Security Compass Unveils DevSecOps Platform
Security Compass today launched a DevSecOps platform that guides developers toward building secure applications faster using a set of security analysis tools and processes embedded within it. Company CEO Rohit Sethi said SD Elements is the first instance of what the company is positioning as a balanced development automation (BDA) platform. By defining a set […]
Critical Controls for DevOps: Best Practices for Continuous Security
In relentless pursuit of automation and velocity, DevOps teams can reduce the software development cycle and ensure that their products are responsive to client feedback. However, this quest for perfection may compromise security, leaving room for vulnerabilities or misconfigurations that can create huge problems later on. Ensuring security integration throughout the life cycle while retaining […]
Report: As WFH Took Hold, Few Adjusted Their Security Posture
In March of this year, how employees worked (if they were fortunate enough to be able to continue to work), changed dramatically following state-led shelter-in-place orders. At first, it was hoped the shift would be a matter of weeks. But as the pandemic continued and weeks stretched to months—and now with more organizations extending their […]
GitLab Presses Case for DevSecOps Collaboration
GitLab today at its GitLab Commit Virtual event pledged to make securing its open source continuous integration/continuous delivery (CI/CD) platform a more collaborative effort. Cindy Blake, senior security evangelist for GitLab, said the company is committed to sharing a road map developed in collaboration with DevOps teams that lets organizations see what cybersecurity issues will […]
TechStrong TV: How strongDM Helps mParticle in Secure Remote Access
In this interview for TechStrong TV, I am joined by strongDM CEO Elizabeth Zalman and mParticle CISO Dave Anderson. Dave shares with us how mParticle uses strongDM proxy services to rapidly enable the expanding mParticle team to access infrastructure, assets and applications necessary for mParticle to fulfill its mission to its customers. With the rapid […]
DevOps and Compliance: A Recipe for Success
In today’s world, DevOps and compliance teams need to work together, not separately Imagine this: You organized a dinner party weeks ago, promptly forgot about it and just realized tonight’s the night! You have two hours to whip up a gourmet meal for 10 friends. Instead of panicking, you get smart and enlist your kids […]
7 Things to Make DevSecOps a Reality
While talking about DevSecOps has become a hot trend, it is clear that many organizations claiming to follow such methodologies are actually mired in traditional waterfall development. Let’s figure out if you’re really ready to implement DevSecOps. In a world that relies heavily on distributed computing and third-party services, security is paramount for those who […]
DevSecOps and Passwords: Lessening the Burden
The point of DevOps is to make IT more responsive (and hopefully more stable, but we have evidence that is not always the case). The point of DevSecOps (so far) is to make security more responsive and to build security right into the stack. These are both worthy goals. As we all have pointed out […]
Accurics Adds Compliance Control Support to Code Analyzer
Accurics, at the online KubeCon + CloudNativeCon 2020 conference today, launched an update to its open source Terrascan static code analyzer that adds support for Open Policy Agent (OPA) engine to make it easier for developers to create custom compliance policies in addition to leveraging more than 500 out-of-the-box policies based on the CIS Benchmark. […]
Why Service Meshes Are Security Tools
Are service meshes overhyped, or do they solve a real puzzle for enterprise IT systems? Service meshes are a relatively new technology, and many people have found it challenging to fit them into predefined tooling categories. That’s because service meshes have a wide variety of functionality, from load balancing to securing traffic. But service meshes […]
Functional Safety in Embedded Design Starts with Code Development
With embedded software likely to become more complex, now is the time to start thinking about functional safety As the world has become increasingly more dependent on embedded systems in functional safety markets—such as rail, automotive, aerospace and medical—ensuring the safety of the software in those systems has become even more imperative. That assurance must […]
DevOps and Security in a Cloud-Native World
DevOps teams have naturally embraced microservices and modern application delivery workflows. But, they may get pushback from risk-averse leadership or feel slowed by security teams who struggle to keep pace. Development teams that play a greater role in guiding their organization’s cloud transformations will ultimately come out ahead. These are some of the takeaways from […]
