Using PAM to Support the ‘Sec’ in DevSecOps
Despite its reputation as slow and complex, PAM can be included in the DevOps pipeline effectively The introduction of DevOps practices has led to a revolution in software development. However, as companies adopt these new technologies, tools and methodologies, incorporating privileged access management (PAM) becomes increasingly complex. Nonetheless, corporate policies, industry standards and government regulations […]
Snyk Brings AI to DevSecOps
Snyk today at its SnykCon 2020 conference announced a static application security testing (SAST) dubbed Snyk Code that incorporates an interpretable machine learning semantic code analysis engine the company gained through its acquisition of DeepCode earlier this year. The company also announced it has extended its alliance with Docker Inc. to become the exclusive provider […]
Code Security: SAST, Shift-Left, DevSecOps and Beyond
Automation is the key to pushing code security beyond DevSecOps In virtually every industry, developers are dealing with ensuring the safety of their code. Regardless of whether it’s enterprise or applications for automotive, aviation or industrial controls, small systems or large systems, every organization struggles with security. In response, the industry continues to evolve to […]
Runtime Security and Incident Response with Loris Degioanni
By adopting DevOps, Kubernetes and containers you can accelerate innovation and deliver a better experience for customers and employees. While Kubernetes adoption simplifies application deployment, security needs to adapt and be cloud-first, open and frictionless as a new set of complexities may surface. Check out this interview with Sysdig Founder and CTO Loris Degioanni to […]
ZeroNorth Extends DevSecOps Orchestration Reach
ZeroNorth has extended its namesake software-as-a-service (SaaS) platform for orchestrating DevSecOps toolchains to include integrations with Scout Suite, Aqua Trivy, Gitlab and BitBucket Server and the configuration management database (CMDB) from ServiceNow. The company is also adding application portfolio reports to surface the security policies applied to each application, scan results and progress of remediation […]
Sonatype Advances Open Source Code Quality, Security
Sonatype today launched an Advanced Development Pack service that surfaces dependencies between open source components in a way that makes it easier for developers to know which ones to employ to build the most secure application possible and what components offer the simplest upgrade path. Company CTO Brian Fox said the Advanced Development Pack service […]
Strengthen API Security With These Tips and Patterns
If you haven’t noticed, digital organizations are building more and more APIs. ProgrammableWeb tracks more than 23,000 public web APIs at the time of writing, and the API market is estimated to be worth $5.1 billion by 2023. Building with APIs increases internal interoperability, reduces development time and can extend product functionality tremendously. In short, […]
Survey Surfaces Lots of DevSecOps Friction
A survey of 560 application security professionals and software developers in North America and Western Europe conducted by WhiteSource, a provider of tools for securing open source software, finds there’s a long way to go before most organizations can claim to have fully implemented best DevSecOps practices. Only 20% of respondents said their organization had […]
Low-Code, High Risk? Closing the Security Gap of Exposed Source Code
There’s no denying that low-code is a rising trend in application development that’s likely to stay for the long run. Its impressive benefits in terms of agility and development time are convincing the enterprise, so it’s no wonder that the industry is on its course to achieve fivefold growth between 2017 and 2022. In low-code […]
VMware Looks to Meld IT and Security Operations
VMware has acquired SaltStack as part of an effort to unify IT and security operations management. The announcement was made during the online VMworld 2020 conference this week. SaltStack has developed an open source IT automation platform to automate IT operations. In recent months it has been extended to also address security and compliance management. […]
GitHub Delivers on Code Scanning Promise
GitHub today announced it is now making available at no cost the open source CodeQL code scanning tool it gained by acquiring Semmle. Justin Hutchings, a product manager at GitHub, said the goal is to further adoption of best DevSecOps practices by making it easy for developers to scan for vulnerabilities as they check code […]
TechStrong TV: strongDM With Betterment
Betterment is a goal-based financial advisory company that provides robo-advising services to help customers make the most of their money, taking away all the complexities of investing and saving. In this interview for TechStrong TV, strongDM co-founder and CEO Elizabeth Zalman and Chris Becker, SRE manager at Betterment, joined us to discuss how strongDM helps […]
The Importance of Digital Certificates to DevOps Teams
Certificate management is an important element of ensuring DevOps processes run smoothly Organizations are increasingly integrating DevOps into their app development processes. According to Amazon Web Services (AWS), DevOps holds so much promise with organizations because it has the potential to increase the speed and ability to deploy new apps and services. Together, development and […]
Should Conway’s Law Be Applied to DevSecOps?
