This article examines the evolution of privacy computing as a data production factor, outlines its technical architecture and challenges, explores diverse industry applications, and discusses security and regulatory compliance considerations essential for the safe and effective circulation of data assets.
This article examines the Capital One breach case and outlines a comprehensive six‑step framework for enterprises to develop, implement, and continuously improve security awareness training, covering legal foundations, project planning, material preparation, execution scheduling, performance tracking, and post‑training optimization.
The Host Security Capability Construction Guide analyzes evolving threats, categorizes security capabilities into basic, enhanced, and advanced levels, details industry-specific priority requirements, and outlines a comprehensive construction and evaluation process to help enterprises select appropriate solutions and build an effective host security framework.
This article outlines essential Kubernetes security principles based on the 4C model, discusses best practices for clusters, containers, and code, and reviews several open‑source tools such as Kubescape, kube‑bench, Terrascan, kube‑hunter, and Anchore for assessing and improving cluster security.
The article details the background, architecture, early challenges, redesign principles, business and technical issues, and future plans of JD Daojia's product governance system, illustrating how a micro‑service based backend platform detects and resolves compliance problems such as sensitive words, inaccurate weight, and image violations.
The article explains data governance concepts, outlines four common governance models, details key policy elements such as availability, quality, integrity, usability, and security, and highlights the benefits, risks, and best‑practice recommendations for implementing effective data governance in organizations.
This article explains the concept of architecture federation for enterprise architecture, outlines its core principles, key constructs, compliance considerations, and provides practical guidance and best‑practice recommendations for MITRE system engineers and other stakeholders.
The JD Retail Technical Salon held on April 8, 2022 brought together internal and external experts to share experiences on open‑source projects, cloud‑native messaging, frontend and backend frameworks, and compliance, fostering sustainable open‑source ecosystems and encouraging community participation across JD’s engineering teams.
This article details JD Finance's comprehensive privacy compliance governance for its mobile app, covering regulatory background, scope definition, key risk areas, policy and permission management, data encryption, sensitive API handling, third‑party SDK control, tooling such as Pandora Kit and Lancet, and the Utrust platform for automated detection and remediation.
On April 8 2022, JDTECH and JD Retail’s Platform Business R&D co‑hosted a hybrid technical salon on open‑source construction and sustainable development, featuring internal and external experts who shared practical experiences, architectural designs, compliance guidelines, and strategies for building lasting open‑source ecosystems within the company.
Oracle has begun auditing Java usage across enterprises, introducing paid licensing models for Java SE, offering a limited free tier for Java 17, and prompting many companies to switch to OpenJDK to avoid compliance penalties and costly subscriptions.
To meet new Chinese privacy regulations, the article presents an mPaaS‑based solution that uses compile‑time Java HOOKs to replace privacy‑sensitive API calls and dangerous permission requests, automatically detecting and logging violations during build and runtime, and providing backend alerts and management tools for compliance.
This article outlines how Haodf Online implements a closed‑loop partner data security framework—covering background regulations, SDL‑based lifecycle stages, partner information handling, security assessment, API testing, monitoring, and continuous improvement—to protect sensitive medical data across its ecosystem.
The article analyzes the shift from plaintext data exchange to a data‑confidentiality era, outlines regulatory drivers, describes technical challenges of privacy‑preserving computation, evaluates existing cryptographic approaches, and argues that trusted privacy computing is the most promising solution to meet performance, reliability, cost, applicability, and security requirements.
This article presents the background, industry challenges, design principles, architecture, core capabilities, and implementation details of JD Tech's privacy compliance detection system for mobile applications, highlighting both static and dynamic analysis techniques to identify and remediate personal data risks.
This presentation explains how federated learning can meet new regulatory requirements for financial data sharing by introducing audit‑enabled models, incentive mechanisms, blockchain‑based data marketplaces, and a Federated AI Hub that together address compliance, security, and practical deployment challenges in the finance sector.
A Chinese tech blogger retrieved the Android kernel source from UMIDIGI after a GPLv2 violation controversy, documented the process in a YouTube video, and made the code publicly available for developers to review.
A Chinese phone maker UMIDIGI faced public pressure after influencer Naomi Wu and a Polish developer demanded the GPL‑v2‑licensed kernel source of the Android 10‑based UMIDIGI F2, highlighting the obligations and controversies surrounding open‑source compliance.
This comprehensive guide explains how TOGAF’s Architecture Capability Framework helps enterprises build and govern architecture capabilities, covering governance structures, capability components, the ADM phases, architecture committees, compliance processes, and practical governance guidelines for successful enterprise architecture implementation.
This article explains what log auditing is, why a unified audit platform is essential for compliance and security operations, outlines its core goals, main functions such as unified collection, correlation analysis, real‑time alerts, forensic reporting, and describes typical deployment architectures and modules.
This article details a compliance‑driven solution that records, replays, and merges user interaction videos across multiple insurance web pages by leveraging rrweb for event capture, Puppeteer for automated playback, and FFmpeg for video stitching, while addressing performance, storage, and privacy challenges.
This guide provides system administrators with a step‑by‑step checklist to audit and harden Linux operating systems, covering account management, password policies, service restrictions, filesystem permissions, logging configuration, and practical command examples for comprehensive security compliance.
The article explains how DevSecOps extends DevOps by embedding security controls throughout the software lifecycle, outlines its key components, adoption steps, essential tools, implementation capabilities, and the business benefits of merging security with development and operations.
