There’s No Such Thing as DevSecOps
Should DevSecOps be categorized separate from DevOps? After years of debate, few doubts remain about the viability of the public cloud for enterprise workloads. Enterprises are shifting to cloud-first and cloud-only strategies, looking to take advantage of all the good the public cloud has to offer. For applications built and deployed in the public cloud, […]
Aqua Security Survey Finds Sharp Rise in DevSecOps
A new survey of 80 cybersecurity professionals that attended the recent RSA Conference 2018 event finds the number of organizations that have a formal or informal DevSecOps team in place has increased by several orders of magnitude year over year. The survey, conducted by Aqua Security, finds 62 percent of respondents have a formal or […]
Using Blockchain to Advance IoT
Imagine two disruptive technologies come together to democratize transparency and connectivity in the tech world. That’s exactly what’s happening with blockchain technology, once synonymous with powering cryptocurrencies including Bitcoin, has the potential to be a disruptor in a number of verticals and the internet of things (IoT), with blockchain addressing key IoT security concerns. About […]
Don’t Forget to Automate Cloud Security
Cloud has been around long enough, and we’ve had enough breaches stemming from unsecured cloud (mostly data objects, but other items, too) that we should know better. I cringe whenever I see a security headline along the lines of “… Unsecured S3 Bucket.” Would you publicly expose a server in your data center and not […]
Securing Third-Party and Open Source Code Components: A Primer
The increasing popularity of open source code continues to be a boon for developers across the industry, allowing them to increase efficiency and streamline delivery. But there are security risks to be considered when leveraging open source and commercial code components, as each carries with it a significant risk of becoming the enemy within, creating […]
Continuous Discussions Video Podcast: DevSecOps, Best Practices and More
In a recent episode of the Continuous Discussions (#c9d9) podcast, a group of industry experts discussed why DevSecOps is officially more than just a buzzword, tips on how to get everyone in the organization to own security and some of their own challenges and experiences baking security into the software delivery pipeline. The panel included: […]
Open Source: Is Your DevOps Org Vulnerable to an Equifax-Style Hack?
More than half of the Fortune 100 could be at risk of falling prey to the same kind of hack that caused devastation at Equifax last year, and it all comes down to poor open source component governance. A new report out from Fortune reports that in the year after Apache Software Foundation issued an […]
Google Advances Confidential Computing
Google has kicked off an effort to make it easier to build secure applications using an open source framework for confidential computing, which enables encrypted data to be processed inline by an application without ever requiring the data to be decrypted. Asylo is an open-source framework and SDK for developing applications that run in multiple […]
Reducing Risk in Applications Using Docker Containers
Docker. It seems like in this day and age you are either using Docker containers or you are going to use Docker containers. If you haven’t jumped on the bandwagon yet, check out a previous article, “Docker: The New Ordinary.” If you are on the wagon or are thinking about it but have concerns about […]
200 Billion Downloads Can’t Be Wrong
Laurie Voss, COO and co-founder at npm (@seldo), tweeted recently that JavaScript packages downloaded from their repository has topped 4 billion. On an annual basis, that would be more than 200 billion downloads. Wow. Just as open source software turns 20 years old this year, these numbers are a testament to the incredible magic that happens when […]
Bridge the DevSecOps Experience Divide with Cross-Functional Teams
Last week’s DevOps Connect event at RSA Conference offered up a ton of wisdom and real-world examples of the power of DevSecOps. With its best-ever attendance after several years and impressive participation levels, this year’s event stands as a good harbinger for the growing interest that the security community has in vesting itself in the […]
451 Research Report Highlights Value of DevSecOps for the CI/CD Pipeline
One of the compelling benefits of DevOps for many organizations is speed. Between breaking down silos, streamlining processes and automating routine tasks, the process of developing and deploying software can be significantly faster. A new report from 451 Research and Synopsys, however, points out the value of incorporating DevSecOps in the equation, especially with continuous […]
Simplify DevSecOps with a Zero Trust Approach
There are major cyberattacks and data breaches weekly, if not daily. Each incident is unique in some way, but one element common to almost all successful attacks is trust. Whether it’s a disgruntled employee conducting an insider attack, an attacker infiltrating the network using stolen credentials or an exploit that leverages a third-party vendor or […]
Study Traces Cybersecurity Issues to Lack of App Supervision
A global survey of 400 application developers conducted by Vanson Bourne on behalf of Veracode, a unit of CA Technologies that provides software development lifecycle tools, shines a light on how big an issue cybersecurity has become because of organizations failing to update components. The survey finds only 52 percent of developers using commercial or […]
Akamai Extends Scope of DevSecOps Reach
Akamai pressed its case for becoming a strategic DevSecOps platform by adding a range of security capabilities to its network service platform that help isolate applications from cybersecurity threats. The company has added support for scripting to automate application security using its Kona Site Defender web application firewall as well as improved management and versioning […]
HashiCorp Extends Secrets Management Reach
Secrets management is core to DevSecOps—how credentials are managed can make all the difference in preventing an application from being compromised in the first place. The challenge is making it as simple as possible for developers to access where most of those credentials are stored in the enterprise. HashiCorp this week released an update to […]
Early Automation: A Key Requirement for DevSecOps Success
According to the “2017 DevSecOps Community Survey,” by Sonatype, almost 60 percent of the respondents consider security to be an inhibitor to DevOps agility, while more than 50 percent of developers say they do not have sufficient time to allocate to security. Hence arises the need for enhanced security automation in DevOps. Security automation helps […]
Building a Solid Foundation for Microservices Security
It’s often true that threats evolve faster than development practices and technologies can keep up with, which can be seen in the current microservices approach to application development. While microservices bring clear benefits to developers by enabling application deployment via modular, independently deployable services, they also open the door to new security vulnerabilities. Consequently, these […]
DevSecOps: Don’t Invest In Hope
A successful DevSecOps approach is rooted in action, not hope. There is a lot of investment in hope. I hope we won’t get breached. I hope our DevOps teams aren’t deploying thousands of vulnerable containers. I hope our developers aren’t downloading millions of vulnerable open source components. I hope our developers and security teams will […]
Barracuda Networks Survey: DevSecOps Is Hard
Organizations that have adopted DevSecOps processes may be making progress when it comes to improving cybersecurity, but it’s far from easy. A survey of 618 IT decision-makers conducted by Dimensional Research on behalf of Barracuda Networks, a provider of IT security software and appliances, finds half have adopted either DevOps, DevSecOps or a continuous integration/continuous […]
Software Liability Goes Global
This month, France turned up the conversation on software liability for manufacturers who place known defective software components in their products. But, they are not the first. Software Liability in France According to Lukasz Olejnik, lawmakers in France just suggested a desire to “put the security liability in hands of product suppliers. In other words, making […]
DevSecOps: Digging into Root Cause Analysis
We have all been there in a postmortem when someone says, “Let’s get to the root of the problem.” And, we all know what that means: Who or what is to blame? We also all know that no one wants to play the blame game, yet we all do. But it isn’t our fault (no […]
DevSecOps: Deception in Depth
Mantraps, tripwires and tarpits … sounds like the start of a solid spy-movie plot, doesn’t it? These are among the many concepts of physical security that are making the crossover to software security. You’ve likely heard that security is all about defense in depth—the idea of layering several defensive measures so that their combined effectiveness […]