What Is DevSecOps and How to Enable It on Your SDLC?
For the past three to four years, all the companies around the IT world have adopted agile and different application development methodologies that leverage the work for different departments or areas and helps them to develop new products and release new features to improve their processes and infrastructure. In this new Agile and DevOps world […]
DevSecOps: A Renewed Commitment to Secure Delivery, Part 1
Security has never been as high a priority than it is today, as companies fear they’ll be the next headline, the next victim of a data breach. Executives also worry about applications meeting the high standards of compliance–either with global regulations such as GDPR, state-oriented privacy laws or the many specific ones covering finance, health […]
The Risks and Potential Impacts Associated with Open Source
Open source software (OSS) is built by communities of developers who contribute their knowledge and time to OSS projects they find appealing. That code can then be used by individuals, communities and organizations in their software products—the only obligation they have is to play under the rules of the license with which the OSS project […]
Software Supply Chain Attacks: How to Disrupt Attackers
Supply chain attacks—compromising an organization via insecure components in its software supply chain—are a growing concern for organizations. Throughout the past three years, an increasing number of open source software package repositories have been found to contain malware, making it clear that all installation and update pathways for software and library code must have security […]
DevSecOps: 10 Best Practices to Embed Security into DevOps
For companies that employ the agile approach, DevOps seems like a natural extension. Traditionally, enterprises started with integration, development and test automation early in the product lifecycle. Gradually, the agile delivery team took care of iterative development and monitoring practices that increase code quality. Today, organizations work in unison to bridge the gap between development […]
API Security in DevOps: Are We Too Comfortable?
Postman performed its annual survey of developers, and as this survey and many other surveys have shown, developers are generally comfortable with the level of API security that their organization has implemented. This has been a consistent trend, with most developers being comfortable that they are protected. The problem is most organizations also put API […]
Service Meshes: Improving Security, Delivery and Availability
Containerized microservices are taking over the software world. These services provide developers a way to quickly create and deploy cloud-native applications. However, containers aren’t perfect. Orchestrating and managing container deployments can be a serious challenge. To help ease this challenge, service meshes were developed. In this article, you’ll learn about service meshes components and architecture […]
Certificates a Fly in the DevOps Ointment
The way cybersecurity teams have managed certificates is turning out to be a major impedance that could best be addressed by more organizations adopting best DevSecOps practices in 2020. A survey of 108 attendees at the recent DevOps Enterprise Summit 2019 conference conducted by Venafi, a provider of tools for assigning identities to machines, finds […]
Breaking Down the OWASP API Security Top 10, Part 2
Due to the widespread usage of APIs, and the fact that attackers realize APIs are a new attack frontier, the OWASP API Security Top 10 Project was launched. From the beginning, the project was designed to help organizations, developers and application security teams become increasingly aware of the risks associated with APIs. This past September, […]
Secure Your Network: How to Integrate EDR and DevOps
DevOps and Endpoint Detection and Response (EDR) solutions converge when no human element is required while deploying applications or detecting the threat and executing preventive measures. In this article, I am evaluating how the DevOps process integrates EDR solutions for securing services operations at various endpoints in the network. What is DevOps? DevOps has an […]
Best of 2019: Breaking Down the OWASP API Security Top 10, Part 1
As we close out 2019, we at DevOps.com wanted to highlight the five most popular articles of the year. Following is the fifth in our weeklong series of the Best of 2019. As a result of a broadening threat landscape and the ever-increasing usage of APIs, the OWASP API Security Top 10 Project was launched. […]
Best of 2019: The Time Has Come for an Engineering Approach to DevOps
As we close out 2019, we at DevOps.com wanted to highlight the five most popular articles of the year. Following is the third in our weeklong series of the Best of 2019. Do you want to know how to do DevOps? Are you doing DevOps but not satisfied with the results you are getting? DevOps […]
Predictions 2020: Infrastructure and Ops Trends to Watch in 2020
Today, modernizing systems is more than simply moving technology to a new location. It requires an IT stack of a new generation of technologies and tools to work. As we head into the new year, let’s take a look at the top eight trends that will shape how we will develop and deliver software. Kubernetes […]
CNCF Graduates TUF Project to Secure Software Updates
The Cloud Native Computing Foundation (CNCF) announced today that an open source specification for securing software update systems has graduated to becoming a top-level project. The Update Framework (TUF) is made up of a set of libraries, file formats and utilities that can authenticate files and images before they are downloaded from a software repository. […]
Synack: DevSecOps Being Accelerated by Cultural Shifts
The 2020 State of Compliance and Security Testing Report from cybersecurity testing platform vendor Synack claims that some of the world’s largest organizations are encountering a significant cultural shift within their development teams, and that bodes well for those seeking to build DevSecOps teams. For the report, Synack surveyed leaders from more than 300 organizations […]
Predictions 2020: The Future of the Mobile Industry
The mobile device industry continues to grow in leaps and bounds. Statistics show that, today, over 5 billion people have mobile devices and there are over 9.2 billion mobile connections worldwide. Add to these statistics the fact that the number of consumers who shop and bank online continues to grow as well–presenting hackers with increasing […]
Survey: DevSecOps Progress Remains Elusive
Results of a survey of 103 IT professionals attending the recent DeveloperWeek Austin conference suggests that awareness of cybersecurity issues is clearly rising among developers, yet most organizations still have a long way to go toward before approaching anything resembling adoption of best DevSecOps practices. Conducted by WhiteHat Security, a unit of NTT Communications, the […]
Why Is Security Missing in Many DevOps Implementations?
The exceptional and ground-breaking, technology-driven opportunities in today’s digitized age come with significant competitive pressures to transform promptly. Specific demands increase due to continuous repeating in response to customer preferences becomes the more deep-seated expectation. To overcome this issue, organizations are shifting toward DevOps as a medium to deliver innovations quickly. DevOps also promotes innovation […]
Shifting Left – But How Far Left Do Companies Need to Go?
For developers, there’s nothing more satisfying than looking at a web app or service and being able to say “I made that.” Or at least part of that. Being able to develop code that works and helps millions of people do what they need to get done is an excuse for bragging rights. But the […]
Practical Approaches to Long-Term Cloud-Native Security
There is no shortage of advice out there about how to secure modern, cloud-native workloads. By now, most developers and IT engineers who work with cloud-native deployments have heard all of the mantras about DevSecOps, shift-left security, multi-layer defenses and dynamic baselining (to name just some of the key concepts that are driving IT security […]
DevSecOps Requires Teamwork for Success
While the manifestos surrounding the current development pipelines may differ, there is one concept that remains constant: teamwork. All the various frameworks populating the development landscape bring together teams of people to build and deliver applications. This is especially true of DevOps, which focuses on a technical culture with defined roles on a quest for […]
Raytheon Leans on Red Hat to Advance DevSecOps
Raytheon Company is partnering with Red Hat to drive the adoption of DevSecOps workflows and processes it developed around the OpenShift application development and deployment platform. Jon Check, senior director for cyber protection solutions for Raytheon Intelligence, Information and Services, said Raytheon has developed a set of DevSecOps practices for organizations building applications deployed in […]
DevSecOps Adoption and the Web Security Myth
As DevOps practices have become widespread in the tech community, many people have begun proclaiming the virtues of DevSecOps. As the name implies, DevSecOps is the addition of security into DevOps. Just as DevOps promises better-quality production in less time, DevSecOps promises better security with less time required to achieve and maintain it. DevSecOps has […]