Vulnerability Management for DevOps Teams: A Practical Guide
The goal of vulnerability management is to close the gap between discovery and resolution, thereby minimizing the window of opportunity for potential cyberattacks.
How Encryption Innovation Will Power Cloud Privacy for Developers in 2024
With new encryption technologies rapidly advancing, developers can ensure their applications are secure.
CISA, NSA Issue Supply Chain Security Guidance Report
The NSA, ODNI and CISA have issued guidance to assist software developers and suppliers in shoring up software integrity and security.
Survey Surfaces Software Supply Chain Security Challenges
While there is general agreement on the importance of software supply chain security, there is a significant disconnect on how to achieve that goal.
3 Steps to Secure Your CI/CD Pipelines
Palo Alto Networks’ Daniel Krivelevich shares a general three-step framework organizations can use to secure the CI/CD pipeline and surrounding areas.
Summit Highlights Open Source Software Security Progress
The OpenSSF hosted a Secure Open Source Software (SOSS) Summit 2023 event during which it made available a Secure Open Source Software Vision Brief 2023.
Survey Surfaces Spike in Generative AI Usage Across IT
A survey of DevOps and SecOps leaders found nearly all are making use of generative artificial intelligence (AI).
Styra Makes Source Code Available for Enterprise Edition of OPA
Styra is making the Open Policy Agent (OPA) enterprise code available under a license that enables IT teams to modify or change the underlying code as they see fit.
Snyk Survey: AI Generating More Vulnerabilities in Code
A Snyk survey finds the use of artificial intelligence (AI) to write code is creating a software security paradox.
Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery
The fusion of DevSecOps and trusted application delivery can extend the GitOps pipeline and add business value.
JFrog Adds Curation Capability for Open Source Software Components
JFrog is adding a curation capability for open source software that will use metadata generated by binaries to identify malicious packages and software components with licensing issues.
Unleashing the Power of AI-Engineered DevSecOps
In my recent article Revolutionizing the Nine Pillars of DevOps with AI-Engineered Tools, I explained that AI-engineered tools can help implement the portion of continuous security practices known as DevSecOps. DevSecOps involves integrating security practices into the DevOps workflow. AI can be used in anomaly detection to identify potential security threats and to automate security […]
Atlassian Advances DevSecOps via Jira Integrations
Atlassian announced today it has allied with Snyk, Mend, Lacework, Stackhawk and JFrog to make it simpler to aggregate vulnerability data within the Jira project management software that many organizations rely on to manage application development and deployment efforts. Andrew Pankevicius, a senior product manager for Atlassian, said the collaborations will make it easier to […]
How DevSecOps Addresses Supply Chain Security
“The absence of security in the initial stages of system engineering is the single most significant cybersecurity gap and risk in modern system development.” This quote from tech entrepreneur Linda Rawson is a good reminder for the current cybersecurity threat situation. With software supply chain attacks increasing in aggressiveness and sophistication, organizations need to understand […]
Report: Most IT Teams Can’t Fix Open Source Software Security
Lineaje, a provider of a platform for securing software supply chains, today published an analysis of 41,989 open source components embedded in the top 44 popular projects managed by the Apache Software Foundation (ASF). That analysis found more than a quarter (26%) of vulnerabilities are not patchable by the application development team that deployed them. […]
New Relic Bolsters Observability Platform
New Relic has updated its observability platform to include the ability to better detect and track errors in addition to monitoring vulnerabilities. At the same time, an instance of the New Relic observability platform that runs natively on the Microsoft Azure cloud platform is now also generally available. Manav Khurana, general manager for observability product […]
Software Supply Chain Security Debt is Increasing: Here’s How To Pay It Off
Last year, the world woke up to the software supply chain dilemma. We saw a spike in attacks as hackers sought to exploit known and unknown vulnerabilities within dependencies. There is also the chance of typosquatting, and malicious code commits to consider. Such supply chain attacks have increased by a shocking 742% over the past […]
Standardizing Federal Cybersecurity With DevSecOps
DevSecOps is having a moment in the federal government. With President Biden’s Executive Order on Improving the Nation’s Cybersecurity and federal agencies’ issuance of DevSecOps best practices based on the Enduring Security Framework, government organizations are shoring up and standardizing their DevSecOps processes to meet today’s cybersecurity challenges head-on. Integrating security into the development process […]
Making SBOMs Actionable
A software bill of materials (SBOM) is a list of all the software components found in a given codebase or used in a given software build. Great. So, now what? Why do we even care about SBOMs? Those are great questions—because in and of itself, the SBOM doesn’t really do anything; it is simply a […]
JFrog Adds Module to Better Secure Software Supply Chains
JFrog today added a JFrog Advanced Security module to its Artifactory repository that enables DevOps teams to scan both binaries and source code for vulnerabilities and misconfigurations. Stephen Chin, vice president of developer relations for JFrog, said that approach will enable DevOps team to ensure applications are secure before they are deployed in a production […]
Implementing Data-Driven DevSecOps
Right now, the way DevSecOps is typically implemented doesn’t fit with the rapid and agile DevOps CI/CD pipeline at all. It’s like applying 19th-century firefighting methods to a modern forest fire. Back then, firefighters employed a “bucket brigade,” where they would form a queue and pass buckets from one hand to another to put out a […]
GraphQL: Security by Obscurity Just Isn’t Enough
The debate about how to secure GraphQL rages on. Many organizations are hesitant to adopt GraphQL for public-facing APIs as there is no precise method to handle authorization concerns as of yet. Without a role-based access layer to enable fine-grained permissions for each field (and underlying services that GraphQL might wrap), the query language can […]
Endor Labs Applies Graph Analysis to Secure Software Supply Chains
Endor Labs exited stealth mode today to launch a platform that applies graph analysis to identify the depth of dependencies that exist within an application. Fresh from raising $25 million in funding, Endor Labs CEO Varun Badhwar said the Dependency Lifecycle Management Platform makes it simpler for organizations to manage dependencies within applications that can […]