The article explains how data security diagrams map which participants can access specific enterprise data, discusses best practices such as using focused participant‑centric or external‑access diagrams, presents example tables and UML/BPMN and Archimate visualizations, and highlights their role in compliance and trust management.
This article introduces an open‑source security compliance auditing platform built with Django, MongoDB and Redis, detailing its architecture, data synchronization methods, configurable audit strategies, asset inventory, policy configuration, task scheduling, and provides deployment instructions and sample API usage for automating compliance checks across applications, databases and operating systems.
This guide explains what technical risk is, why it matters, and provides a step‑by‑step methodology for assessing, mitigating, and managing technology‑related risks—including lifecycle, compliance, and complexity considerations—to improve cost efficiency, agility, and security across the enterprise.
Docker’s updated service terms clarify that while its commercial services are subject to U.S. export controls and cannot be used in embargoed countries, the open‑source Docker engine itself remains unrestricted, and the article explains the legal background, relevant regulations, and industry impact.
The article outlines enterprise data‑security risks and regulatory demands, reviews symmetric, asymmetric and hash techniques, highlights cloud‑encryption and key‑management challenges, and presents Tencent Cloud’s comprehensive solutions—including KMS, BYOK, white‑box keys, virtual HSMs, and integrated database encryption—to protect data throughout its lifecycle.
A Cloud Access Security Broker (CASB) sits between cloud service consumers and providers to enforce security, compliance, and governance policies, offering visibility, data protection, threat detection, and control over shadow IT, with various deployment modes and integration options for modern cloud environments.
The Zhengda Hospital HIS database outage, caused by unauthorized scripts and poor permission controls, sparked a detailed discussion on how to prevent reckless production testing, enforce proper authorization, design efficient yet secure workflows, improve outsourcing oversight, and build robust emergency and compliance practices.
This article explains why enterprises need information security, outlines the core security requirements such as data protection and business continuity, and presents a phased ISO 27001‑based roadmap—including short‑term, medium‑term goals, management policies, network segmentation, third‑party compliance, and budgeting—to establish a comprehensive security architecture.
China’s mandatory Cybersecurity Graded Protection System 2.0, effective Dec 1 2019, classifies information systems into five security levels, imposes legally enforceable technical and management controls—including encryption, trusted computing, and cloud requirements—and outlines a five‑step assessment, registration, remediation, and supervision process for enterprises to achieve compliance quickly.
GitHub detailed its response to US trade sanctions, outlining how its services—including GitHub.com and GitHub Enterprise Server—are subject to export regulations, what restrictions apply to users in sanctioned regions, and how developers can navigate compliance and appeal processes.
The article explains China’s Network Security Level Protection 2.0 standard, its differences from 1.0, and provides practical guidance for internet companies on key compliance areas such as identity authentication, access control, security auditing, dynamic monitoring, and cloud security to strengthen overall cyber defenses.
This article chronicles the origins, standardization process, historical milestones, learning resources, and conformance challenges of SQL standards, highlighting key ISO/IEC versions, the roles of major vendors, and the growing complexity of the language over more than three decades.
The article examines recent U.S. export control measures targeting Huawei, their ripple effects on global chip and software suppliers, and the newly updated GitHub user agreement that subjects hosted code to U.S. export regulations, raising concerns about the safety and accessibility of open‑source projects for developers worldwide.
This article explains how large enterprises such as BAT and banks implement strict auditing and supervision of operational privileges, using personal accounts, command logging, OSSEC monitoring, firewall limits, and cross‑team oversight to enforce the principle of least privilege.
This talk outlines Alibaba’s massive global host infrastructure, the evolving security governance from manual controls to data‑driven, automated systems, the challenges of compliance and operational efficiency, and future directions such as zero‑trust and invisible security.
This article summarizes essential DevSecOps concepts from the DevOps Handbook, explaining how to embed security throughout the software lifecycle—from making security a shared responsibility to integrating automated checks in development, testing, deployment pipelines, and change management—while highlighting real‑world examples and practical recommendations.
Oracle announced that after January 2019 Java SE 8 will no longer receive public updates without a commercial license, prompting organizations to assess their Java usage, distinguish between general‑computing‑free and paid scenarios, and evaluate potential licensing costs and migration paths.
The EU’s General Data Protection Regulation, effective May 25, dramatically expands data‑privacy rights, imposes strict obligations on all companies handling EU personal data—including non‑EU firms—introduces hefty fines, and reshapes how the internet industry balances advertising revenue with user protection.
This article examines why many organizations doubt the feasibility of DevOps and continuous delivery, analyzes the root causes behind those doubts, and demonstrates through five detailed case studies how regulated environments, non‑web systems, legacy platforms, and cultural factors can all successfully adopt DevOps practices.
The article outlines Apple’s App Store Review Guidelines across safety, performance, business, design, and legal categories, highlights frequent iPhone client rejections such as metadata errors, preview video ads, IAP icon duplication, and missing UGC reporting, and proposes training, risk reporting, and a knowledge base to prevent future violations.
This article explains how MongoDB’s security features—including access control, authentication, encryption, data discovery, retention policies, zone sharding, backup, monitoring, and audit logging—help organizations meet GDPR requirements while minimizing operational overhead and ensuring data sovereignty.
This article explains GDPR's key principles, the Discover‑Defend‑Detect framework, and concrete database controls such as data identification, retention, pseudonymisation, encryption, access control, disaster recovery, and audit logging needed to achieve compliance.