Survey: Organizations Knowingly Deploy Vulnerabilities
A survey published today by Synopsys, a provider of electronic design automation (EDA) and application security tools, finds nearly half (48%) of respondents admit they consciously push code with known vulnerabilities into production because of time constraints. Based on a survey of 378 cybersecurity professionals conducted by Enterprise Strategy Group (ESG) on behalf of Synopsys, […]
Automation: The Human-Free Zone Approach to Software
Humans hate repetitive manual tasks. We suck at them—we make mistakes, lose concentration, get bored. Throughout history, humans have instinctually developed automation to keep us away from the hazard-prone, tedious work of these tasks. In software, we use configuration management, deployment tools and lean/agile processes born out of factories and the automation principles established there […]
MuseDev Offers DevOps-Optimized Security Code Analyzer
MuseDev today announced it has made available on GitHub under an early access program a code analysis tool dubbed Muse that is designed to surface cybersecurity issues as pull requests are made from the repository. Company CEO Stephen Magill said rather than waiting to discover cybersecurity issues after an application is deployed, Muse makes it […]
Okta Offers PASETO as Alternative to JSON Tokens
Okta today launched an open source library for using Platform-Agnostic Security Tokens (PASETO) as an alternative to JSON Web Tokens (JWT) to authenticate end users. Randall Degges, head of evangelism for Okta, said PASETO is quickly emerging as an easier, more secure implementation of the JWT specification. PASETO is a draft specification created by Scott […]
Snyk Tool Prioritizes Open Source Vulnerabilities
Snyk today announced it has enhanced the ability of its namesake vulnerability scanning tool by adding the ability to identify which open source vulnerabilities should be fixed first using a scoring tool that leverages data science and machine learning algorithms to analyze code. In addition, DevOps teams can now take advantage of automated pull requests […]
Balancing UX and Privacy With IoT
As more IoT devices track data to improve customer UX, privacy concerns are becoming more prevalent. How can developers strike a balance? The internet of things, or IoT, is a system that has changed the way we perceive technology. While it has made the usage of technology easier than ever, it does come with its […]
How to Make DevSecOps a Reality
DevSecOps is an increasingly popular term; however, security vulnerabilities in software continue to proliferate. 2019 saw a surge in web application breaches shining a spotlight on the fact that DevSecOps remains elusive. The latest data from the Verizon Data Breach Investigations Report (DBIR) identified that web application vulnerabilities had doubled in the last year alone. […]
RunSafe Allies With JFrog to Secure Applications
RunSafe Security, a provider of Alkemist tools that prevent memory exploits, has partnered with JFrog to create a plug-in for the Artifactory repository manager platform. Alkemist employs a combination of runtime application self-protection (RASP) and moving target defense (MTD) methods to neutralize memory corruption exploits such involving, for example, a memory overflow. Based on a […]
Traceable Secures Apps Using Distributed Tracing
Traceable this week announced it is making available under an early access program a namesake platform that combines distributed tracing and machine learning algorithms to better secure applications. Fresh of raising $20 million in funding, Traceable CEO Jyoti Bansal said the goal is to leverage distributed traces generated via open source Hypertrace agent software to […]
How to Source Vulnerability Data for True DevSecOps
Open source comes with code vulnerabilities that must be considered in the DevOps process The war between open source and “only proprietary code” is long over. Open source won the day by convincing the opposition of the benefits of joining the open source community. “Vulnerabilities in the Core,” a report published by the Linux Foundation […]
How IaC Bridges the Divide Between DevOps, Security
IaC provides a connection between security and DevOps teams in a subtle, non-intrusive manner Companies often choose DevOps as means to provide value and responsiveness through rapid, high-quality service delivery. Instead of traditional siloed development and operations teams, DevOps embraces multidisciplinary teams that share efficient practices and tools. Essential DevOps practices include agile planning, continuous […]