Survey Sees Long DevSecOps Ahead
A survey of 250 developers working at leading technology companies paints a bleak picture of the current state of application security with 85% admitting applications on average have 10 or more vulnerabilities, with nearly half saying they have on average more than 20 per application. Conducted by Contrast Security, a provider of an observability platform […]
DevSecOps: Changing AppSec for the Midmarket
The midmarket space has always been prime for innovation and opportunity. In the DevSecOps space, that is no different. If you look at this report or others about DevSecOps markets, two things stand out: The market is expected to explode to $14 billion by 2026 from today’s nominal $2 billion. The biggest driver of the […]
Runtime Security and Incident Response with Loris Degioanni
By adopting DevOps, Kubernetes and containers you can accelerate innovation and deliver a better experience for customers and employees. While Kubernetes adoption simplifies application deployment, security needs to adapt and be cloud-first, open and frictionless as a new set of complexities may surface. Check out this interview with Sysdig Founder and CTO Loris Degioanni to […]
Survey Surfaces Lots of DevSecOps Friction
A survey of 560 application security professionals and software developers in North America and Western Europe conducted by WhiteSource, a provider of tools for securing open source software, finds there’s a long way to go before most organizations can claim to have fully implemented best DevSecOps practices. Only 20% of respondents said their organization had […]
Synopsys Report Shows DevSecOps Progress
A report based on analysis of the software security initiatives of 130 organizations conducted by Synopsys, a provider of static application security testing (SAST) and software composition analysis tools, suggests progress in terms of DevSecOps adoption is being made but there is still a long journey ahead. According to the survey results, 121 organizations now […]
DeepFactor Unifies Performance and Security Monitoring for Developers
DeepFactor today launched what it describes as the first continuous monitoring platform designed specifically for pre-production environments. Company CEO Kiran Kamity said the DeepFactor Pre-Production Monitoring platform combines security, performance and behavior monitoring in one offering. Based on a “Deep Passive Monitoring” capability that requires developers to add a file to a container image to […]
Okta Offers PASETO as Alternative to JSON Tokens
Okta today launched an open source library for using Platform-Agnostic Security Tokens (PASETO) as an alternative to JSON Web Tokens (JWT) to authenticate end users. Randall Degges, head of evangelism for Okta, said PASETO is quickly emerging as an easier, more secure implementation of the JWT specification. PASETO is a draft specification created by Scott […]
RunSafe Allies With JFrog to Secure Applications
RunSafe Security, a provider of Alkemist tools that prevent memory exploits, has partnered with JFrog to create a plug-in for the Artifactory repository manager platform. Alkemist employs a combination of runtime application self-protection (RASP) and moving target defense (MTD) methods to neutralize memory corruption exploits such involving, for example, a memory overflow. Based on a […]
Traceable Secures Apps Using Distributed Tracing
Traceable this week announced it is making available under an early access program a namesake platform that combines distributed tracing and machine learning algorithms to better secure applications. Fresh of raising $20 million in funding, Traceable CEO Jyoti Bansal said the goal is to leverage distributed traces generated via open source Hypertrace agent software to […]
CNCF Elevates SPIFFE Spec to Secure App Services
The Technical Oversight Committee (TOC) of the Cloud Native Computing Foundation (CNCF) announced that the open source Secure Production Identity Framework For Everyone (SPIFFE) specification and the SPIFFE Runtime Environment (SPIRE) have become incubation-level hosted projects. Andrew Harding, SPIRE maintainer and a principal software engineer at Hewlett Packard Enterprise (HPE), said the elevation of a […]
Appian Infuses Low-Code Platform With AI
Appian this week released an update to its low-code application development and deployment platform that employs artificial intelligence (AI) to recommend best next steps, including how to address cybersecurity issues. In addition, the latest version of Appian also makes it easier to incorporate robotic process automation (RPA) modules to automate rote tasks in addition to […]
Report Finds Most Cloud Security Issues Left Unaddressed
