Snyk Report Finds Decline in Open Source Vulnerabilities
Snyk, a provider of tools for discovering and remediating vulnerabilities in open source code, today published a report that finds the number of new vulnerabilities discovered in open source software packages has declined 20% on a year-over-year basis. However, the bulk of the vulnerabilities being discovered are considered to be high severity, the report finds. […]
SaltStack Looks to Automate DevSecOps Processes
SaltStack announced today it has integrated its automation framework with a variety of third-party security platforms to further the adoption of best DevSecOps processes. Mehul Revankar, director of product management for SaltStack, said version 6.3 of SaltStack Enterprise provides integration with offerings from Splunk, Tenable, Qualys, Rapid7 and Kenna Security. Data generated from vulnerability scans […]
The Secret to Winning at DevOps: Are You Up for the Challenge?
The main idea behind DevOps is to enable companies to keep up with the increased software velocity and advancements in agile culture for a smoother end-to-end software delivery cycle. The main goal of DevOps is to accomplish integration and automation, which is why implementing this philosophy can be challenging. Not only do you need to […]
CNCF Elevates SPIFFE Spec to Secure App Services
The Technical Oversight Committee (TOC) of the Cloud Native Computing Foundation (CNCF) announced that the open source Secure Production Identity Framework For Everyone (SPIFFE) specification and the SPIFFE Runtime Environment (SPIRE) have become incubation-level hosted projects. Andrew Harding, SPIRE maintainer and a principal software engineer at Hewlett Packard Enterprise (HPE), said the elevation of a […]
Why DevOps and Federal Agencies Need Each Other
In times of crisis, the U.S. government needs to bring in tech tools fast to help solve the problem. First, now is a vulnerable time and weaknesses are exposed in telework infrastructure as the government rapidly shifted to remote work. Cyberattacks are up as adversaries try to exploit the weaknesses. Second, federal agencies are also […]
COVID-19, the New Normal and the Indisputable Importance of Mobile App Security
As the United States emerges from COVID-19 lockdown, it’s not back to business as usual. COVID-19 remains a very serious risk, and until a vaccine or treatment arrives, we will all need to remain vigilant. Further, it’s also certain that the new normal post-COVID-19 world represents a fundamental transformation in how businesses operate, with mobile […]
GitLab Adds Fuzz Testing to DevSecOps Toolbox
GitLab today announced it has acquired Peach Tech, a provider of protocol fuzz testing and dynamic application security testing (DAST) API testing tools, and Fuzzit, a continuous fuzz testing tool, as part of its efforts to advance the adoption of best DevSecOps practices. David DeSanto, director of product for GitLab Secure & Defend, said the […]
3 DevOps Security Best Practices Your Organization Can’t Afford To Ignore
CI/CD pipelines are at the core of daily operations for many businesses today. These processes, when set up correctly, help to keep the delivery process consistent by automating many manual tasks and providing visibility into how the software is being worked on. DevOps is also the place in your technology stack where your infrastructure has […]
DevSecOps vs. Agile Development: Putting Security at the Heart of Program Development
Despite most developers and managers being well aware of the concept of DevSecOps, it is still often confused with a number of related processes and concepts. This is particularly true for the Department of Defense (DoD) contractors because they have long been encouraged to use a related process known as agile development. Since agile development […]
How DevOps Powered by AI and Machine Learning Is Delivering Business Transformation
The use of artificial intelligence (AI) and machine learning (ML) is fundamentally changing the way we think about DevOps. Most notably, it is delivering a new form of DevOps that recognizes the need to have systems that are intelligent by design and underpinned by comprehensive security (DevSecOps). For many, this will be the crucial next […]
Who’s Responsible for Security? Apparently, It Depends
More than 10 years after organizations began implementing DevOps, responsibility for security still resembles the proverbial chicken and egg dilemma. GitLab’s 2020 Global DevSecOps Survey asked developers, security team members, operations pros and testers about sole responsibility for security in their organizations. About 28% of developers, 33% of security teams, 21% of ops pros and 23% […]
GitLab Releases Massive Update to CI/CD Platform
