DevSecOps: Embedding a Security Practice into your DevOps Approach
It’s a no-brainer that the element of security cannot be compromised even to the smallest of extents in today’s competitive, fast-paced, modern technology-driven IT infrastructure. However, to keep up with the rapid developments of other processes in this agile world, security is often given relatively less importance and in some cases, even left behind. As […]
Serverless: What You Need to Know
There are clear benefits to serverless architecture, with many enterprises already making or planning to make this change. Like any paradigm shift however, the move to serverless carries both benefits and risks. Here’s what you need to know. AWS pioneered the serverless space with its release of AWS Lambda back in 2014, with the other […]
Making DevOps a Reality – Bringing in Security: Top 4 Topics
I caught up with Maria Loughlin, vice president of engineering at CA Veracode; Chris Eng, vice president of research at CA Veracode; and Alan Shimel, CEO of DevOps.com, to talk more about their recent panel webinar on bringing in security to make DevOps a reality. It was enlightening to hear their perspectives on how companies […]
There’s No Such Thing as DevSecOps
Should DevSecOps be categorized separate from DevOps? After years of debate, few doubts remain about the viability of the public cloud for enterprise workloads. Enterprises are shifting to cloud-first and cloud-only strategies, looking to take advantage of all the good the public cloud has to offer. For applications built and deployed in the public cloud, […]
Aqua Security Survey Finds Sharp Rise in DevSecOps
A new survey of 80 cybersecurity professionals that attended the recent RSA Conference 2018 event finds the number of organizations that have a formal or informal DevSecOps team in place has increased by several orders of magnitude year over year. The survey, conducted by Aqua Security, finds 62 percent of respondents have a formal or […]
Using Blockchain to Advance IoT
Imagine two disruptive technologies come together to democratize transparency and connectivity in the tech world. That’s exactly what’s happening with blockchain technology, once synonymous with powering cryptocurrencies including Bitcoin, has the potential to be a disruptor in a number of verticals and the internet of things (IoT), with blockchain addressing key IoT security concerns. About […]
Don’t Forget to Automate Cloud Security
Cloud has been around long enough, and we’ve had enough breaches stemming from unsecured cloud (mostly data objects, but other items, too) that we should know better. I cringe whenever I see a security headline along the lines of “… Unsecured S3 Bucket.” Would you publicly expose a server in your data center and not […]
Continuous Discussions Video Podcast: DevSecOps, Best Practices and More
In a recent episode of the Continuous Discussions (#c9d9) podcast, a group of industry experts discussed why DevSecOps is officially more than just a buzzword, tips on how to get everyone in the organization to own security and some of their own challenges and experiences baking security into the software delivery pipeline. The panel included: […]
Reducing Risk in Applications Using Docker Containers
Docker. It seems like in this day and age you are either using Docker containers or you are going to use Docker containers. If you haven’t jumped on the bandwagon yet, check out a previous article, “Docker: The New Ordinary.” If you are on the wagon or are thinking about it but have concerns about […]
Akamai Extends Scope of DevSecOps Reach
Akamai pressed its case for becoming a strategic DevSecOps platform by adding a range of security capabilities to its network service platform that help isolate applications from cybersecurity threats. The company has added support for scripting to automate application security using its Kona Site Defender web application firewall as well as improved management and versioning […]
Building a Solid Foundation for Microservices Security
It’s often true that threats evolve faster than development practices and technologies can keep up with, which can be seen in the current microservices approach to application development. While microservices bring clear benefits to developers by enabling application deployment via modular, independently deployable services, they also open the door to new security vulnerabilities. Consequently, these […]
DevSecOps: Don’t Invest In Hope
A successful DevSecOps approach is rooted in action, not hope. There is a lot of investment in hope. I hope we won’t get breached. I hope our DevOps teams aren’t deploying thousands of vulnerable containers. I hope our developers aren’t downloading millions of vulnerable open source components. I hope our developers and security teams will […]
Barracuda Networks Survey: DevSecOps Is Hard
Organizations that have adopted DevSecOps processes may be making progress when it comes to improving cybersecurity, but it’s far from easy. A survey of 618 IT decision-makers conducted by Dimensional Research on behalf of Barracuda Networks, a provider of IT security software and appliances, finds half have adopted either DevOps, DevSecOps or a continuous integration/continuous […]
DevOps Isn’t Getting Cloud Security Right (and What Can Done About It)
The song title of Billy Joel’s 1977 hit, “Get it Right the First Time” aptly describes what DevOps teams need to take to heart when making the jump to the public cloud. But in most cases, security is lacking in the pipeline when making the shift—and a change in DevOps culture and mindset is necessary […]
DevSecOps: Deception in Depth
Mantraps, tripwires and tarpits … sounds like the start of a solid spy-movie plot, doesn’t it? These are among the many concepts of physical security that are making the crossover to software security. You’ve likely heard that security is all about defense in depth—the idea of layering several defensive measures so that their combined effectiveness […]
Integrating Security into DevOps: The Benefits and Drawbacks
The efficiency of DevOps for your enterprise will depend on the level of security you integrate in it. The integration of security into DevOps is new to many enterprises, but is highly important because the speed of DevOps can make the apps in development vulnerable to malicious attacks. This can be prevented with the help […]
DevSecOps: If You Build It, They Will Come
Spring training for Major League Baseball in the United States has begun. Millions of people share my love for baseball; however, the same can’t be said for security and compliance—well, at least not yet. Perhaps one day. Much like in the immortal baseball movie, “Field of Dreams,” if you build a friendly security and compliance […]
DevSecOps: How Security Teams Can Better Support Their Developer Counterparts
Much of the conversation around digital transformation revolves around technology. But the new wave of technology this era has ushered in has also made a big impact on the way organizations, and the teams that comprise them, function. This impact on corporate culture has paved the way for the widespread adoption of DevOps, which has […]
Chef Advances Compliance Automation
Chef today expanded the reach of its InSpec platform for automating compliance management with an update that adds support for Amazon Web Services (AWS) and Microsoft Azure public clouds, as well as integration with additional third-party tools. In total, InSpec 2.0 adds more than 30 additional capabilities, including support for Docker containers, Microsoft IIS and […]
DevOps Brings Value to Security (and Vice Versa)
Many enterprises today are implementing security solutions that can be deployed and maintained more quickly and easily, and at lower cost, using a DevOps methodology. Organizations applying DevOps to security are not looking at IT groups separately as the database team and the application team; rather they see everything as the delivery team. It’s also […]
GitLab Acquires Gemnasium to Advance DevSecOps
GitlLab, as part of its effort to extend the reach of its DevOps platform into the realm of security, has acquired Gemnasium, a provider of tools to mitigate vulnerabilities in open source code. The goal is to incorporate the IT security tools Gemnasium has developed within a single software development lifecycle (SDLC) platform, said GitLab […]
DevOps in the Cloud: Security’s Groundhog Day
Throughout the internet age, enterprise IT has given security a lower priority than qualities such as speed-to-deployment, scalability, availability and usability. We first saw this in the late 1990s and early 2000s, when IT teams rushed applications onto the web. Amid the glee surrounding the potential of fancy new internet architectures, few thought about the […]
CA Technologies Survey Uncovers DevSecOps Challenges
When it comes to infusing security concerns into a DevOps culture, most organization still have a very long way to go. A global survey of 1,279 IT leaders conducted by the market research firm Freedom Dynamics on behalf of CA Technologies finds more than half of respondents (58 percent) cited existing culture and lack of […]