DevOps Leadership Series 2015: Women & Diversity
Many of the leading minds and practitioners in the DevOps movement are women. I hope that comes as no surprise to you. DevOps has always embraced a diversity of thought and contribution. Case in point, close to 50% of the presenters at this year’s DevOps Days Boston event were women. In this episode of […]
DevOps Leadership Series 2015: Women & Diversity – a diversity of thought and contribution
Many of the leading minds and practitioners in the DevOps movement are women. I hope that comes as no surprise to you. DevOps has always embraced a diversity of thought and contribution. Case in point, close to 50% of the presenters at this year’s DevOps Days Boston event were women. In this episode of […]
Bring Your Own Exploit
Here’s a simple question: for each tool that your organization uses, have you (or someone else on your DevOps team) changed the default passwords? That should be a no-brainer, shouldn’t it? Of course you changed them! Or at least you changed them for the tools that looked like they would have default passwords. Well, OK, […]
Security at the Speed of Innovation
With the advent of the cloud and platform as a service (PaaS) offerings, developers are innovating faster than ever. But with this rapid pace comes risk. Companies quickly implement new apps to meet their business demands, but the increasing complexity of the infrastructure being used – both in the cloud, on premise, or a hybrid […]
Sleep easy: release automation reduces DevOps security threats
Sleep easy: release automation reduces DevOps security threats “Devops reigns”. “DevOps redefines the way services are launched and managed”. Just two of the recent headlines from the sea of coverage on DevOps. It’s a reasonable argument. The software development methodology emphasizes communication and collaboration between software developers and other IT professionals, and is quickly gaining […]
What is Adaptive Security?
72 days after the fact AdultFriendFinder.com, a “very mature” dating site, realized they had been hacked. The VERY personal information of 3 million registrants has been held hostage. By now, it should be clear that in the modern software development world, old-style static security just won’t work. Of course, there are times when the static security […]
The DevOps and Security Manifesto
Early in Illumio’s history, I saw the future of DevOps security. The CISO of an electronics manufacturer brought us in to help secure a new support service that was built entirely in the cloud. After meeting with the security team, we were introduced to the application development team who cast a cold eye on our […]
Enterprise DevOps: Standardize for Security
Etsy is a shining example of the success that can be achieved with continuous delivery (CD). By 2014 Etsy had doubled its deployment rate, deploying more than 50 times a day. Today the site deploys API changes in 18 seconds and launches a new website every 150 seconds. That’s speed, to be sure. Speed that […]
Welcome to the ADC (After DevOps Connect) era of DevOps and Security
I was speaking with Britta Glade of RSA Conference after our DevOps Connect conference at RSA Conference Monday. She congratulated us on putting together a great day of tracks and sessions (kudos to Gene Kim and Josh Corman). But then she said something else that really struck me to my core. She said after today […]
Security and DevOps: the horses are finally here
It doesn’t seem like it was so long ago when it was actually difficult to find enterprises and experts who could speak – from experience – about having successfully managed security in a DevOps environment. Sure, they existed, but they were primarily the so-called “unicorns:” web-based enterprises that had little of the legacy infrastructure in […]
DevOps Security Talks At RSA USA 2015 Conference
DevOps and security. Its a muddled mix of waters made even more confusing by the wet ink still on the concept of DevOps. There is no denying the popularity of DevOps and there is a lot of talk on how the DevOps movement functions alongside security teams. The annual USA RSA conference is just around […]
Automated Security Testing in a Continuous Delivery Pipeline
Automated unit, integration and acceptance tests are essential quality controls in running a reliable continuous integration or continuous delivery pipeline. Too often, security tests are left out of this process because of the erroneous belief that security testing is solely the domain of leather-jacket-wearing security experts. Security testing does not need special treatment We’ve made […]
Linux Containers & Security Implications
Does the word “container” intimate containment, suggesting that containers are inherently secure? If it does, any such assumption of security may be the broadest Docker vulnerability to date. “One of the biggest threats I see with Docker is its positioning and the implied security in the language. The reality is that these containers don’t contain […]
Dev and Ops Coming Together To Combat the Weakest Security Link – BYOD
Traditionally, security threats have taken the form of intentional acts by remote attackers: somebody on the outside working covertly to get to the inside. This is the classic scenario that most people associate with IT security, and it’s what most network operators are best prepared for. But these classic threats are eroding rapidly in the […]
To Be or Not to Be – Shadow IT
Is it being an innovator, or demonizing business decisions to use other vehicles, and cry foul? Sun Tzu, the famous Chinese strategist and philosopher, once said, “If ignorant both of your enemy and yourself, you are certain to be in peril.” These words ring true to the quandary that traditional IT organizations find themselves in […]
Security Should Be the Top Driver for DevOps
I’ve often said that the driving factor for many companies in adopting a comprehensive information security program are the dreaded “F” and “A” words – FUD and Audit. Technically FUD is an acronym for fear, uncertainty and doubt. And it might be better said that audit is the action used to hopefully demonstrate compliance and […]
Gartner gives Docker security an ambivalent thumbs up
As organizations continue to evaluate wider spread use of containerization to enable continuous deployment, security concerns around the wildly popular Docker keep popping up. Last week, an analyst with Gartner published a report that gave Docker security positive marks with some big caveats. Written by Joerg Fritsch, the report examined the security properties of Docker. […]
Webinar: Security & DevOps in 2015
The intersection of Security and DevOps. What does 2015 hold in store? Organizations are under increasing pressure to do more, faster. But cybersecurity breaches by criminals, hacktivists and state sponsored actors have cast a shadow over large portions of our IT infrastructure. How can security and DevOps in tandem make us safer while allowing us to […]
Automating Away the Regulatory Compliance Myth
At the recent DevOps Enterprise Summit, we had a chance to sit down with Justin Arbuckle and discuss his concept of “compliance as code” and why it’s so important that security and compliance tests be built into DevOps practices at large enterprises. Recently, Arbuckle was chief architect at GE Capital where he introduced and sponsored […]
Webinar: What DevOps Need To Know About Web App Security
You’ve seen the headlines— With Global Presence Falls Victim to Hackers. These data breaches result in the theft of millions of names, passwords, credit card numbers, and other personal data. Imagine the consequences of a breach leading to the theft of your confidential data. . . If multi-national companies with dedicated security teams and expansive […]
Moving Security To the Left In a DevOps World
Moving security to the left has become a coined phrase meant to describe the process of getting the security team involved earlier in a process. Most typically, the phrase is used in conjunction with IT or software development projects. One of the top suggestions for ensuring security in a DevOps world is to move security […]
Ensuring security and managing risk in enterprise DevOps
Today’s question in this recurring series comes from a developer in a typical large enterprise – risk averse, tightly controlled, highly secured – a major challenge to any DevOps transformation: Q. I work in a large government department that is tight on security. We have strict policies on separation of duties, can’t share users IDs […]
Internet of Things (IoT) poses challenges for DevOps and security
One of the hottest things in tech today is the Internet of Things (IoT). Everything will be connected including every gadget, kitchen appliance, wearable device and vehicle. But one of the biggest areas for IoT are controllers embedded into just about everything. These controllers will report back, generating reports and information that can be analyzed […]