August 2026 | 3:00 pm

We Empowered AI Agents With 'Hands,' Now We Require Kernel-Level Vision to Monitor Them

The cybersecurity industry has been looking at large language models (LLMs) for the past few years as a scary librarian who can be slightly dangero...
Posted on 11 August 2026 | 12:00 pm