DevSecOps Implementation: It’s About the Data
It seems we are constantly barraged with, “So-and-so announced that their systems had been breached and 80,000 user records were stolen,” notices. In fact, https://haveibeenpwned.com/ lists ten billion hacked accounts. That is no surprise. Databases exist to pool related data together. Even NoSQL type databases, which some saw as an opportunity for wildly disparate data […]
DevSecOps Implementation: EDR/XDR
We mentioned host intrusion detection and network intrusion detection in an earlier blog, and mentioned firewalls a couple of times in passing. Let’s delve a bit into the history to understand how these tools’ functionality has evolved over time. On the host side, we had virus detection, in one form or another, from early in […]
DevSecOps Implementation: SIEM
The world is filled with events. Our inbox floods with events that marketers really want us to pay attention to, while news feeds flood us with events they’re trying to raise above the background noise, but then, the dog barking interrupts our consumption of that information. Our family is, meanwhile, texting us about events on […]
DevSecOps Implementation: Intrusion Detection
Originally, this series was just going to be four articles on the DevSec side of DevSecOps. There are many reasons for this, but primarily because that side is cleaner. The other reason is that these topics are beyond the work we were doing at Accelerated Strategies Group. But we’ve had a number of requests to […]
DevSecOps: Bringing Compliance to DevOps
In today’s fast-paced business environment, the division of DevOps and SecOps must be bridged to create DevSecOps Now that the “X-as-a-service” model has taken hold, enterprise infrastructure, integration and solution delivery has accelerated rapidly. Waterfall methodology has given way to the Agile framework of rapid, continuous development and delivery. This necessitates the use of automation […]
Cloud Growth and Other 2020 Trends
Growth continued this year as even the COVID pandemic could not slow down the cloud The rise of COVID-19 defined 2020 for nearly every industry. Cloud computing is no exception, though growth in the sector continued this year. Gartner estimates that $257.9 billion will be spent on public cloud services in 2020, up 6.3% from […]
XDR: The DevOps Transformation of Security Infrastructure
eXtended detection and response (XDR) is a security technology that unites multiple security systems into one. Organizations are transitioning from traditional systems such as endpoint detection and response (EDR) and security and information event management (SIEM) to XDR, in a move that is analogous to the transition from agile to DevOps work processes. XDR can […]
Speed and Security: How to Find a Balance in Development
Time management can help developers realize the necessary combination of security and speed in application development As software continues to create competitive advantages and market differentiation for organizations focused on successful digital transformation, developers will continue to be measured by how fast they can develop and release code. Business leaders encourage DevOps teams to push […]
How to Foster Collaboration Between DevOps and Security
DevOps is on the rise. Back in 2018, MarketsandMarkets wrote that it expected the DevOps market to grow to $10.31 billion by 2023. That’s up from $2.90 billion in 2017, with a compound annual growth rate (CAGR) at 24.7% projected for the forecast period. Demand for DevOps solutions and services in response to the need […]
Why Secrets Management is Critical to DevOps Pipeline Security
While valuable, secrets management also can be difficult for DevOps teams to employ. Here’s what you need to know Business is all about speed. Companies want to innovate and deliver functionality faster to remain competitive. This explains the increasing popularity of DevOps as a go-to model for rapid application delivery. A recent Gartner report indicated […]
Securely Streamline Code Signing for DevOps and DevSecOps
Introducing code-signing provides security within the application, but teams should take care to understand and implement the process effectively Digital certificate management, with hundreds or thousands of certificates required to support IT infrastructure, can easily lead to degradation of application integrity and unnecessary risk to the business. The cumbersome nature of siloed teams manually managing […]
KubeCon Coverage: Incentivizing the DevSecOps Culture
Just as DevOps set to de-silo development and operations teams, the DevSecOps movement is bringing security to the same table. A shift-left security mindset is permeating much discussion of late. Cyberattacks are on the rise in the era of COVID-19 and cybersecurity has become paramount to arm business-critical applications. Furthermore, new regulations have emerged to […]
Gravitational Becomes Teleport to Streamline Access Management
Gravitational today announced it has changed its name to Teleport and launched the Teleport Unified Access Plane, an open source security gateway that comes in the form of a single binary that acts as a proxy for remotely accessing Linux servers and Kubernetes clusters. Teleport Unified Access Plane (UAP) for managing those gateways can be […]
Two-Part Training Required for Developers to Slay the Security Beast
Developers’ defensive qualities are only as good as the training they receive The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt. The volume of code being produced is too […]
20/20 Network Visibility: Making Cloud Migration a Success
Organizations need to take a considered and gradual approach to cloud migration to ensure security and compliance For businesses to succeed in 2021 and beyond, agility and responsiveness are critical. Data is the new currency, and businesses need to be able to access theirs instantly and securely to make the rapid-fire business decisions that will […]
OpenSSF Makes Free Security Training Available
The Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, is providing free security training for developers building and employing open source software starting later this week as part of an overall effort to advance best DevSecOps practices. Linux Foundation CTO Chris Aniszczyk said the Secure Software Development Fundamentals professional certificate program along […]
How Service Mesh Enables a Zero-Trust Network
How can we achieve high-grade security within a microservices ecosystem? Service mesh may be the answer Enterprise applications often assign an identity to humans to determine security clearances. Using standards such as OpenID Connect and SAML, we can delegate authorization scopes across a suite of applications to determine precisely what a user is permitted to […]
Using PAM to Support the ‘Sec’ in DevSecOps
Despite its reputation as slow and complex, PAM can be included in the DevOps pipeline effectively The introduction of DevOps practices has led to a revolution in software development. However, as companies adopt these new technologies, tools and methodologies, incorporating privileged access management (PAM) becomes increasingly complex. Nonetheless, corporate policies, industry standards and government regulations […]
Datadog Allies with BigPanda on AIOps
BigPanda Inc. and Datadog today announced they will integrate their respective platforms to make it easier to form artificial intelligence for automating IT operations (AIOps) to consume data generated by the Datadog IT monitoring service. The two companies are pledging to invest in a go-to-market partnership to create a comprehensive platform for monitoring, analytics and […]
ZeroNorth Extends DevSecOps Orchestration Reach
ZeroNorth has extended its namesake software-as-a-service (SaaS) platform for orchestrating DevSecOps toolchains to include integrations with Scout Suite, Aqua Trivy, Gitlab and BitBucket Server and the configuration management database (CMDB) from ServiceNow. The company is also adding application portfolio reports to surface the security policies applied to each application, scan results and progress of remediation […]
Strengthen API Security With These Tips and Patterns
If you haven’t noticed, digital organizations are building more and more APIs. ProgrammableWeb tracks more than 23,000 public web APIs at the time of writing, and the API market is estimated to be worth $5.1 billion by 2023. Building with APIs increases internal interoperability, reduces development time and can extend product functionality tremendously. In short, […]
Survey Surfaces Lots of DevSecOps Friction
A survey of 560 application security professionals and software developers in North America and Western Europe conducted by WhiteSource, a provider of tools for securing open source software, finds there’s a long way to go before most organizations can claim to have fully implemented best DevSecOps practices. Only 20% of respondents said their organization had […]
Low-Code, High Risk? Closing the Security Gap of Exposed Source Code
There’s no denying that low-code is a rising trend in application development that’s likely to stay for the long run. Its impressive benefits in terms of agility and development time are convincing the enterprise, so it’s no wonder that the industry is on its course to achieve fivefold growth between 2017 and 2022. In low-code […]