Strictly adhering to Conway’s Law could lead to less innovation and the inability to keep up in a fast-changing market When it comes to determining how an organization should be structured, the 1967 Conway’s Law provides a plausible direction that many software companies could follow. However, in today’s ever-changing cloud environment, it is arguable whether […]
The Role of DevSecOps in Finance App Dev
DevSecOps is critical in developing apps successfully in the rapidly changing and highly regulated finance environment One of the most important shifts of the past few years in finance and banking was the movement from primarily branch-based banks to mobile-first banks. While these innovative products simplify the end user experience, they also bring up more […]
Snyk Acquires DeepCode to Apply AI to DevSecOps
Snyk today announced it has agreed to acquire DeepCode as part of an effort to apply artificial intelligence (AI) to DevSecOps. DeepCode has developed an interpretable machine learning semantic code analysis tool that scans code anywhere from 10 to 50 times faster than existing approaches. DeepCode currently supports Java, JavaScript, Python, TypeScript and C/C++ programming […]
Synopsys Report Shows DevSecOps Progress
A report based on analysis of the software security initiatives of 130 organizations conducted by Synopsys, a provider of static application security testing (SAST) and software composition analysis tools, suggests progress in terms of DevSecOps adoption is being made but there is still a long journey ahead. According to the survey results, 121 organizations now […]
TechStrong TV: Credentials Management, with strongDM and Software.com
Now more than ever, businesses around the world should pay close attention to how they manage their credentials and control access to their sensitive data, in order to protect it from being hacked or compromised in any way. During this interview for TechStrong TV, Mason McLead of Software.com and Elizabeth Zalman of strongDM, discuss the […]
Safeguarding Secrets Within the Pipeline
How can an organization write source code to use secrets without directly referencing them and risking them being leaked to the public? 2020 closes out a decade full of countless code leaks, a topic we talk about quite often. In fact, just recently, Intel became the latest victim after 20GB worth of internal documents were […]
TechStrong TV: strongDM Helps Kustomer Go Remote
For a procurement process to be effective, the relationship between the customer and the product team is almost as important as the functionality and features of the product itself. During this interview for TechStrong TV, strongDM CEO Elizabeth Zalman and Steve Flinchbaugh, senior SRE at Kustomer (a customer support CRM platform for managing high support […]
Shifting Left With DevSecOps: ESG Report Exposes Difficulties
A recent report asks the tough questions about DevSecOps adoption, and the results are surprising In a world of increasing development velocity, companies are placing more responsibility on developers to enact quick deployments. Naturally, security is “shifting left” as well. Theoretically, DevSecOps sounds great, but it opens up many questions. Who exactly is responsible for […]
Progress Acquires Chef to Expand DevOps Portfolio
Progress today announced it has acquired Chef for $220 million in cash as part of an effort to advance adoption of best DevOps and DevSecOps practices in the midmarket. Once the deal is completed next month, Chef will operate as an independent business unit led by Sundar Subramanian, who currently is a senior vice president […]
Fastly Sets DevSecOps Strategy After Signal Sciences Buy
In the wake of acquiring Signal Sciences for $770 million, Fastly is gearing up to expand the range of security services it offers as part of an effort to advance adoption of best DevSecOps practices. Artur Bergman, chief architect for Fastly, said a forthcoming wave of edge computing applications will require web applications firewalls (WAF) […]