Without These 3 Things, You Don’t Have DevSecOps
DevSecOps adds security to the DevOps software development and releasing paradigm. Everyone thinks this is a great idea, except actual Dev and Ops practitioners, for whom security can be a thankless, stressful time sink. Without the right approach and tools, an organization can run a DevSecOps process that actually contributes little to security. Security simply […]
Tackling Audit Compliance as Code
Do the words, “It’s audit time!” make your stomach sink? If so, you’re not alone. Assisting with evidence collection for compliance audits around PCI DSS, SOC-2, ISO 27001, NIST and HITRUST is a drain on DevOps teams’ time and resources at companies of all types and sizes – time and resources that could be better […]
How to Eliminate Incident Inefficiencies
In today’s complex, dynamic IT environments, the proliferation of disparate IT Ops, NOC, DevOps and SRE teams and tools is a given – and usually considered a necessity. This leads to the inevitable truth that when an incident happens, often the biggest challenge is collaborating between these teams to understand what happened and resolve the […]
GrammaTech Allies with GitLab to Advance DevSecOps
GrammaTech announced today it has partnered with GitLab to integrate its GrammaTech CodeSonar static application security testing (SAST) tools with the GitLab Ultimate DevSecOps platform. Vince Arneja, chief product officer at GrammaTech, said integration with continuous integration/continuous delivery (CI/CD) platforms such as GitLab is critical because it enables security scans to run automatically any time […]
Cloud Migrations Demand Risk and Compliance Maturity
The COVID-19 pandemic brought undeniable disruptions for organizations and their employees whether business, personal or otherwise. Across the globe, businesses and governments alike were forced to try and manage these disruptions. For nearly all organizations, digitization initiatives were accelerated in a short period of time, from implementing work-from-home policies and launching new applications to support […]
Building Trust Into Your Product by Design
In today’s world, every tool, every solution and every technology has the potential to do both good and bad. Good, if used according to the way it was designed, but bad if it falls into the wrong hands, or is manipulated or abused. As the ‘Peter Parker’ principle says, “With great power comes great responsibility.” […]
ZeroNorth Adds Analytics App to Advance DevSecOps
ZeroNorth today added an Advanced AppSec Risk Analytics module to its platform for orchestrating DevSecOps processes. John Worrall, ZeroNorth CEO, said the analytics tool pulls vulnerability data generated by a variety of security tools to provide both DevOps and cybersecurity professionals with a single source of truth for assessing security within an application environment. The […]
Understanding Data Storage: Lakes vs. Warehouses
Now more than ever, companies are looking for new ways to incorporate data analytics into their daily operations and leverage data-driven insights to improve business functions. They are frequently turning to complex data for tasks like machine learning and artificial intelligence, which are becoming necessary to understand and reach customer segments across industries. However, understanding […]
AppDynamics Partners With Cisco to Secure Application Runtimes
AppDynamics today announced its agent software, which it provides as part of its observability platform, now has the ability to enforce application security policies. Developed in collaboration with the security business unit of parent company Cisco, the Cisco Secure Application offering, available from AppDynamics, can detect attacks, identify deviations in application behavior and block attacks […]
OpenAPI Specification: Perception vs. Reality
The OpenAPI Specification (OAS) (formerly known as the Swagger specification) provides a way to describe and document REST APIs and their components. It includes details on endpoints, their operations, parameters needed for the operations, expected responses for every operation, authentication methods and even annotations. OAS is an easy format to learn and read, and can […]
ARMO Aims to Simplify Microservices Security
ARMO this week emerged from stealth to launch a platform to secure cloud-native workloads and improve visibility. The ARMO Workload Fabric technology attaches code within the memory invoked by a microservice to enable cybersecurity policies to be applied via a cloud service. Company CEO Shauli Rozen said the ARMO Workload Fabric is designed to enable […]
Overcoming Cloud Asset Management Challenges
Twenty years ago, no one in IT could have predicted the monumental role that cloud computing would play in our everyday lives. To play off the words of Back to the Future‘s Doc Brown: “On-premises? Where we’re going, we don’t need on-premises.” As technology continues to evolve, though, security teams face greater challenges. Infrastructure is […]
A Security Vulnerability Management Guide
Living in a container-native world is not easy. Containers have a reputation for being a point of entry for security vulnerabilities for many organizations. In 2015, according to a research paper, over 40% of Docker images distributed through Docker Hub had high-risk vulnerabilities; at that time there were more than 95,000 container images hosted on […]
Report: Software Quality Issues Costing U.S. Companies $2.08 Trillion
A report published today by the Consortium for Information & Software Quality (CISQ) estimates poor software quality collectively cost companies in the U.S. an estimated $2.08 trillion in 2020. The report, co-sponsored by software quality and security tools provider Synopsys, attempts to calculate, at least theoretically, the cost of known software failures. The report identifies […]
Building an IaC Security and Governance Program Step-by-Step
Infrastructure as code (IaC) is undoubtedly changing how engineers approach the cloud. IaC, when coupled with dev tools and automation, opens up new avenues for infrastructure performance, scalability and, now, security. By embedding IaC security and compliance controls into your version control systems and CI/CD pipelines, you can start identifying and fixing errors earlier. But, […]
Why Service Meshes Are Security Tools
Are service meshes overhyped, or do they solve a real puzzle for enterprise IT systems? Service meshes are a relatively new technology, and many people have found it challenging to fit them into predefined tooling categories. That’s because service meshes have a wide variety of functionality, from load balancing to securing traffic. But service meshes […]
Veritas Looks to Reduce Data Protection Costs
Veritas has extended the capabilities of the company’s NetBackup software as part of an effort to reduce the total cost of data protection. Version 8.3 of NetBackup now includes Veritas Resiliency Platform (VRP), a disaster recovery tool, and CloudPoint, a tool for backing data up on a public cloud. All of these tools are part […]
Google Taps AMD for Confidential Computing Service
Google Cloud, at a Google Cloud Next 2020 Online event, announced it is making available in beta Confidential VMs, a new service that represents the cloud service provider’s first foray into the realm of confidential computing. Based on second-generation EPYC processors from AMD that provide access to an embedded Secure Encrypted Virtualization (SEV) capability, Confidential […]
AIOps Greasing the Wheel of Digital Security amid COVID-19
Amid the most challenging era for business infrastructures and transformations, AIOps (AI for IT Operations) can help industries operating in the digital environment to be vigilant when it comes to network operations or the digital security measures. AIOps has the potential to significantly align well with the cybersecurity needs of a company. A cybersecurity department […]
Can NetOps and SecOps Finally Get Along?
For years, the very definition of NetOps and SecOps has involved friction and even contentious relationships that make their respective jobs more difficult and lessen their efficiency and effectiveness. Much of this conflict originates from having charters that are seemingly in opposition to each other. At the surface, NetOps stands for connectivity, openness, speed and […]
Commvault Extends Data Protection Alliance with Microsoft
Commvault and Microsoft are extending their existing relationship to integrate Commvault’s data protection software with Azure Blob Storage. Azure Blob Storage is a service based on object-based storage optimized for unstructured data. Commvault last year launched the Metallic software-as-a-service (SaaS) platform, which provides a cloud-based approach to managing data protection, that runs on Azure. The […]
SonicWall Adds Multi-Gigabit Switches to SD-Branch Portfolio
SonicWall has added a line of multi-gigabit switches to its software-defined (SD)-branch offering that unifies the management of wireless access points and firewalls that include software-defined wide area network (SD-WAN) capabilities. Dmitriy Ayrapetov, vice president of platform architecture for SonicWall, said the switches will replace a series of switches that SonicWall had been reselling from […]