DevSecOps May Be Key to Prevent Data Leaks
Data leakage has become something of a norm in the digital realm, despite the fact that cybersecurity budgets are growing and more engineers are assigned to these very issues. Nowhere does this seem more true than in the realm of health care, where breaches that expose sensitive patient data are, sadly, a fairly common occurrence. […]
DevSecOps Implementation: Patch Management
Patch management has been a thorn in IT’s side for decades. While it is undeniably necessary for security and stability purposes, the staggering array of patches that are available make managing them effectively nearly a full-time job – or a job better left to users. Few IT professionals want to be the “patch person,” and […]
ZeroNorth Adds Analytics App to Advance DevSecOps
ZeroNorth today added an Advanced AppSec Risk Analytics module to its platform for orchestrating DevSecOps processes. John Worrall, ZeroNorth CEO, said the analytics tool pulls vulnerability data generated by a variety of security tools to provide both DevOps and cybersecurity professionals with a single source of truth for assessing security within an application environment. The […]
Rewind Acquires BackHub to Protect GitHub Repositories
Rewind, a provider of a software-as-a-service (SaaS) platform for backing up cloud services, today announced it has acquired BackHub to gain control of a platform for backing up GitHub repositories. Based in Germany, BackHub adds a data protection platform to a Rewind portfolio that includes offerings for backing up everything from QuickBooks to Shopify. Fresh […]
Survey Shows DevSecOps Progress in Larger Organizations
A survey of 250 U.S. and UK large enterprises with more $1 billion in revenue conducted by Security Compass, a provider of a platform for automating security tasks as application are developed, finds three-quarters (75%) have implemented DevSecOps processes on current application development projects. Rohit Sethi, CEO, Security Compass, said the State of DevSecOps Report […]
BluBracket Community Edition of Secrets Discovery Tool now Available
BluBracket today announced general availability of a community edition of a tool that employs machine learning algorithms to discover passwords, tokens and other security vulnerabilities in code. Prakash Linga, BluBracket’s CEO, said application secrets stored in code enable cybercriminals to compromise applications in ways that can impact an entire software supply chain. The community edition […]
CNCF Graduates Open Policy Agent Project to Manage Compliance as Code
The Cloud Native Computing Foundation (CNCF) announced this week that the Open Policy Agent (OPA) project, which many IT teams are employing to manage compliance as code, has officially graduated. Torin Sandall, co-founder of the OPA project and vice president of open source at Styra, whose compliance management platform is based on OPA, said formal […]
AppDynamics Partners With Cisco to Secure Application Runtimes
AppDynamics today announced its agent software, which it provides as part of its observability platform, now has the ability to enforce application security policies. Developed in collaboration with the security business unit of parent company Cisco, the Cisco Secure Application offering, available from AppDynamics, can detect attacks, identify deviations in application behavior and block attacks […]
OpenAPI Specification: Perception vs. Reality
The OpenAPI Specification (OAS) (formerly known as the Swagger specification) provides a way to describe and document REST APIs and their components. It includes details on endpoints, their operations, parameters needed for the operations, expected responses for every operation, authentication methods and even annotations. OAS is an easy format to learn and read, and can […]
Tidelift Secures Open Source Software Supply Chains
Tidelift today announced the general availability of a platform dubbed Tidelift catalogs, through which enterprise IT organizations can more effectively manage their open source supply chains. Donald Fischer, Tidelift’s CEO, says the Tidelift catalogs platform enables IT teams to curate, track and manage open source components that have been vetted and adhere to compliance requirements […]
DevSecOps Implementation: EDR/XDR
We mentioned host intrusion detection and network intrusion detection in an earlier blog, and mentioned firewalls a couple of times in passing. Let’s delve a bit into the history to understand how these tools’ functionality has evolved over time. On the host side, we had virus detection, in one form or another, from early in […]
A Pragmatic Approach to DevSecOps
In response to market and competitive forces, many companies are using DevSecOps to develop higher quality and more secure software. Whether that software is their own product or is a component of their product, quality – and especially security – have become required rather than optional. To accommodate the security requirements, some companies have adopted […]
Approaching Security as a Fundamental Element of Software Development
How we really integrate security into the SDLC? What are some of the best practices around secure software? In this episode of TechStrong TV, Jill Britton, director of compliance, and Stuart Foster, product manager at Perforce, joined us to discuss how to improve application security by making security a fundamental component of the software creation […]
DevSecOps Implementation: Intrusion Detection
Originally, this series was just going to be four articles on the DevSec side of DevSecOps. There are many reasons for this, but primarily because that side is cleaner. The other reason is that these topics are beyond the work we were doing at Accelerated Strategies Group. But we’ve had a number of requests to […]
BYOPC Solves Endpoint Provisioning Challenges
For many cloud-first companies, workstation imaging isn’t “a thing.” The notion that an IT organization might need several days – or even weeks – to onboard a new employee by provisioning an imaged laptop with correct security policies and only approved applications on it is absurd. The constraints of operating in an admin-centric model for […]
A Security Vulnerability Management Guide
Living in a container-native world is not easy. Containers have a reputation for being a point of entry for security vulnerabilities for many organizations. In 2015, according to a research paper, over 40% of Docker images distributed through Docker Hub had high-risk vulnerabilities; at that time there were more than 95,000 container images hosted on […]
Managing Data Risk in 2021
You can’t protect your data if you don’t know where it is stored. The first thing to consider when creating a risk-based approach to data protection is the ability to identify and prioritize data, and control who has access to it. But, how do we do this? How do we prioritize data? In this TechStrong […]
Set DevOps Free With Modern Application Security
Development teams increasingly use technologies like cloud computing and microservices, in conjunction with DevOps principles, to innovate faster and remain competitive. But such progress comes at a cost. The fast pace of DevOps has left security teams scrambling to keep pace and install appropriate security guardrails. Traditional security practices used to occur in the final […]
How Managed Detection and Response (MDR) Solutions Benefit DevOps
Managed Detection and Response (MDR), a relative newcomer in the cybersecurity realm, is starting to have a noticeable impact on enterprises seeking to better secure their operations. Research giant Gartner notes that, “By 2025, 50% of organizations will be using MDR services for threat monitoring, detection and response functions that offer threat containment capabilities.” Despite […]
Windows Sandbox and Hypervisor-Based Isolation
Completely securing the endpoint is hard. Securing it without sacrificing user productivity is even harder. Think of a modern laptop running a Windows 10 OS, for example. The OS consists of millions of potentially vulnerable lines of code. It has many legacy components written with old security standards in mind. The kernel is probably executing […]
7 Trends Influencing DevOps and DevSecOps Adoption
Enterprise technology adoption trends can be broadly categorized under three pillars: infrastructure, architecture and technology. Let’s explore what these trends are and how they influence DevOps and DevSecOps adoption in tech corporations worldwide. Trends in Architecture In computing, architecture is the collection of protocols encompassing the utility, structure and execution of software applications. Architecture defines […]
Orchestration Emerges as Crucial DevSecOps Enabler in 2021
As DevSecOps best practices continue to evolve and mature in 2021, security orchestration is emerging as a cornerstone of a solid defense-in-depth approach to application security. DevSecOps assumes organizations will shift responsibility for application security further left toward developers. If this assumption is correct, then developers clearly need access to a range of code analysis […]
The Best IAM Practices for DevOps
Through identity and access management (IAM), it is possible to assign policies that determine whether a user and the role can access particular services or not. An IAM system is also supposed to maintain the principle of least privilege (POLP), which grants the roles and users the permission to access certain resources. As a business […]