Publications
What our experts publish.
Since 2002, our experts have been writing about their subjects in specialist articles, talks, podcasts and interviews. You will find more posts in our blog.
Articles, talks, podcasts
Since 2002, sorted by year. For many articles and talks there is a PDF or a recording. Write to us if you are interested in any of them.
2026
-
PHP2Shell: the grace period is over
Tobias Glemser
-
Secure supply chains
Sebastian Fritsch, Dominik Merli (TH Augsburg)
-
Cyber Resilience Act: market intervention for more security?
Tobias Glemser
-
CRA: start implementing now
Tobias Glemser
-
Helping to shape harmonised standards for the CRA
Luise Werner, Louisa Perelo
-
Managing vulnerabilities
Sebastian Fritsch, Dominik Merli (TH Augsburg)
-
Assessing risks
Sebastian Fritsch, Dominik Merli (TH Augsburg)
-
A look into the BSI community: status of the GS++ methodology
Daniel Künkel, Robert Beck (HiSolutions GmbH)
-
The CRA in practice
Sebastian Fritsch, Dominik Merli (TH Augsburg)
2025
-
The new OWASP Top Ten 2025
Tobias Glemser
-
BBOT: detecting attack surfaces automatically and reducing risks
Danny Scherer
-
Detecting security vulnerabilities early with SAST tools
Timo Schäpe
-
Testing large cloud environments (automatically)
Viktor Rechel
-
Grundschutz++: the BSI route to agile security
Reto Lorenz, Daniel Künkel
-
IT security in medium-sized businesses
Tobias Glemser
-
5G risk analysis
Team der secuvera GmbH
-
Penetration tests in practice: what they achieve, how to make them work – and why they often fail
Tobias Glemser
-
The Cyber Resilience Act and the state of the art
Sebastian Fritsch, Sophia Pötsch
-
Penetration tests: benefits, execution and challenges
Tobias Glemser
-
EUCC Scheme – First Experience in Setting Up the Necessary Ecosystem
Sebastian Fritsch
-
Go hack yourself – simple ways to check your biggest points of entry yourself
Tobias Glemser
-
How to prepare your organisation strategically – regulation such as NIS2 or the CRA?
Tobias Glemser
-
Your role as information security officer
Viktor Rechel, Ann-Kathrin Udvary
-
German companies are not yet afraid enough of cyber attacks
Tobias Glemser
-
ISO 27032 – Yet another management system? Classification and relevance
Viktor Rechel, Ann-Kathrin Udvary
2024
-
Women in cybersecurity? That's ridiculous
Kathrin Manhart, Ann-Kathrin Udvary
-
Tackling emergencies in a targeted way – prepared with BCM
Ann-Kathrin Udvary, Björn Lemberg
2023
-
The new ISO 27001 – What to expect
Ann-Kathrin Udvary, Björn Lemberg
2022
-
Penetration tests as part of an ISMS (information security management system) – basics, relevance and possible approaches
Viktor Rechel
-
Two, one, risk... OWASP Top 10 2021
Tobias Glemser
-
Product certifications – what do they offer?
Sebastian Fritsch, Tobias Glemser
2021
-
Penetration tests of web applications – planning and organisation
Tobias Glemser
-
The Power of the Dragon
Tobias Glemser, Rainer Burkardt,
2020
-
Privacy management according to ISO/IEC 27701
Ann-Kathrin Udvary, Björn Lemberg
2010–201942 entries
2019
-
IEC 62443: cybersecurity in the industrial environment
Frank Kienzle, Tobias Glemser
-
Penetration tests of web applications
Tobias Glemser
-
Setting up an ISMS (information security management system) according to ISO 27001 in SMEs
Björn Lemberg
-
Securely connected – OWASP publishes RC API Security Top 10
Tobias Glemser
2018
-
TeleTrusT test scheme for product testing according to IEC 62443-4-2
Sebastian Fritsch
-
Cybersecurity Best Practices (contribution: Cyber Security Check)
-
Planning penetration tests
-
Security of IoT and Industrial IoT (keynote talk)
Tobias Glemser
-
Penetration tests in large enterprises
Tobias Glemser
-
OWASP Top 10 2017
Tobias Glemser
2017
-
Penetration tests: planning aspects, pitfalls and practical benefits
Tobias Glemser
-
Security assessment according to IEC 62443 (industrial IT security)
Kathrin Schäberle
-
Process model for a security assessment according to ISA99 / ISA / IEC 62443
Kathrin Schäberle
-
Security recommendations for configuring Samsung Knox
Sebastian Fritsch
-
Penetration tests: planning aspects, pitfalls and practical benefits
Tobias Glemser
-
Penetration tests
2016
-
Crisis simulations in IT
Dr. Meetz, Tobias Glemser
-
Doomed 4.0: our failure as security experts?
