A Developer’s Guide to CCPA, GDPR Compliance
Here’s what developers need to know to ensure compliance with the two biggest privacy laws The digital landscape is continuously evolving, and privacy regulations such as CCPA (California Consumer Privacy Act) and the European Union’s GDPR (General Data Protection Regulation) are in effect to give consumers their fundamental right to data privacy. These regulations force […]
3 Reasons Why Traceability Should Be a DevOps Priority
Traceability in DevOps is about ensuring clarity, accountability and the best possible end product for customers There’s a lot to think about when it comes to mobile DevOps. For a start, there’s the need for effective cooperation between members of different teams, perhaps even via team collaboration software for remote workers. With so many people […]
Puppet Adds CIS Benchmark Compliance Service
Puppet this week announced it has added a service that makes it easier to achieve compliance with benchmarks defined by the Center for Internet Security (CIS). Yasmin Rajabi, global services strategy manager at Puppet, said the CIS Service offering from Puppet extends the ability to manage infrastructure as code into the realm of compliance. Via […]
Despite Downturn, Enterprise IT Budgets Remain Intact
A survey of 137 IT operations leaders at companies in the U.S with at least 500 employees and an annual IT budget in excess of $5 million finds a surprising amount of resiliency at the beginning of the COVID-19 pandemic. Conducted April 1 by OpsRamp, a provider of IT operations tools, the survey finds more […]
Embracing the Journey to Public Cloud
One of the fascinating competitions in today’s business world is the one between the digital disruptors—companies whose business vision is rooted in technology and driven by the cloud—and the so-called incumbents. One sector where this competition is particularly intense is financial services. In this sector, the digital-first companies typically don’t compete with banks and other […]
Achieving Full Disk Encryption and PCI Compliance
Full disk encryption (FDE) is a critical security measure in today’s modern networks. With data security being more critical than ever, many IT admins are wondering how they can enforce full disk encryption across their fleets of cross-platform systems. Many organizations are also subject to compliance regulations including PCI DSS, which require FDE as a […]
Automation Hacks for DevOps Teams
DevOps teams are expected to do more work in less time. They need to plan, test, build, secure and release applications at a fast-paced rate. Of course, the DevOps team needs to achieve all of this while maintaining high software quality. This is why automation is a crucial part of the DevOps workflow. The goal […]
Positioning Compliance as a Differentiator
As the threat landscape has become more perilous and complex, regulators have imposed a wide array of mandates designed to protect sensitive personal information. For most organizations, compliance is seen as the cost of doing business. However, if executed strategically it can not only improve a company’s overall security posture but shortens sales cycles and […]
How to Use DevOps for Compliance
Picture this: You’ve been working in an organization’s IT department for a couple of years and tasks have become quite a routine. Some documentation here and there, code reviews, end-user training, routine meetings with the developers and so on. You can do literally everything with your eyes closed. Then, all of a sudden, the company […]
CircleCI Achieves SOC 2 Compliance for DevOps Platform
CircleCI has achieved a SOC 2 compliance rating for the DevOps platform it makes available via a software-as-a-service (SaaS) model. Tad Whitaker, security manager at CircleCI, said CircleCI is the first provider of a SaaS platform for DevOps that has invested the hundreds of thousands of dollars required to achieve SOC 2 compliance. SOC 2 […]
Chef Achieves Multiple Compliance Mandates
Chef today announced it will make it easier for organizations that adopt its IT automation framework to stay compliant with mandates such as the Federal Information Processing Standards (FIPS), Secure Technical Implementation Guidelines (STIG) and the Center for Internet Security (CIS) certification. John Snow, senior software development engineer and federal content lead for solutions engineering […]
What It Really Takes to Build Compliant Apps
If you search online for “software compliance,” you’ll be met with a seemingly endless lineup of blog posts, how-tos and explainer articles promising to tell you everything you need to know about writing and deploying software in a compliance-friendly manner. Some of those are good resources, especially the ones that delve into meeting specific compliance […]
CloudBees Further Extends Jenkins CI/CD Reach
CloudBees announced it is expanding the scope and reach of its Jenkins open source continuous integration/continuous development (CI/CD) platform into the realms of compliance and serverless computing frameworks. Announced at the DevOps World | Jenkins World conference in Nice, France, a new plugin for Jenkins adds support for the AWS Serverless Application Model (SAM) defined […]
Chef Extends Scope of Compliance Automation
Chef has extended the reach of its InSpec compliance automation framework by adding a plug-in architecture that makes it easier for developers to programmatically generate compliance controls that can be applied to automation frameworks. The Terraform configuration management framework developed by HashiCorp is the first framework supported via the plug-in architecture. InSpec previously was integrated […]
Don’t Forget to Automate Cloud Security
Cloud has been around long enough, and we’ve had enough breaches stemming from unsecured cloud (mostly data objects, but other items, too) that we should know better. I cringe whenever I see a security headline along the lines of “… Unsecured S3 Bucket.” Would you publicly expose a server in your data center and not […]
Has DevOps Caused the Re-emergence of Shadow IT?
Shadow IT is back, and this time, it’s in the DevOps toolstack “One of our clients conducted an audit and found more than 10,000 Jenkins instances across their IT landscape!” This remark from a tooling vendor that helps enterprises centralize their continuous integration infrastructure really took me by surprise. For starters, I was impressed how […]
Software Liability Goes Global
This month, France turned up the conversation on software liability for manufacturers who place known defective software components in their products. But, they are not the first. Software Liability in France According to Lukasz Olejnik, lawmakers in France just suggested a desire to “put the security liability in hands of product suppliers. In other words, making […]
Automation Levels the Playing Field for Continuous Compliance
At this point, I doubt there is any company doing business anywhere that doesn’t fall under at least one compliance framework. One universal truth of compliance—in intent, if not in practice—is that it is a process, not an event. Checking boxes and passing an audit is a requirement of most compliance mandates, but the real […]
Chef Advances Compliance Automation
Chef today expanded the reach of its InSpec platform for automating compliance management with an update that adds support for Amazon Web Services (AWS) and Microsoft Azure public clouds, as well as integration with additional third-party tools. In total, InSpec 2.0 adds more than 30 additional capabilities, including support for Docker containers, Microsoft IIS and […]
Survey: Not Much Compliance Progress in DevOps World
A survey of 1,500 customers conducted by Chef illustrates the lacking state of DevSecOps in the enterprise today, finding that nearly three-quarters of IT organizations still manually assess whether applications comply with various regulations before being deployed to production. Worse yet, half the respondents also manually remediate any issue once it arrives, which takes days […]
Why DevOps Principles Fit Well in Highly Regulated Industries
DevOps is best suited to digital start-ups with minimal regulation and few restrictions, right? Initially the DevOps movement stemmed from the agile, innovative, born-on-the-web companies that were able to change their way of working quickly. However, the principles and practices are completely transferrable to all organization types. This includes those at the other end of […]
DevOps Chat: Chef Habitat Project Continues to Mature
When Chef Habitat was released a little more than two years ago (good devopsy.kinsta.cloud story on Habitat here and a good DevOps Chat on it here), many people in the DevOps community wondered where Chef was going with Habitat. It was a really ambitious vision, but could it meet its lofty goals? Habitat is now […]
It’s Time to Break Up with Your WAF
If the only reason you have a web application firewall (WAF) is for compliance, you deserve better. It’s time to replace it with something that provides not only compliance, but real security value as well. In the land of web application security, there are a few not-so-well-kept secrets, arguably none bigger than this: The WAF […]