IoT, Not People, Now the Weakest Link in Security
Do a quick search on “people weakest link” and you’ll see a raft of articles in which cybersecurity experts and computer scientists point to employees or end users as the biggest vulnerability. No doubt, people do silly (or outright abusive) stuff and open the door for a variety of enterprise security problems. Spoiler alert: There’s […]
How to Turn Your DevSecOps Shift into Your ‘Pixar Moment’
If you have worked in security as long as I have, you have seen that vulnerabilities persist, despite years of attempts to fix them without changing how the organization operates. One of my all-time favorite leadership quotes comes from the first stockholder meeting after Robert Iger, the CEO of Disney, bought Pixar. “The riskiest thing […]
Applying DevSecOps to Address Cloud Security Challenges
Driven by the encouragement from 2018 progress, cloud technology is poised to be even bigger in 2019. However, one major hurdle continues to haunt the cloud trend: security. An overwhelming number of firms in the IT industry are preparing for cloud adoption, yet security continues to be a big question for many of them. Early DevOps […]
DevOps Chat: Identity Management with ForgeRock’s Peter Barker
Two megatrends for 2019 and beyond is scale and automation. The identity management space is a perfect example. Considering all of the IP-enabled devices (machines) coming online and the billions of people and their identities, managing these billions and billions takes systems that will redefine scale and, almost by definition, have to be automated. Enter […]
Always-on Development: Why Continuous Delivery Relies on Security by Design
How continuous delivery can help organizations in their application security efforts The old model of developing secure applications followed a structured, siloed, step-by-step process—build, check, release. Organizations’ desire for speed has forced development teams to ramp up their release cycles by any means necessary, even if it means bypassing incremental scanning for flaws that could […]
9 Pillars of Continuous Security Best Practices
Without proper consideration given to security best practices, the continuous delivery of software changes facilitated by DevOps is risky. On the other hand, DevOps provides an opportunity to reduce security risks if security is integrated into the continuous delivery pipeline according to best practices. This blog enumerates best practices for security across nine pillars of […]
Security and Speed: Why DevOps and Security Need to Play Nicely
It isn’t news that DevOps and IT security teams often struggle to align their departments and maintain a coherent balance between keeping a business secure and developing new applications to maintain customer interest. While security processes are a necessity, they can be deemed by DevOps teams to be manual and cumbersome, blocking the agility that […]
Best of 2018: 5 Open Source SIEM Tools Worth Checking Out
As we close out 2018, we at DevOps.com wanted to highlight the five most popular articles of the year. Following is the second in our weeklong series of the Best of 2018. Security information and event management (SIEM) is the cornerstone of IT security. All other network solutions are merely data flows that feed […]
What It Really Takes to Build Compliant Apps
If you search online for “software compliance,” you’ll be met with a seemingly endless lineup of blog posts, how-tos and explainer articles promising to tell you everything you need to know about writing and deploying software in a compliance-friendly manner. Some of those are good resources, especially the ones that delve into meeting specific compliance […]
DevOps Chat: A New Take on Application Security with Portshift
Portshift brings a new identity-based application security model from code to runtime. Cloud or on-prem, Portshift works. In this DevOps Chat we speak with CEO Ran Ilany and VP Business Ops Eran Grabiner about what is unique to the Portshift solution and why you should consider it for your own application security, especially for your […]
How to Become a DevSecOps Engineer
The popularity and success of DevOps means it’s now an increasingly common feature in IT job descriptions. One of the most important roles within DevOps, however, is the Security Engineer or DevSecOps Engineer. This deeply rewarding career requires a specific technical skill set, current knowledge of cybersecurity trends and a decent amount of experience. Perhaps […]
DevOps Chat: Promoting Innovation at the RSA Conference
RSA Conference is where the world comes to meet Security. For the last 14 years, the Innovation Sandbox Contest was where you could find out what the up and coming companies in security were up to. This year RSAC is doing something else in addition. The Launch Pad is where to come to if you […]
DevOps Chat: DevSecOps with Signal Sciences’ James Wickett
James Wickett is the man to go to for DevSecOps. The founder of the Rugged DevOps movement, which has merged into the DevSecOps group, James is one of the most knowledgeable people on the subject of DevSecOps. In this DevOps Chat, James shares his views on what’s on the horizon for DevSecOps and the most […]
The State of Web and Mobile DevSecOps
As the leaders in coverage of the DevOps world, the reporters here at DevOps.com are constantly pressed upon to convey the true state of DevSecOps at any given moment in time. We try to dig up the state of the union by asking important questions of IT executives, DevOps champions, security leaders and other pundits. […]
5 Questions to Ask When Choosing a Cloud-Native Security Platform for DevOps
If you work in DevOps, you’ve likely heard the mantra that DevOps success is all about the right people, tools and processes. Below, we take a look at how you can address the “tools” part of that equation when it comes to security. Specifically, we’ll discuss which questions to ask and what features DevOps teams […]
How Secure is Open Source for DevOps? 5 Considerations
Open source libraries and frameworks have important roles to play in a DevOps culture that emphasizes shorter development life cycles, collaboration and innovation. However, it’s vital not to neglect the security of these open source components. This article discusses the use of open source in DevOps and gives you five things to consider in terms […]
3 Tips to Build A DevSecOps Organization
For organizations undergoing digital transformation today, modernizing the existing environment can present serious challenges when it comes to security. Whether you’re dealing with a transition from legacy to cloud or hybrid models, or shifting from ITIL and waterfall methodologies to DevOps, the increasing number of technologies and complexity mean you need to rethink your security […]
Are Developers Your First Line of Security Risk or Defense?
Every organization on the planet, whether public or commercial, is facing an ongoing challenge: to exist in an increasingly digital space. Past products must transform to meet the digital expectations of their customers, and new products must be built with “digital-first” frameworks in mind. After all, if they fail to meet these expectations, there’s almost […]
10 Years of DevOps—Transition, Growth and the Future of AIOps
When software development became a cumbersome task of repetitive coding, testing and glitches, organizations had to come up with a solution. The solution? An organized approach that would not only eliminate the endless cycle of repetitive tasks but also would establish proper coordination and execution in the software development life cycle (SDLC). That very systematic […]
How DevSecOps Can Help Avoid Catastrophic Breaches
Earlier this year, Tesla’s Cloud was hijacked and used to mine cryptocurrency, exploiting a vulnerability in the company’s Kubernetes cluster. A mountain of FedEx data was recently exposed, affecting 119,000 individuals. The Equifax breach garnered international attention after an estimated 145.5 million Americans were jeopardized. In other news, we’ve reported on how the Vine Docker […]
American Express Uses DevOps for Better Breach Response
It was 6 a.m. Saturday when the phone rang and awoke the American Express CIO. When the phone rings at 6 a.m., it is never good news. Never. This instance was no different: In this case, a third-party supplier just suffered a breach, and that breach would impact American Express cardholders. Immediately following that call, […]
DevOps Chat: The State of Software Security with Veracode’s Chris Eng
Every year CA Veracode publishes its “State of Software Security” report, chock full of research about how well software is being secured during development and beyond. It’s eye-opening stuff and definitely worth a read for anyone even remotely interested in helping make software more secure. In this DevOps Chat, Chris Eng, VP of research at […]
Security Through ‘Legisurity’: Impacts of SB-327
With more devices connecting to the internet every day, security through obscurity should have died a long time ago. Still, high-profile cases of devices with mass-produced default login credentials and easily cracked crypto keys persist. As a result, say hello to security through “legisurity”: California SB-327—“Information privacy: connected devices”—became law Sept. 28. How will this […]