Tobias Glemser
-
Talk on services in the field of Industry 4.0
-
Interview on procuring IT security services
Tobias Glemser
-
Interview on procuring IT security services
Tobias Glemser
2015
-
Security testing for product manufacturers
-
Penetration tests for industrial customers
Tobias Glemser
-
Presentation on penetration testing (together with Andreas Hölscher, LVM)
Tobias Glemser, Andreas Hölscher
-
Self-diagnosis: The Cyber Security Check (BSI/ISACA guideline) – help for self-help
Sven Supper, Tobias Glemser
-
Only half the truth (live hacking)
Tobias Glemser
2014
-
Web application security in the practice of enterprise applications
Tobias Glemser
-
Standardising security reviews of (web) applications: Application Security Verification Standard
Simon Bieber
-
Tomcat security – BSI IT-Grundschutz module
-
Wish list: A vision for the future of IT-Grundschutz
Reto Lorenz
2013
-
BSI (Federal Office for Information Security) protection profile for smart meter gateways and its application
Sebastian Fritsch
-
Security for web-based specialist applications
-
Improving web application security through penetration testing
-
Lückenfinder ZAP
2012
-
Security of mobile devices in communication networks; mobile security and compliance
Tobias Glemser
-
OWASP German Chapter
2011
-
DOMinated: DOM-based cross-site scripting
-
Secure Windows
-
Secure Windows
2010
-
Interview on penetration testing
Tobias Glemser
-
openucf: Unified communications with open source as a framework approach
Sebastian Fritsch
-
Security of web applications
Tobias Glemser
2002–200921 entries
2009
-
Best practice: Planning security tests of web applications
-
VLAN – perceived security
Tobias Glemser
-
Live scenario: Web application security – cross-site scripting (XSS) and other trouble
Tobias Glemser
-
Perceived security: Security properties of VLANs
Tobias Glemser
2008
-
IT-Grundschutz in certification practice
Reto Lorenz
-
Asterisk Security
Sebastian Fritsch
-
VoIP vs. botnets
Tobias Glemser
2007
-
Botnet attacks on VoIP
Tobias Glemser
-
Deployment scenarios for VoIP with Asterisk
Sebastian Fritsch
-
Healthy Distrust – Web Application Security
Christiane Rütten, Tobias Glemser
-
Web application security (classic threats, Ajax attacks, countermeasures)
Tobias Glemser
-
VoIP Insecurity
Tobias Glemser
2006
-
Healthy Distrust – Web Application Security
Christiane Rütten, Tobias Glemser
-
VoIP redundancy concepts – is 99.999% achievable?
Dieter Steinle
-
Penetration tests: fundamentals, risks and best-practice recommendations
Tobias Glemser
-
Penetration tests
Tobias Glemser
-
Penetration tests (part 2)
Tobias Glemser
2005
-
SQL injection
-
VoIP security
2004
-
Security risks in shared web hosting ("know-how" article)
Tobias Glemser, Reto Lorenz
2002
-
Web server security
Workshops at heise conferences
We run these workshops regularly at heise conferences, with open dates for individual participants.
-
ISMS (information security management system) according to ISO 27001 and NIS-2 requirements
Viktor Rechel, Ann-Kathrin Rechel
-
Your role as information security officer
Ann-Kathrin Rechel, Tim Fetzer
-
OWASP Top 10: critical security risks for web applications
Dr. Björn Kaidel, Daniil Dombrovskij
-
IEC 62443: industrial security for product manufacturers
Luise Werner