The Road Ahead for Security, DevOps Transformation
Qualys hosted its Qualys Security Conference 19 this week in Las Vegas. Hundreds of attendees from around the world have gathered at the Bellagio hotel to learn more about the current state of cybersecurity and what the future has in store. As you might expect, given the technology landscape today, many of the sessions and […]
Three Ways Developers Can Worry Less About Security
Over the past 10 years, developers have risen in organizational importance. They’ve acquired more tools, power, responsibility and autonomy. As part of that evolution, many developers today want to touch all of the layers of code and have their hands in every tool that’s being built. Known as “mechanical sympathy,” developers are taking increased initiative […]
What Are AWS Application Patterns?
The cloud-native approach is not just about compute power and cloud services. A “set it and forget it” attitude won’t work with cloud native; there are far too many moving pieces and there is just way too much complexity. Instead, this approach requires constant testing, optimization and improvement. This is epitomized in the two key […]
Survey Surfaces Uneven Approaches to DevSecOps
A ZeroNorth survey shows implementing DevSecOps is rife with questions for many organizations, with no clear answers There’s general agreement that digital business transformation initiatives are driving an overall acceleration in the rate at which applications are developed. At the same time, however, given the critical nature of those applications, cybersecurity has never been more […]
Five Tips to Approach DevSecOps Training
Developers are on the front lines when it comes to protecting their organizations from cyberattacks. As we’ve seen with the hacks of Monster.com or the Fortnite vulnerability, 2019 has been a trying year for organizations who have failed to protect their applications and websites. With an increase of cyberthreats today, it is vital that organizations and developers incorporate standard […]
Why Mobile App Security is Like a Rubik’s Cube
Now more than ever, mobile applications are driving modern business, and developing and launching them are top priorities for companies across industries. As of 2018, more than 194 billion applications had been downloaded from app stores, according to Credence Research. The global mobile app market was valued at $109.67 billion in 2018 and, at the […]
Kubernetes and Service Mesh With StackRox
DevOps and Kubernetes enable organizations to “go with security,” adding security to the code instead of on top of it. In other words, security is built-in rather than bolted on. This is one of the aspects of security in the DevOps world with a Kubernetes system that Ali Golshan, co-founder and CTO of StackRox, explained […]
Applying Secrets Management to DevOps
DevOps has changed the way enterprises operate, allowing for quick and efficient product development. In order for companies to keep up with market competition, many companies that are not structurally prepared to implement DevOps will still put together a team just to meet demand, which in turn creates vulnerabilities and gaps within their security posture. […]
What Developers Must Know About Threat Modeling
Threat modeling is a process that far few developers seem to pursue, but it is a process that helps you and your team to model all potential threats to your application. Essentially, threat modeling is your thinking through all of the potential threats against an application. Doing so is virtually as easy as putting together […]
The New Era of Kubernetes, With StackRox
Orchestrators are becoming the operating systems of cloud for the future. Which one do you think has become the dominant one? Ali Golshan, co-founder and CTO of StackRox, placed his bet on Kubernetes right from the start. StackRox is a Kubernetes-native security platform that helps DevOps and security teams operationalize security, providing richer context, native […]
Trend Micro Partners With Snyk to Advance DevSecOps
Trend Micro today announced an alliance with Snyk through which alerts about vulnerabilities in open source code will be passed on to the tools Trend Micro makes available to apply virtual patches to both monolithic and microservices-based applications. Snyk provides a tool that identifies and fixes vulnerabilities and license violations in open source dependencies and […]
WhiteSource Extends DevSecOps Reach
WhiteSource has extended its platform that enables developers to more easily address application security issues to provide integrations with GitLab Core and integrated development environments (IDEs) based on the open source Eclipse project. David Habusha, vice president of product for WhiteSource, said these latest extensions extend the reach of the company’s platform for addressing DevSecOps […]
ESG Survey Sees Long DevSecOps Road Ahead
A study published by Enterprise Strategy Group (ESG) in collaboration with Data Theorem, a provider of tools for securing application programming interfaces (APIs) and mobile applications, finds that while a lot of progress has been made in terms of adopting DevSecOps, most organizations still have a very long road ahead before they can claim DevSecOps […]
Survey: DevSecOps Easier Said Than Done
While there’s clearly a lot of interest in best DevSecOps processes, a survey of more than 3,000 DevOps practitioners suggests adopting DevSecOps will require a lot of patience and perseverance. The “2019 State of DevOps Report,” co-written by Puppet, CircleCI and Splunk, ranks respondents on a scale of High, Medium and Low in terms of […]
Implementing DevSecOps Goes Beyond Technology
While technology is crucial for implementing DevSecOps, it is the people, processes and culture that drive it forward. As recently as last year, a survey found 58% of technology leaders cited existing culture and lack of skills as hurdles to being able to embed security testing and evaluation within software development processes. That report found […]
DevSecOps Becomes a Higher Cloud-Native Priority
At the Cloud Native Security Summit, Enterprise Strategy Group (ESG) today revealed the results of a survey of 600 senior IT leaders that finds organizations are looking at DevSecOps as a way to address the complexities of managing and securing cloud-native applications. According to the survey results, 43% of respondents said their biggest challenge with […]
IoT Security Concerns
The Internet of Things (IoT) is being hailed as the next step in our technological development. It’s hard to argue with that. The abilities it provides are as captivating as they are numerous: smart cars and homes, automatized agriculture, advancements in medicine that help with after-stroke recovery and the list goes on. However, while the […]
DevOps Chat: Splunk Moves Into Microservices With Omnition Buy
Swiftly after announcing its acquisition of SignalFx, Splunk is vaulting into microservices tracing by announcing its intention to acquire Omnition. Tech companies are rapidly making acquisitions to strengthen their position in the DevOps and contemporary cloud-native software stack. Rick Fitz, SVP and GM of Splunk’s IT Markets Group, joins DevOps Chat to share with us […]
Cloud Security: Self-Healing Infrastructure With Fugue
Misconfiguration is the No. 1 cause for data breach in the cloud. Fugue helps to eliminate data breaches, as it fixes anything that gets drifted by providing baseline drift detection and automated remediation. Fugue is all about cloud security. It identifies security risks and compliance violations and ensures they’re never repeated. During this interview, Josh […]
From DevOps to DevSecOps: Owning Cloud Security
The cloud is a complex environment, with different groups managing different cloud services and environments. The most basic division is between the cloud provider, who provides the core infrastructure, and the customer, who leverages services or builds their applications using resources leased from the provider. Within larger organizations, different cloud resources, data and applications may […]
VMware Starts to Make DevSecOps Case
VMware, at the VMworld 2019 conference this week, strengthened its case for an application-centric approach to cybersecurity via updates to VMware AppDefense along with acquiring Intrinsic, a provider of a set of tools for securing serverless computing frameworks. VMware AppDefense layers a distributed service layered on top of the Platinum Edition of VMware Sphere platform […]
Weighing the Cost of Improper DevSecOps
Simply put, data breaches are terrible news for companies. And, the costs associated with such attacks continue to escalate. A recent IBM-sponsored report found an average price of 3.92 million per breach. Not adapting security automation and vulnerability scanning into development pipelines could have a drastic effect not only on cost but workload efficiency and […]
Puppet Aims to Automate Vulnerability Remediation
Puppet today unveiled Puppet Remediate software, which makes it easier to prioritize and remediate software vulnerabilities automatically. Matt Waxman, vice president of products for Puppet, said Puppet Remediate builds on existing automation capabilities in the Puppet platform to make it easier for DevOps teams to focus on addressing vulnerabilities. Most existing approaches to addressing vulnerabilities […]