GitLab has updated its continuous integration/continuous delivery (CI/CD) platform with a raft of capabilities spanning everything from value stream management to cybersecurity. In addition, GitLab announced it is making generally available Gitaly Clusters, which enable DevOps teams to create a warm replica of a Git repository. Brendan O’Leary, senior developer evangelist at GitLab, said with […]
The Best Approach to Help Developers Build Security into the Pipeline
Speed and agility are at the core of digital transformation and DevOps culture, and have quickly become a business imperative for organizations that want to remain competitive. Speed cannot come at the sacrifice of security, though. The pace of software development requires that security be baked into the code from the start rather than tacked […]
5 Ways to Detect Application Security Vulnerabilities Sooner to Reduce Costs and Risk
Security testing has always been an important step in the application development process. Yet, traditional measures often occur too late in the process to effectively find and fix vulnerabilities before causing costly production delays, or worse, putting organizations at risk for potential security breaches. To minimize security-related costs and risks, testing needs to occur sooner […]
Cloud-Native Security and Performance: Two Sides of the Same Coin
You’re running Kubernetes in a production environment, and you need to apply a patch — perhaps to a commercial application, an open source component or even a container image. How long should it take to implement that patch in production? Thirty days? One day? One hour? Remember, cloud-native environments are supposed to respond to change […]
How to Secure the Intangible — Cloud Native Security in the New Age
People don’t want to buy a quarter-inch drill. They want a quarter-inch hole. Companies aren’t interested in managing IT; they’re more interested in results. They want to deliver software quickly and focus on their core product or service. This is where the concept of cloud native computing comes in—and why securing it has become critical. […]
No Excuses: Lock Down RDP
We’ve been at the “everyone working remote” thing for months now, and still there are horror stories of people being attacked via Remote Desktop Protocol (RDP). Early on, it was understandable if not acceptable—but we’re not early on any more. During the rush of doing whatever it took to help people work from home, exposed […]
The Secure Software Development Life Cycle: Syncing Development and Security
Over the last five to 10 years, the nature of software development has shifted dramatically. Whereas large software releases occurred every six to 18 months in the past, current release schedules have become much more frequent. The waterfall model of software development has morphed into what we now know as the DevOps model. As a […]
VMware Carbon Black Developer Day 2020: Bringing DevSecOps to the Fore
Developer Day is a VMware Carbon Black’s virtual event that connects intermediate to advanced security developers with Carbon Black experts to learn advanced API and integration techniques. The event takes place Tuesday, May 12, starting at 11 a.m. EST. Developer Day, which occurs the day before VMware Carbon Black’s Connect 2020 virtual conference, focuses on […]
Survey Surfaces Root Causes of DevSecOps Tension
Results of a survey published by SaltStack, a provider of IT automation tools, suggests tensions between cybersecurity and IT professionals on the one side and DevOps teams on the other are running high. According to the survey of 130 cybersecurity and IT leaders, 70% of respondents said their organization is sacrificing data security for faster […]
Sacrificing Security for Speed: 5 Mistakes Businesses Make in Application Development
Earlier this year, the Democratic party in Iowa announced its plans to use a smartphone app to calculate and transmit their caucus results. Using technology to improve the speed of governance, one would think, “What could possibly go wrong? A lot, apparently. The app’s failure on results day was attributed to reporting and coding issues. […]
WordPress Hacks: Best Ways to Protect WordPress from Hacking
When it comes to website security, even an iota of prevention is really worth a large pool of measures to restore a website from its affected state. WordPress websites are most vulnerable to security attacks from sophisticated hackers as well as the bots that are capable of exploiting security vulnerabilities. These security vulnerabilities range from […]
Your Applications Are the Weakest Security Link
Amazon, Microsoft and Google have much bigger security budgets than you do. They have hundreds of people all over the world ensuring that their infrastructure is secure. Their teams are constantly reviewing their code, looking for flaws, vulnerabilities and potential exploits. They monitor hacking forums and run attractive bug-bounty programs in order to remain proactive. […]