When Did Safety Nets Become Optional?
There are various reasons why some organizations would not be interested in protecting their data. These reasons could range from the lack of financial resources to the lack of non-financial resources, such as engineers to implement a solution. Regardless of whether there is a good reason to not protect your data, the net result is […]
DevOps and Database Security
Osterman Research recently released a survey-based report on database security. The results don’t exactly instill confidence where username breaches are concerned: While more than 50 percent of respondents felt that a breach of the database would be a serious problem for their organization, 44 percent responded that it would take more than a day to […]
Veracode Makes DevSecOps Transition Easier for Developers
Following the formal acquisition of Veracode by CA Technologies, a much bigger effort to make security a more integrated element of DevOps has kicked off in earnest. Veracode recently unfurled an update to its application security platform aimed specifically at developers that provides security findings as each application module is scanned. Tim Jarrett, senior director […]
DevSecOps @RSAC, My 2 Favorite Presentations
For the third year, DevOps.com hosted a DevSecOps/Rugged DevOps event at RSA Conference. As with years before, we smashed attendance records. We had just shy of 900 people stop in on Monday of RSA Week to hear from the 11 presentations we hosted. Taken in total, the presentations presented a wide range of DevSecOps issues. […]
Securing Immutable Servers in a Serverless World
Snowflakes are beautiful, unique creations. But, let’s keep them in nature. They don’t belong in our server infrastructure. Snowflake servers, where every configuration is just a little different, can introduce unnecessary security vulnerabilities and complications. While common in IT infrastructure, in the DevOps realm, they are gradually becoming ancient history. At the recent All Day […]
From a Commodore 64 to DevSecOps
We all know the story: a farm, a kid, a Commodore 64, and a modem maxing out at 300bps. A few unexpected phone bills later, and young Ian Allison is figuring out how to game the system so he can keep using his newfound gateway to the world of tech. According to Ian, that is […]
Threat Protection Appliances: As Valuable to Security as Your Toaster
Nothing in the IT security community is as widely deployed and universally reviled as anti-virus. But, threat detection appliances, including intrusion prevention appliances, application firewalls and advanced threat protection appliances, should be almost as reviled. These appliances are nearly as useless as they are toxic. They do a horrible job finding problems and ultimately create […]
All Day DevOps: System Hardening with Ansible
The DevOps pipeline is constantly changing. Therefore, relevant security controls must be applied contextually. We want to be secure, but I think all of us would rather spend our time developing and deploying software. Keeping up with server updates and all of the other security tasks is like cleaning your home: you know it has […]
Ransomware will Double in 2017. Are you Prepared?
A recent report found that ransomware attacks quadrupled in 2016, and are likely to double in 2017. Not surprisingly, a research survey showed that 48 percent of organizations had been hit by ransomware in the past year. And as we highlighted in a recent blog post, next generation cloud applications and databases are quickly becoming […]
Security @ the Speed of DevOps Survey: Efforts Still Lag
Enterprises today are in a relentless race to digitize or die. If they don’t digitize business processes, services or internal workflows and their competitors do, they will be at a steep disadvantage—and perhaps soon an irrecoverable one. In more and more companies these efforts are being driven by DevOps. According to IDC, the vast majority […]
A Modern Database Backup and Recovery Checklist
Do you have single points of failure? How do you handle deduplication? These questions and more need consideration when you’re dealing with database backup and recovery. Enterprises are quickly onboarding next-generation, mission-critical applications such as eCommerce, artificial intelligence, machine learning and Internet of Things (IoT) on non-relational databases and distributed local storage. However, as organizations […]
Elasticsearch Ransomware Attacks Highlight Need for Better Security
Recently, reports surfaced that a large number of Elasticsearch servers fell victim to potential ransomware attacks. Ransomware is the type of malware a company doesn’t want on its systems or network. It takes systems hostage, most commonly by encrypting or stealing data, and exposes the owners to blackmail attempts. According to a report by the […]
2017 Security Blogger Awards – Open for Voting!
It’s another year, and another awards ceremony to come at the Security Blogger Meet-Up at RSA Conference in San Francisco. It’s time to vote for your favorite blogs, which were selected solely by our esteemed influencers: Ericka Chickowski, George Hulme, Kelly Jackson-Higgins (Dark Reading) and Don MacVittie. We are very grateful for their taking the time […]
The Secure Developer Podcast: Continuous Security at Chef
Welcome to The Secure Developer, a podcast about security for developers, covering security tools and practices you can and should adopt into your development workflow. The Secure Developer is hosted by Guy Podjarny, CEO and co-founder of Snyk. In this episode of The Secure Developer, Guy talks with Chef CTO Adam Jacob about the role security […]
What the Current DDoS Landscape Means for DevOps
Businesses, governments, hospitals, schools, charities and even individuals—they’re all the same to a DDoS perpetrator. If you have a website, it’s likely to be targeted by a distributed denial of service (DDoS) attack at some point. DDoS has the potential to shut down your site for days and create havoc with an organization. They can […]
Lance Crosby’s Vision To Bring Scale, Speed and Security To Developers with StackPath
The last most of us heard from Lance Crosby we thought he was riding off to an island sunset, to bask in the glow of a very successful exit from SoftLayer. The company he founded was bought by IBM for a few billion dollars to serve as the centerpiece of their cloud strategy. Many would […]
DevOps Lessons from the Dyn Attack Fiasco
Dyn’s DNS servers suffered a major DDoS attack last week, slowing a host of major websites. Does the drive for DevOps automation increase the risk of similar attacks? Maybe, but it doesn’t have to. As almost every geek knows by now, a DDoS attack on Oct. 21 overwhelmed Dyn’s DNS servers, and websites that depended […]
Network Resilience and Security from A to Z
An observer watching a bunker shot by legendary pro golfer Gary Player was heard to say: “I’ve never seen anyone so lucky in my life.” The player retorted: “Yes, and the more I practice, the luckier I get.” Yet, when it comes to cybersecurity, nearly half of organizations are solely relying on luck to get […]
Empower Developers to Build Security into DevOps
Over the past 10 years, as more organizations have made the transition to DevOps, there has been a cultural shift in which security and development teams agree quality is a priority. Yet, even with a shared quality focus, Development, Security and Operation teams still find themselves at odds on the road to continuous delivery of […]
Fixing Flaws: Bridging InfoSec and DevOps
The Road to Creating More Secure Code and Interlocking two Traditionally Distinct Practices As DevOps continues to expand across verticals, including the financial and government sectors, security has become paramount in the minds of CIOs and CTOs. As such, more organizations have begun to integrate security early in the development process. While security always has been […]
Top 5 DevOps Practices to Improve Security in Engineering
We’ve all been there … A new application or feature needs to be deployed yesterday and the last thing anyone wants to do is address security requirements. On the flip side, the very last thing anyone wants to address later is a security breach or a cost associated with non-compliance. Not only is it a […]
Software Assurance Takes Center Stage at Developer Day
Cloud Security Alliance and SAFECode Develop Training for Improved Software Security Using Cloud and DevOps Practices Software assurance is one of the most important and possibly one of the least understood areas of software development today. Software assurance is a comprehensive process that encompasses a set of design, coding and testing methods for ensuring that […]
It’s All About the Tools: Lifecycle Security and Testing
In the past, whenever a new application or a new version of an application was bought to market, users often were abused as beta testers for security and usability. This was largely because of a lack of opportunity to test a large codebase effectively and efficiently. Similarly, the subsequent patches and new applications versions were […]