Search the Knowledge Center
One search across every technical article, category, reference collection, reference entry, Decision Center tool, and learning path — entirely client-side, with no query ever sent to a server.
Browse by content type
Results
52 of 52 results
How Engineering Managers Quantify Application Security Risk
Quantifying AppSec Risk
CI/CD Security Controls Every Engineering Team Should Have
CI/CD Security Controls
Repository Security Assessment Checklist
Repository Security Checklist
APK Static Analysis, Explained
APK Static Analysis
IPA Security Testing, Explained
IPA Security Testing
Vulnerability Prioritization Beyond CVSS
Vulnerability Prioritization
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
Repository Security
Secret detection, dependency review, SAST patterns, and the access-control practices that keep a codebase auditable.
CI/CD Security
Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Reverse Engineering
Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of.
Software Supply Chain
Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.
OWASP M10OWASP Mobile Top 10
The ten most critical mobile app security risks (OWASP Mobile Top 10, 2024), explained with Strata's own detection mapping for each category.
ASVSOWASP ASVS Controls
OWASP ASVS security verification requirements by chapter — authentication, communications, configuration, and more.
CWECWE Reference
Common Weakness Enumeration reference — the stable weakness-type IDs behind Strata's OWASP-mapped findings, explained for engineers.
ATT&CKMITRE ATT&CK Reference
Application-security-relevant MITRE ATT&CK for Mobile techniques, mapped back to the OWASP Mobile Top 10 category each one relates to.
CVSSCVSS Reference
How CVSS v3.1 Base Score metrics work — exploitability, impact, and vector strings — and how Strata calculates them automatically.
EPSSEPSS Reference
What EPSS measures, how it complements CVSS, and why exploitation likelihood matters for vulnerability prioritization.
KEVCISA Known Exploited Vulnerabilities
An educational overview of CISA's Known Exploited Vulnerabilities catalog and the BOD 22-01 federal remediation mandate.
M1M1: Improper Credential Usage
Hardcoded secrets, API keys, and tokens embedded directly in an application binary or source, rather than provisioned at runtime.
M2M2: Inadequate Supply Chain Security
Third-party dependencies and SDKs with known vulnerabilities, malicious packages, or outdated components pulled directly into the app.
M5M5: Insecure Communication
Cleartext traffic, weak TLS configuration, or disabled certificate pinning that exposes data while it moves between the app and its backend.
M9M9: Insecure Data Storage
Sensitive data persisted in plaintext — SharedPreferences, SQLite, external storage, or an unprotected Keychain entry.
V2ASVS V2: Authentication
Requirements for how an application verifies identity — credential handling, multi-factor authentication, and session initiation.
V9ASVS V9: Communications
Requirements for protecting data in transit — TLS version, certificate validation, and cleartext traffic prevention.
V14ASVS V14: Configuration
Requirements covering build and deployment configuration — debug flags, exported components, and backup exposure.
CWE-798CWE-798: Use of Hard-coded Credentials
A weakness where software contains a hardcoded credential (password, key, or token) used for authentication or encryption.
CWE-1104CWE-1104: Use of Unmaintained Third-Party Components
A weakness from depending on a third-party component that is no longer actively maintained or supported.
CWE-319CWE-319: Cleartext Transmission of Sensitive Information
A weakness where sensitive data is transmitted in a way that allows it to be read by an unauthorized actor in transit.
CWE-922CWE-922: Insecure Storage of Sensitive Information
A weakness where sensitive data is stored without sufficient protection against unauthorized access.
T1404T1404: Exploit OS Vulnerability
An adversary technique where an unpatched operating-system vulnerability is used to escalate privileges beyond what the app or attacker should have.
T1476T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
T1437T1437: Standard Application Layer Protocol
An adversary technique using standard, blend-in network protocols for command-and-control or data exfiltration once a device is compromised.
CVSS Base Score: Exploitability Metrics
The four CVSS v3.1 Base metrics — Attack Vector, Attack Complexity, Privileges Required, User Interaction — that describe how a vulnerability is reached.
CVSS Base Score: Impact Metrics
The three CVSS v3.1 Base impact metrics — Confidentiality, Integrity, Availability — that describe what happens if a vulnerability is successfully exploited.
CVSS Vector Strings, Explained
How to read a compact CVSS v3.1 vector string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What EPSS Actually Measures
A 0–1 probability estimating the likelihood a specific CVE will be exploited in the wild within the next 30 days.
EPSS vs. CVSS: Complementary, Not Competing
Why exploitation likelihood (EPSS) and severity (CVSS) answer different questions, and prioritization needs both.
What the CISA KEV Catalog Is
A CISA-maintained catalog of CVEs with confirmed evidence of active, in-the-wild exploitation — not a predictive or theoretical list.
BOD 22-01 and the Federal Remediation Mandate
The CISA Binding Operational Directive that requires federal civilian agencies to remediate KEV-listed vulnerabilities by an assigned due date.
Vulnerability Prioritization Matrix
Turn seven risk factors into a suggested priority and remediation timeline.
Mobile App Security Review Checklist
A 10-category interactive checklist for reviewing an Android or iOS app before release.
Repository Security Review
Answer questions across 8 repository security categories to surface concrete improvements.
Secure SDLC Planner
Answer five questions about your team to get a tailored secure-development plan.
Application Security Foundations
A guided starting sequence covering standards coverage, OWASP, prioritization reasoning, and a hands-on tool.
Engineering Manager AppSec
A guided sequence for managers reporting on and prioritizing application security risk, from CVSS/EPSS/KEV to a planning tool.
Mobile Application Security
A guided sequence through mobile app security — OWASP Mobile Top 10, key CWEs, and a hands-on interactive checklist.
Repository and CI/CD Security
A guided sequence through repository and CI/CD security — access controls, secrets, dependencies, and two hands-on reviews.
Vulnerability Prioritization
A focused guided sequence on vulnerability prioritization — CVSS, EPSS, CISA KEV, and a hands-on prioritization tool.
Secure SDLC Planning
A guided sequence for designing a secure SDLC — grounded in ASVS and existing repository/CI/CD guidance, ending in a tailored plan.