Why Modernizing Security is Like Visiting a Fast-Food Restaurant
Fast casual restaurants are taking over the food industry. Today’s consumers want quality and speed, and the brick-and-mortar model offering immediate service paired with quality ingredients perfectly fits the bill. It’s the new, modernized dining experience. You can also argue that the same modernization taking the food industry by storm is happening in the security […]
Helping Developers Win in the Shift-Left Revolution
The shift-left revolution is upon us. Just because it’s a cliche, doesn’t mean it’s not true. As software development organizations continue to implement DevOps culture, processes, and tools, developers are adopting the practice of testing and ensuring the security of their applications as early as possible in the DevOps pipeline. This is quite a change […]
Top 5 AWS Security Mistakes: Leaky S3 Buckets
As we get ready to discuss our list of the Top 5 AWS Security Mistakes in the upcoming DevOps.com webinar, we wanted to provide a preview of the type and depth of information we’ll be discussing. Since the most-talked about, and likely the most vulnerable, aspect of AWS security is inevitably those leaky S3 buckets, […]
Software Compliance Teams Can Learn a Lot from DevSecOps
Many argue that application security should be the responsibility of a security team. However, while security professionals can contribute, developers are usually the only ones with the technical ability to fix software security vulnerabilities. The same goes for software compliance. When it comes down to it, only developers are equipped to build applications in compliance […]
GitLab Research Reveals DevOps and Cybersecurity Disconnects
DevOps and cybersecurity teams have a complicated relationship, which impacts code quality, research shows Finger-pointing has long been the name of the game when it comes to cybersecurity failures. After all, who should be responsible when so-called bad code or bad practices are blamed for the latest incident? A recent survey by DevOps lifecycle tool […]
The Challenge of Securing Open Source Applications
As enterprises have increased their reliance on applications over the years, there has been a significant rise in the use of reusable software components such as third-party libraries and open source code. This makes perfect sense, as this development method makes it possible to add value to applications and other software offerings quickly and easily. […]
ASF Moves OpenWhisk Serverless Computing Forward
The Apache Software Foundation (ASF) announced today that the OpenWhisk serverless computing framework has now become a high-level open source project. Matt Rutkowski, CTO for serverless technologies and advocacy for IBM, said with this announcement, organizations looking to implement an open source serverless computing framework on-premises or in a public cloud now can have confidence […]
3 Reasons Why Ephemeral Access is Best for DevOps
Recently, we worked with a customer, MOST Digital, whose developers were struggling with a common workflow challenge we hear from many companies. The company is in the software robotics automation space—it essentially makes little robots that automate all sorts of business processes for a company, such as HR report filing or routine emails. MOST Digital […]
Product IT Operating Model: The Next-Gen Model for a Digital World
Digitization presents many new opportunities for businesses to create value. At the same time, it forces IT to rethink the way it operates. Modern CIOs need an operating model that understands the blurring lines between IT and business and is designed for agility and speed. The product-centric IT operating model is rapidly emerging as the […]
GitLab Survey Surfaces Major DevSecOps Challenges Ahead
A report based on a survey of 4,071 software professionals published this week by GitLab, a provider of a continuous integration and continuous deployment (CI/CD) platform, found that while appreciation of the potential value of DevSecOps best practices is high, the ability to implement those practices is uneven at best. According to the survey, half […]
Transforming the Security Team Into a DevOps Partner
Securing DevOps environments is an increasingly important concern for chief information security officers (CISOs) and security teams. While developers often recognize security is important, it is not their top priority. More typically, the DevOps team prioritizes delivering new capabilities and features to the business and customers, often as part of a larger digital transformation initiative. […]
DevOps Chat: Mayhem Testing With ForAllSecure
Secure software depends on people finding vulnerabilities and deploying fixes before they are exploited in the wild. This has lead to a world of security researchers and bug bounties directed at finding new vulnerabilities. As dedicated as security researchers are, there is a vast ocean of software in existence, waiting for someone to find and […]
DevSecOps Survey Finds Failure to Communicate
While it’s generally agreed that shifting more cybersecurity responsibility onto the shoulders of developers is a good idea, a failure to communicate across application development and cybersecurity teams has contributed to little progress in achieving DevSecOps. A survey of 1,310 IT decision-makers conducted by the market research firm Vanson Bourne on behalf of Trend Micro […]
State of the Software Supply Chain: Secure Coding Takes Spotlight
After almost a year of research that involved studying 36,000 open source software projects, 12,000 enterprise development teams and 3.7 million open source releases, we at Sonatype are excited to share the “2019 State of the Software Supply Chain” report. This year, we worked with research partners Gene Kim, founder of IT Revolution, and Dr. […]
6 Traits That Define DevSecOps
How do we define DevSecOps? A combination of DevOps and security is readily apparent, but the philosophy goes much deeper. In a recent eBook, The State of DevSecOps, we asked industry experts to define what DevSecOps meant to them. Below, we’ve condensed their answers into five core attributes. Following these principles, CIOs or CTOs now […]
DevOps Chat: Global Intelligence for AWS GuardDuty, With Sumo Logic
Wouldn’t it be helpful to know if other cloud users are seeing the same or similar attacks that you are? Security intelligence about cloud applications beyond just those you own and operate as an enterprise opens up a new dimension in attack visibility against even large sets of cloud apps. During AWS re:Inforce 2019, Sumo […]
Portable Security Policies: A DevSecOps Primer
Protecting critical data and applications is a challenge under any circumstances, but it’s especially daunting when resources reside in the cloud. Most organizations today operate a significant portion of their workloads in the cloud, which adds to the complexity of the security problem—a security team can’t fully control cloud environments but is responsible for securing […]
Data: the New Currency That Accelerates Business
The amount of data created every day is staggering: 2.5 quintillion (that’s 18 zeros) bytes, to be exact. And that number is growing exponentially, thanks to mass deployments of internet of things (IoT) networks and devices. Cisco Systems estimates that by the end of 2019, IoT will generate more than 500 zettabytes of data per […]
DevOps Security Champion: Who, What and Why?
In general, DevOps is a process and culture of organizations to get applications out the door faster and with higher quality. To do so, security champions are essential. In DevOps, security champions work as a backup mechanism in various projects and take multiple leadership roles. Security champions make effective decisions and take projects forward while […]
Open Innovation Labs: How Lockheed Brought Better Security to Fighter Jets
How Red Hat’s Open Innovation Labs have helped accelerate Lockheed’s software development for the F-22 Raptor As the key government contractor charged with helping the U.S. Air Force keep its F-22 Raptor jets in fighting trim, Lockheed Martin Aeronautics increasingly values software delivery speed as much as engine speed. So much of the continued evolution […]
Security: Are You Doing DevOps Right?
Phil Kernick, co-founder and CTO of cybersecurity specialist CQR Consulting, has no fundamental problem with DevOps, but asks, from a security perspective, “How many people do it right?” If DevOps is going to work and produce secure systems, then developers must take responsibility for security. It’s not something that can be treated as an additional […]
The Bug in Production: What You Don’t Know Can – and Will – Harm You
Despite the risk of unplanned downtime, many organizations that develop software and services push them live without adequately testing for bugs that will manifest against production traffic. This is a huge gamble: Those bugs could lead to errors that bring down the service altogether. Pushing live without sufficient testing can be detrimental to your business. […]
Motorola Solutions: Driving a Thriving Security Culture
It’s crunch time in the cybersecurity industry. For too long, many companies have remained unmoved by the increasing threat of cyberattacks, despite increased digitization of their products and services. Customer data is the new gold, and some organizations are leaving the door to their vault wide open. In saying that, secure development is complex and […]