DevSecOps Implementation: It’s About the Data
It seems we are constantly barraged with, “So-and-so announced that their systems had been breached and 80,000 user records were stolen,” notices. In fact, https://haveibeenpwned.com/ lists ten billion hacked accounts. That is no surprise. Databases exist to pool related data together. Even NoSQL type databases, which some saw as an opportunity for wildly disparate data […]
Tidelift Secures Open Source Software Supply Chains
Tidelift today announced the general availability of a platform dubbed Tidelift catalogs, through which enterprise IT organizations can more effectively manage their open source supply chains. Donald Fischer, Tidelift’s CEO, says the Tidelift catalogs platform enables IT teams to curate, track and manage open source components that have been vetted and adhere to compliance requirements […]
A Pragmatic Approach to DevSecOps
In response to market and competitive forces, many companies are using DevSecOps to develop higher quality and more secure software. Whether that software is their own product or is a component of their product, quality – and especially security – have become required rather than optional. To accommodate the security requirements, some companies have adopted […]
DevSecOps Implementation: SIEM
The world is filled with events. Our inbox floods with events that marketers really want us to pay attention to, while news feeds flood us with events they’re trying to raise above the background noise, but then, the dog barking interrupts our consumption of that information. Our family is, meanwhile, texting us about events on […]
Approaching Security as a Fundamental Element of Software Development
How we really integrate security into the SDLC? What are some of the best practices around secure software? In this episode of TechStrong TV, Jill Britton, director of compliance, and Stuart Foster, product manager at Perforce, joined us to discuss how to improve application security by making security a fundamental component of the software creation […]
A Security Vulnerability Management Guide
Living in a container-native world is not easy. Containers have a reputation for being a point of entry for security vulnerabilities for many organizations. In 2015, according to a research paper, over 40% of Docker images distributed through Docker Hub had high-risk vulnerabilities; at that time there were more than 95,000 container images hosted on […]
Guide for Software Development & Software Security
In order to ensure an efficient, secure and successful software development project, there are many factors that you and your team must consider when starting a new project. The most common and pertinent considerations for many include defining the requirements of the project, selecting the correct processes for each stage of the software development project, […]
Orchestration Emerges as Crucial DevSecOps Enabler in 2021
As DevSecOps best practices continue to evolve and mature in 2021, security orchestration is emerging as a cornerstone of a solid defense-in-depth approach to application security. DevSecOps assumes organizations will shift responsibility for application security further left toward developers. If this assumption is correct, then developers clearly need access to a range of code analysis […]
XDR: The DevOps Transformation of Security Infrastructure
eXtended detection and response (XDR) is a security technology that unites multiple security systems into one. Organizations are transitioning from traditional systems such as endpoint detection and response (EDR) and security and information event management (SIEM) to XDR, in a move that is analogous to the transition from agile to DevOps work processes. XDR can […]
KubeCon Coverage: Incentivizing the DevSecOps Culture
Just as DevOps set to de-silo development and operations teams, the DevSecOps movement is bringing security to the same table. A shift-left security mindset is permeating much discussion of late. Cyberattacks are on the rise in the era of COVID-19 and cybersecurity has become paramount to arm business-critical applications. Furthermore, new regulations have emerged to […]
Two-Part Training Required for Developers to Slay the Security Beast
Developers’ defensive qualities are only as good as the training they receive The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt. The volume of code being produced is too […]
Strengthen API Security With These Tips and Patterns
If you haven’t noticed, digital organizations are building more and more APIs. ProgrammableWeb tracks more than 23,000 public web APIs at the time of writing, and the API market is estimated to be worth $5.1 billion by 2023. Building with APIs increases internal interoperability, reduces development time and can extend product functionality tremendously. In short, […]
SaltStack Looks to Automate DevSecOps Processes
SaltStack announced today it has integrated its automation framework with a variety of third-party security platforms to further the adoption of best DevSecOps processes. Mehul Revankar, director of product management for SaltStack, said version 6.3 of SaltStack Enterprise provides integration with offerings from Splunk, Tenable, Qualys, Rapid7 and Kenna Security. Data generated from vulnerability scans […]
What Developers Really Think About Pentesting
A developer in their natural habitat is often spotted in a state of deep concentration, coding awesome features to tight deadlines. Feature-building is often our favorite part of the job, and really, it’s the fundamental outcome of the software development life cycle (SDLC). However, as we have discussed before, many of us are still prioritizing […]
DevSecOps vs. Agile Development: Putting Security at the Heart of Program Development
Despite most developers and managers being well aware of the concept of DevSecOps, it is still often confused with a number of related processes and concepts. This is particularly true for the Department of Defense (DoD) contractors because they have long been encouraged to use a related process known as agile development. Since agile development […]
The Secure Software Development Life Cycle: Syncing Development and Security
Over the last five to 10 years, the nature of software development has shifted dramatically. Whereas large software releases occurred every six to 18 months in the past, current release schedules have become much more frequent. The waterfall model of software development has morphed into what we now know as the DevOps model. As a […]
Survey Surfaces Root Causes of DevSecOps Tension
Results of a survey published by SaltStack, a provider of IT automation tools, suggests tensions between cybersecurity and IT professionals on the one side and DevOps teams on the other are running high. According to the survey of 130 cybersecurity and IT leaders, 70% of respondents said their organization is sacrificing data security for faster […]
ClickShare Vulnerabilities May Have Been Patched, But They Mask a Much Bigger Problem
I think we can all recall a time in recent memory where, in a meeting or at a conference, someone has had issues with presentation technology. It happens so often that there is almost an expectation of a clunky experience, at least initially. It stands as no surprise, then, that ClickShare’s seamless app was immediately […]
Digital.ai: The Companies Formerly Known As XebiaLabs and CollabNet Plus
Another shoe has dropped in the continuing story of TPG Capital‘s foray into DevOps. The company formed by the merger of XebiaLabs and CollabNet VersionOne is now Digital.ai. Additionally, the company has acquired Arxan, a leader in application protection. I had a chance to catch up with Digital.ai’s CEO Ashok Reddy and Arxan COO Mark […]
Filling the Skills Gap for Effective DevSecOps
With the rise of DevSecOps comes a whole new need for training and upskilling. It isn’t a secret that the cybersecurity skills gap will only continue to grow. The security skills gap combined with the rise of DevSecOps has introduced hidden challenges organizations must address. The Rise of DevSecOps While DevOps accelerates agility and scalability […]
Report Pins Cloud Security Woes on Flawed DevOps Processes
By now it’s become apparent that the bulk of security incidents involving cloud platforms revolve around some type of configuration issue. An analysis of those cloud configurations published today by the Unit 42 research arm of Palo Alto Networks suggests that the root cause of the issue is most likely the templates many developers and […]
DevSecOps: 10 Best Practices to Embed Security into DevOps
For companies that employ the agile approach, DevOps seems like a natural extension. Traditionally, enterprises started with integration, development and test automation early in the product lifecycle. Gradually, the agile delivery team took care of iterative development and monitoring practices that increase code quality. Today, organizations work in unison to bridge the gap between development […]
Raytheon Leans on Red Hat to Advance DevSecOps
Raytheon Company is partnering with Red Hat to drive the adoption of DevSecOps workflows and processes it developed around the OpenShift application development and deployment platform. Jon Check, senior director for cyber protection solutions for Raytheon Intelligence, Information and Services, said Raytheon has developed a set of DevSecOps practices for organizations building applications deployed in […]