Survey Sees Limited DevSecOps Progress Being Made as Vulnerabilities Mount
A recent survey found that, on average, organizations have 55.5 security vulnerabilities each day in their remediation queue, with at least one critical.
Avoiding Mistakes in Multi-Cloud Configurations
Knowing how to configure multiple clouds mistake-free is essential to keep the promise of multi-cloud alive.
Snyk to Add ASPM Platform via Enso Security Acquisition
Snyk this week announced it plans to acquire Enso Security, a provider of an application security posture management (ASPM) solution that tracks events and analyzes metadata collected from DevOps and security tools. At the same time, Snyk revealed it has added a DeepCode AI Fix tool that creates validated fixes for code written by either […]
AppSec in the Cloud: What DevOps Teams Should Know
Cloud application security refers to the measures and controls that are put in place to protect cloud-based applications and data from cyberthreats, unauthorized access and data breaches. These measures can include technical controls such as encryption, access controls and secure networks, as well as operational controls like policies and procedures for managing and securing data […]
The Missing Link in DevOps Cloud Security
We’ve all seen the data from the latest Verizon Data Breach Incident Report that shows half of security breaches stem from credential abuse. It’s clear that credential compromise is an epidemic in cybersecurity and can be largely avoided with multifactor authentication and least-privilege policies. Misused credentials have shot up by almost 30% over the last […]
Techstrong TV: The Future of Cloud Security
Check Point Software has announced the acquisition of Spectral, an Israeli start up specialized in automated code security. This further reinforces Check Point’s commitment to cloud security. The video is above and a transcript of the conversation is below. Interviewer: Hey everyone, welcome to another segment here on Techstrong TV. I’m really […]
JFrog Aligns With AWS to Improve Cloud Application Security
At the AWS re:Inforce event this week, JFrog announced it integrated its JFrog Xray software composition analysis tool with AWS Security Hub, a cloud security posture management (CSPM) service that alerts IT teams whenever a security issue is detected. In addition, JFrog also announced it is participating in a preview of an AWS Marketplace Vendor […]
Orca Security Adds CLI to Improve Cloud Security
Orca Security has extended its cloud security platform via a command-line interface (CLI) that makes it simpler to integrate with a wide range of DevOps tools. Rather than relying on agents, the Orca Security platform creates a risk profile using read-only access to block storage accessed via a runtime hosted on Amazon Web Services (AWS), […]
Why DevSecOps Should Be Top Priority
DevOps culture and process are integral to maintaining the pace of cloud-native software development for organizations, especially when code deployments might take place many times a day. The ability to instantly create, populate and scale cloud applications and infrastructure, often automated through code, allows enormous agility and incredible speed. But moving this quickly means security […]
Progress Expands Scope of Compliance-as-Code Capabilities
Progress this week extended its DevSecOps portfolio—built atop the Chef automation framework it acquired in 2020—to now include the ability to programmatically address compliance mandates. At the same time, Progress has updated the Progress Chef InSpec framework for automating the discovery of compliance issues to add support for SAP ASE, IBM DB2, Mongo, Cassandra, Oracle, […]
Datadog Unfurls Application Security Service
Datadog, Inc. today made generally available an Application Security Monitoring (ASM) service that is based on the same agent software that many DevOps teams already use to monitor applications. Pierre Betouin, vice president of product for the cloud security platform at Datadog, said ASM is designed to make it simpler for DevOps teams to add […]
Radware Embraces APIs to Improve AppSec Across Multiple Clouds
Radware this week launched an application programming interface (API) approach to securing multiple clouds designed from the ground up to be an extension of a DevSecOps workflow. Eyal Arazi, a senior product marketing manager in Radware’s security group, said that Radware SecurePath makes it possible to invoke any of the company’s cloud security offerings via […]
Understanding SaaS Security for DevOps
As Software-as-a-service (SaaS) and DevOps adoption grew, new teams were formed to address emerging security challenges. Traditional solutions weren’t built to detect the new vulnerabilities in the cloud and created excessive noise for an already stressed pool of resources. The combination of emerging zero-day vulnerabilities and an avalanche of false-positives ends up increasing security […]
Merging Secrets Management and Configuration
Fresh from picking up $5.25 million in funding, CloudTruth CEO Greg Arnette talks with Mike Vizard on this episode of the View With Vizard about why configuration and secrets management need to converge. The video is below, followed by a transcript of the conversation. Announcer: This is Digital Anarchist. Mike Vizard: Thanks for the throw. […]
EP 24: Cloud Performance Testing
The purpose of cloud performance testing is to identify and eliminate performance bottlenecks that might occur within an application. Performance testing allows DevOps teams to check the speed, scalability and stability of the apps to ensure that everything is working as planned under the designated workload. In this episode of DevOps Unbound, Kristen Webb (Tricentis), […]
CIS Benchmarks: DevOps Guide to Hardening the Cloud
DevOps and cloud computing have become inseparable. But while the cloud started as primarily a dev/test environment — without stringent security and availability requirements — it has evolved into a mature platform for running production workloads. Moreover, devastating supply chain attacks like SolarWinds and Kaseya taught us all that development environments must also be secure. […]
Mastering the Shared Responsibility Model
It’s no secret that cloud-native application development is growing exponentially, with Agile development, IaaS and PaaS from providers like Amazon, Microsoft and Google, enabling innovation at a pace that is challenging for security to keep up with. A global pandemic and the resulting remote work mandates have only accelerated this movement. And with this change […]
CloudBees Acquires Neuralprints to Shift Compliance Left
At the online DevOps World 2021 conference today, CloudBees revealed it has acquired Neuralprints to provide the core technology for CloudBees Compliance, a real-time compliance and risk analysis platform that it will roll out in the first quarter of 2022. At the same time, CloudBees has enhanced the feature management capabilities of its namesake continuous […]
Cloud Security Requires Shared Responsibility
The Growth of Public Cloud and the Need for Cloud Security Since 2006 when Amazon first introduced EC2 — the first public cloud service — cloud has become a major staple of enterprise information technology strategy. Both Infrastructure as a Service (IaaS) and newer cloud services continue to grow robustly. Enter the need for cloud security. […]
Open Your Ears and Get Ready to Listen: Cloud-Native Days with Kubernetes
If you think all the way back to primary and secondary school, you may remember hearing something like, “open your ears while your teacher is talking to you.” It’s true that someone tuned in to listening learns more than someone who doesn’t, but opening your ears is a lot more important than that. Open ears […]
Mark Your Calendars and Meet the Best in Tech at Cloud-Native Days with Kubernetes
After over a year of dreaded isolation, many of us are ready to return to the networking and social atmosphere of pre-COVID life. While physical proximity continues to be a struggle, virtual proximity through events like virtual summits and teleconference meetings, is getting increasingly more helpful amidst the transition. Here are the top 10 reasons […]
Learning from Loris Degioanni: Cloud-Native Days with Kubernetes Virtual Summit
Keeping up with information can be challenging. With all these changes, you’re probably left wondering, “who can guide me through all this information?” Fortunately, Cloud-Native Days with Kubernetes is focused on giving attendees the tools they need to become proficient in cloud-native technologies. At the virtual summit, attendees can tune into our expert-led featured sessions […]
Fugue Aims to Simplify Securing Infrastructure-as-Code
Fugue today unveiled a 1.0 release for Regula, an open source policy engine for infrastructure-as-code (IaC) security that comes with prebuilt libraries for implementing hundreds of policies that validate configurations on Amazon Web Services (AWS), Microsoft Azure and Google Cloud services. Regula is based on the Open Policy Agent (OPA) software being advanced under the […]