Shifting Left and Static Code Analysis with Perforce
Perforce Product Manager Stuart Foster, and Evangelist Steve Howard, join Mitch Ashley to discuss the importance of creating security software from the beginning of the development process. We discuss shift left, SAST, source code scanning and other pursuits towards this goal. The video is immediately below, followed by the transcript of the conversation. Enjoy! Transcript […]
XDR: The DevOps Transformation of Security Infrastructure
eXtended detection and response (XDR) is a security technology that unites multiple security systems into one. Organizations are transitioning from traditional systems such as endpoint detection and response (EDR) and security and information event management (SIEM) to XDR, in a move that is analogous to the transition from agile to DevOps work processes. XDR can […]
Speed and Security: How to Find a Balance in Development
Time management can help developers realize the necessary combination of security and speed in application development As software continues to create competitive advantages and market differentiation for organizations focused on successful digital transformation, developers will continue to be measured by how fast they can develop and release code. Business leaders encourage DevOps teams to push […]
Data Security in the Cloud with Imperva
Database security startup jSonar, founded by Ron Bennatan, was recently acquired by Imperva, a leading cybersecurity company focused on data and application protection. In this episode of TechStrong TV, Ron Bennatan, general manager of data security at Imperva, joins us to discuss the plethora of data security challenges across cloud environments. They also talk about […]
Dynatrace Adds Security Module to Observability Platform
Dynatrace announced today it is adding a module to provide continuous runtime application self-protection (RASP) capabilities to its observability platform. The Dynatrace Application Security Module leverages existing Dynatrace tracing and artificial intelligence (AI) technologies to detect threats in real-time and then apply appropriate policies to automatically secure applications. Andreas Lehofer, chief product officer for Dynatrace, […]
Integrating Security in the Development Process With DevSecOps
Occasionally, it’s worthwhile to reflect on how we develop and deliver software during times of rapid change and significant disruption. In those moments of reflection, we learn from the exciting trends and changes that are taking place. Recently I had the opportunity to commiserate with two technical thought leaders at Perforce: Stuart Foster, product manager, […]
How to Foster Collaboration Between DevOps and Security
DevOps is on the rise. Back in 2018, MarketsandMarkets wrote that it expected the DevOps market to grow to $10.31 billion by 2023. That’s up from $2.90 billion in 2017, with a compound annual growth rate (CAGR) at 24.7% projected for the forecast period. Demand for DevOps solutions and services in response to the need […]
Why Secrets Management is Critical to DevOps Pipeline Security
While valuable, secrets management also can be difficult for DevOps teams to employ. Here’s what you need to know Business is all about speed. Companies want to innovate and deliver functionality faster to remain competitive. This explains the increasing popularity of DevOps as a go-to model for rapid application delivery. A recent Gartner report indicated […]
DevSecOps Implementation: Dynamic Scans
This is the third installment in this series on DevSecOps. Read the first installment, on static analysis, here and the second installment, on source composition analysis, here. One weakness of static analysis is its failure to account for environment and use. Running static analysis on a code base as the only check before production deployment […]
Securely Streamline Code Signing for DevOps and DevSecOps
Introducing code-signing provides security within the application, but teams should take care to understand and implement the process effectively Digital certificate management, with hundreds or thousands of certificates required to support IT infrastructure, can easily lead to degradation of application integrity and unnecessary risk to the business. The cumbersome nature of siloed teams manually managing […]
KubeCon Coverage: Incentivizing the DevSecOps Culture
Just as DevOps set to de-silo development and operations teams, the DevSecOps movement is bringing security to the same table. A shift-left security mindset is permeating much discussion of late. Cyberattacks are on the rise in the era of COVID-19 and cybersecurity has become paramount to arm business-critical applications. Furthermore, new regulations have emerged to […]
build.security Leverages OPA to Shift App Authorization Left
build.security today announced it has raised $6 million to launch a platform that promises to make it simpler for developers to centralize the management of authorization controls across multiple applications. The goal is to enable DevOps teams to shift control over application authorization further left to advance adoption of best DevSecOps practices using a platform […]
strongDM Extends Access Management as Code Efforts
strongDM today announced it has added an application programming interface (API) and software development kits for Go, Java, Python, Ruby and other programming languages for involving the single sign-on (SSO) capabilities of its infrastructure access management platform, in addition to adding support for command-line interfaces (CLIs) exposed by cloud service providers. At the same time, […]
DevSecOps Implementation: Source Composition Analysis
This is the second installment in this series on DevSecOps. Read the first installment, on Static Analysis, here. One of the better additions to security in recent years is source composition analysis (SCA). The purpose of SCA is to sit in the gap between static analysis and dynamic analysis to help you find issues introduced […]
Two-Part Training Required for Developers to Slay the Security Beast
Developers’ defensive qualities are only as good as the training they receive The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt. The volume of code being produced is too […]
Survey Sees Long DevSecOps Ahead
A survey of 250 developers working at leading technology companies paints a bleak picture of the current state of application security with 85% admitting applications on average have 10 or more vulnerabilities, with nearly half saying they have on average more than 20 per application. Conducted by Contrast Security, a provider of an observability platform […]
Survey Finds Security Champions Fostering DevSecOps
A survey of 99 application development and IT security professionals suggests organizations that appoint a security champion within their application development teams are making more progress toward implementing best DevSecOps practices. According to the survey conducted by ZeroNorth, a provider of an application security automation and orchestration platform, 84% of respondents said they believe the […]
OpenSSF Makes Free Security Training Available
The Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, is providing free security training for developers building and employing open source software starting later this week as part of an overall effort to advance best DevSecOps practices. Linux Foundation CTO Chris Aniszczyk said the Secure Software Development Fundamentals professional certificate program along […]
How to Secure Fintech Applications and Protect Customer Data
All industries are feeling the pain of preventing rising risks to their applications, private information and customers’ data, and it is not surprising that this is especially true in the financial services sector. In fact, fintech companies on average spent more than $18 million in 2019 battling cybercrime, while other markets’ companies spend an average […]
How Service Mesh Enables a Zero-Trust Network
How can we achieve high-grade security within a microservices ecosystem? Service mesh may be the answer Enterprise applications often assign an identity to humans to determine security clearances. Using standards such as OpenID Connect and SAML, we can delegate authorization scopes across a suite of applications to determine precisely what a user is permitted to […]
DevOps’ Role in Fixing Software Vulnerabilities
From the beginning, application development has required that software developers deal with bugs, vulnerabilities and other issues. But problems encountered under the DevOps model tend to be more manageable since the updates and fixes required are usually smaller. The reason for this is that the process of maintaining and improving DevOps-related software never stops. In […]
GrammaTech Discovers Vulnerabilities in Third-Party Code
GrammaTech today launched a CodeSentry software composition analysis (SCA) for binaries that inventories third-party code used in custom applications and identifies known vulnerabilities. Vince Arneja, chief product officer for GrammaTech, said the bulk of custom applications today are made up of binaries based on components developed by a third-party that comes in the form of […]
How to Successfully Integrate Security and DevOps
As digitalization transforms industries and business models, organizations increasingly are adopting modern software engineering practices such as DevOps and agile to become competitive in the modern marketplace. DevOps enables organizations to release new products and features faster, but this pace and frequency of application releases can conflict with established practices of handling security and compliance. […]