How Devs Can Improve Open Source Security in the Enterprise
Modern applications are dynamic. They’re distributed and they’re often born in the cloud. These applications can be developed on the fly, spun up and scaled quickly to meet evolving user and market demands—enabling a level of business agility that allows users to make quick, informed decisions in real-time and take advantage of opportunities as they […]
Report: Impact of Bad Software on US Economy Reaches $2.41 Trillion
A report published this week by Synopsys in collaboration with the Consortium for Information & Software Quality (CISQ) estimated that software quality issues might adversely impact the U.S. economy to the tune of $2.41 trillion in 2022. Cybercrime losses due to a rising number of software vulnerabilities alone are on track to increase 42% in […]
Survey Surfaces Raft of DevSecOps Cultural and Technical Challenges
A global survey of 606 IT, security, application development and DevOps decision-makers found that the biggest barrier to adoption of DevSecOps best practices is cultural rather than technical. However, the survey, which polled organizations with more than 500 employees and was conducted by Progress, also found only 16% of respondents planned to prioritize addressing those […]
Implementing Shift Left Security in the Cloud
While ransomware has been the leading concern for enterprise security teams over the few past years, software vulnerabilities are nipping at its heels. The boom in cloud-based apps and services and increased digitization of work have been a boon for hackers, who are taking advantage of developers’ and DevOps teams’ attempts to work faster and […]
4 Best Practices for Entertainment App Testing
Entertainment apps represent a broad category of software, ranging from mobile games, to social media platforms, to streaming video apps and beyond. However, all entertainment apps share a few key traits in common: They typically host dynamic content that is unique for each user. This makes entertainment apps different from apps where most or all […]
Rezilion Adds Windows Support to Dynamic SBOM Tool
Rezilion has added support for Windows applications to its tool for dynamically generating software bills of materials (SBOMs). Rezilion CEO Liran Tancman said in addition to existing support for Linux applications, it’s now possible to analyze all the components that make up a Windows application runtime environment in real-time. That capability also makes it possible […]
Culture a Stumbling Block to DevOps, DevSecOps
Organizations are struggling to improve DevSecOps practices as they confront a lack of cultural alignment and investment, according to a global Progress survey of more than 600 IT, security, application development and DevOps decision-makers. Many companies are behind in achieving their DevOps and DevSecOps goals, with 73% of organizations saying they could be doing more. […]
Palo Alto Networks Buys Cider Security to Lock Down Pipelines
Palo Alto Networks this week extended its efforts to secure application environments by agreeing to acquire Cider Security, a provider of a platform for securing continuous integration/continuous delivery (CI/CD) platforms, for approximately $195 million in cash. The acquisition of Cider Security, scheduled to close this quarter, will extend the reach of the company’s Prisma Cloud […]
Data Centers IN SPAAACE | Discord GDPR Fine | AWS Fires Dead Wood
In this week’s The Long View: The EU wants to put servers in orbit, a GDPR penalty for Discord, and Amazon has the hatchet out.
5 Tips for Securing DevOps: What You Wish You Knew Sooner
Foundations and frameworks, concrete and steel—not exciting. But that’s the foundation and framing of pretty much every modern building. Everything else that is part of a building–flooring, wiring, lighting, room placement and so on—is made possible by the foundation and the framework. If you want DevOps to succeed in your organization, you have to start […]
Critical Vulnerability Discovered in Open Source Backstage Platform
Oxeye today disclosed that it has discovered a critical vulnerability in the open source Backstage software used to build developer portals. Backstage was originally created by Spotify. A 1.5.1 update to the Backstage platform remediated a sandbox escape vulnerability that can occur via a third-party Scaffolder plug-in that could be used to conduct unauthenticated remote […]
Codenotary Automates SBOM Creation
Codenotary today launched a tool that enables an application to automatically generate a software bill of materials (SBOM) by adding a single line to its source code. Codenotary CEO Moshe Bar said TrueSBOM makes it possible to self-report the components used to construct applications to any organization that uses them for the first time. In […]
Aqua Security Claims Compliance With Biden’s Executive Order
Aqua Security this week claimed it is the first software supply chain security platform provider to meet the attestation requirements as defined by an executive order issued to federal agencies last year by the Biden administration. A supplementary memo issued by the Biden administration required federal agencies to collect compliance attestation letters for all software […]
Rust Momentum Intensifies | Elon Says No WFH
In this week’s The Long View: People won’t shut up about Rustlang, and Musk mandates Twitter teams return to the office.
Standardizing Federal Cybersecurity With DevSecOps
DevSecOps is having a moment in the federal government. With President Biden’s Executive Order on Improving the Nation’s Cybersecurity and federal agencies’ issuance of DevSecOps best practices based on the Enduring Security Framework, government organizations are shoring up and standardizing their DevSecOps processes to meet today’s cybersecurity challenges head-on. Integrating security into the development process […]
2023 Application Security Budgets on the Rise
A survey of 500 DevSecOps professionals in the U.S. found nearly three-quarters (73%) of organizations plan to increase investment in application security in 2023. The survey, conducted by Wakefield Research on behalf of Invicti, a provider of dynamic application security testing (DAST) tools, also found 97% of DevSecOps teams said they ignored a real vulnerability […]
OpenSSL Fiasco: What can DevOps Learn? | Elon Fires ‘50%’ of Twitter
In this week’s The Long View: The OpenSSL project has egg on its face, and half of Twitter’s staff are for the chop tomorrow.
Tanium Uses SBOMs to Automate Vulnerability Remediation
Tanium this week added the ability to detect libraries and software packages with known vulnerabilities within a software bill of materials (SBOM) manifest that can then be used to automate remediation of endpoints running vulnerable code. Pete Constantine, senior vice president of product management for Tanium, said the Tanium Software Bill of Materials (SBOM) module […]
Update to Open Source ZAP Tool Improves DAST Performance
An update to the OWASP Zed Attack Proxy (ZAP) open source dynamic application security testing (DAST) tool made available today improves performance by employing a multi-threaded passive scanner engine. Version 2.12.0 of ZAP also adds support for HTTP/2 and should make it simpler to update the vulnerability scanning tool by making the spider that discovers […]
PlanSecOps: Incorporating Security Strategies in Design
Organizations that don’t adapt and change aren’t likely to survive. The same can be said about DevSecOps, a discipline created to ensure security is baked into the software development process, not an add-on after the code is approved. And as much as DevSecOps has changed the software development world for the better, it is time […]
The Scariest Things About SCA
It is a time of ghouls, mischievous spirits and David S. Pumpkins. In the spirit of Halloween, here are the top five scariest limitations of software composition analysis (SCA) tools that are enough to send shivers down your spine. Read on … if you dare! 1. SCA Scans Only Your Application Code SCA’s scope is […]
Meta Income Down by Half | Will Apple Make it Worse? | Linux Secure Boot Fix
In this week’s The Long View: Meta’s latest results are very bad, Apple wants its cut of Facebook ads, and Lennart Poettering proposes improving Secure Boot for Linux.
Sigstore Code Signing Service Becomes Generally Available
A free digital signing service for software created by the Sigstore open source community has become generally available this week via the cloud. Announced at the SigstoreCon event that occurred during the KubeCon + CloudNativeCon North America conference, the cloud service makes it possible for developers to both cryptographically sign artifacts and verify that the […]