Accurics, a provider of a platform for assessing the security of cloud computing environments, has published a report that finds that even once discovered, only 4% of issues reported in cloud production environments are addressed. Based on research conducted using its platform and other public sources of data, the report also finds 90% of organizations […]
The Best Approach to Help Developers Build Security into the Pipeline
Speed and agility are at the core of digital transformation and DevOps culture, and have quickly become a business imperative for organizations that want to remain competitive. Speed cannot come at the sacrifice of security, though. The pace of software development requires that security be baked into the code from the start rather than tacked […]
5 Ways to Detect Application Security Vulnerabilities Sooner to Reduce Costs and Risk
Security testing has always been an important step in the application development process. Yet, traditional measures often occur too late in the process to effectively find and fix vulnerabilities before causing costly production delays, or worse, putting organizations at risk for potential security breaches. To minimize security-related costs and risks, testing needs to occur sooner […]
Fortanix Adds Platform to Manage Confidential Computing on Azure
Fortanix today announced that a software-as-a-service (SaaS) platform for managing instances of confidential computing on the Microsoft Azure cloud is now generally available. Confidential computing is an emerging approach to encrypting data while it is running in memory. Today encryption is only applied to data at rest. Confidential computing makes it possible to set up […]
The Secure Software Development Life Cycle: Syncing Development and Security
Over the last five to 10 years, the nature of software development has shifted dramatically. Whereas large software releases occurred every six to 18 months in the past, current release schedules have become much more frequent. The waterfall model of software development has morphed into what we now know as the DevOps model. As a […]
Survey Surfaces Root Causes of DevSecOps Tension
Results of a survey published by SaltStack, a provider of IT automation tools, suggests tensions between cybersecurity and IT professionals on the one side and DevOps teams on the other are running high. According to the survey of 130 cybersecurity and IT leaders, 70% of respondents said their organization is sacrificing data security for faster […]
Sacrificing Security for Speed: 5 Mistakes Businesses Make in Application Development
Earlier this year, the Democratic party in Iowa announced its plans to use a smartphone app to calculate and transmit their caucus results. Using technology to improve the speed of governance, one would think, “What could possibly go wrong? A lot, apparently. The app’s failure on results day was attributed to reporting and coding issues. […]
Securing Internet-Facing Portals
Against the backdrop of the current pandemic, barely a day goes by without another portal or web application being launched to help citizens and customers interact with governments and corporations. Bringing these applications to market quickly, and ensuring they can’t compromise the security of the organization, requires DevOps to embrace news techniques and technologies. So, […]
Continuous Security Through Developer Empowerment
Every organization is embracing DevOps to one degree or another. The business impact of shipping software quickly and adapting to market needs is so immense that it has become a requirement—you’re either heading toward DevOps or heading toward bankruptcy. Yet, while our need for speed has increased, so has our need for security—and combining both […]
HashiCorp Strengthens Vault Secrets Management
HashiCorp has released an update to its HashiCorp Vault platform for managing secrets and encrypting data that now includes an internal storage option that eliminates the need to manage a separate storage backend. Version 1.4 of Vault also adds an OpenLDAP Secrets Engine, which automates the management of static entities within OpenLDAP directories, and the […]
Palo Alto Networks Advances DevSecOps in the Cloud
Palo Alto Networks has updated its Prisma Cloud to make it easier to embrace best DevSecOps processes while deploying workloads in the cloud. New capabilities include the ability to define and apply cybersecurity policies to continuous integration (CI) and continuous delivery (CD) workflows and scanning tools for discovering misconfigurations in cloud infrastructure templates, which is […]
How to Compare and Contrast APIs to Improve DevOps Processes
The cloud is driving digital transformation, from web applications to mobile applications, from partner integrations to API monetization. Even custom applications are moving into the cloud. If you draw a line through all these trends, APIs would be at the heart of it all. We know we need to eat our vegetables to keep our […]