Latest from Andrew
Lean Security: How Better Development Can Protect Your Business
If companies are to reach their strategic goals—reducing time to market, boosting sales, improving product market fit and brand image, and cutting cybersecurity costs—then it’s time for a new outlook on software security. Today’s business leaders must learn to see security for what it is: A differentiating factor. Companies with reputations for secure developmental processes […]
Jun 3, 2016 · 3 minAll articles by Andrew Storms
Showing 1–11DevOps Security Talks At RSA USA 2015 Conference
DevOps and security. Its a muddled mix of waters made even more confusing by the wet ink still on the concept of DevOps. There is no denying the popularity of DevOps and there is a lot of talk on how the DevOps movement functions alongside security teams. The annual USA RSA conference is just around […]
Security Should Be the Top Driver for DevOps
I’ve often said that the driving factor for many companies in adopting a comprehensive information security program are the dreaded “F” and “A” words – FUD and Audit. Technically FUD is an acronym for fear, uncertainty and doubt. And it might be better said that audit is the action used to hopefully demonstrate compliance and […]
Writing Security Acceptance Criteria into a DevOps Story
When organizations write user stories for development it should include the acceptance criteria. The acceptance criteria being a detailed description of the expected features and functionality the story should deliver. Far too often developers and product managers fail to include information security requirements as part of the acceptance criteria. Including security criteria in every story […]
Moving Security To the Left In a DevOps World
Moving security to the left has become a coined phrase meant to describe the process of getting the security team involved earlier in a process. Most typically, the phrase is used in conjunction with IT or software development projects. One of the top suggestions for ensuring security in a DevOps world is to move security […]
Deputizing Everyone for Security – Building Agile Assurance
Those of us highly focused on the delivery pipeline of DevOps will wonder why we should include the security guy to the party. After all, aren’t they just going to slow down the process and make it harder to deliver good features to end customers? My prior post about introducing SecDevOps by example was not […]
SecDevOps: Security Automation By Example – The Firewall Change
Security Automation By Example The Firewall Change Just when you thought DevOps was the new black, along comes SecDevOps. Yes folks, like most things in life, the new cool is already here. Before I move on to trying to explain SecDevOps, please accept my mea culpa because for many people DevOps is yet to be […]
Delivering Delight At ChefConf 2014
Chef CEO Barry Crist stirs the pot to open ChefConf 2014 The theme from ChefConf 2014 is stirring delight and if you listened to Barry Crist during todays opening keynote, then you would know its more appropriately “F****ing Delight”. Amidst high energy, loud music and a smattering of exciting expletives, Barry Crist called for attendees […]
Using AWS CloudWatch for Anomaly Detection
Based on my unscientific poll of friends, one of the least used and most overlooked features of AWS is CloudWatch. Not only can CloudWatch be used to monitor the availability of your AWS services, but it can also be used as anomaly an detection tool. Did I mention that these feature are free? Since the […]
Logging Wins for Devops and Security
Its always great when companies can invest in tools that serve multiple groups and purposes. Ensuring proper setup and use of logs is one toolset that can serve both DevOps and Security. Why logs are important to DevOps DevOps use logs primarily to understand what’s going on inside an application server, database system or the […]
Security Policies For DevOps 101
A while back I was talking with some friends about how to ensure security inside a devops environment. The simple first thought was that no where does DevOps say to do away with security. Instead, consider how your existing information security practices and policies need to adjust given the changes that DevOps brings to the […]