DevSecOps Guide
DevSecOps is the DevOps community’s approach to bringing security into the development lifecycle. Businesses want to deliver software, but cannot afford to release unreliable or insecure applications— therefore security needs to be baked in much sooner than it has traditionally been.
DevSecOps shifts security ‘left’ to find and fix vulnerabilities earlier in the software development life cycle. It includes the benefits of DevOps such as developing, deploying and delivering new features at a rapid pace, but it also provides a more proactive approach to identifying and addressing bug in real time to bring security risks significantly down.
Just like DevOps, culture will remain a barrier to a successful DevSecOps solution. In addition to bringing the developers and operation teams together, now they need to figure out how to work with the security team towards the same goals and objectives. Bringing the security team in sooner will help them understand the code and work with the development team in a more productive manner.
SD Times news digest: Qualcomm’s first AR reference design, GitLab 13.9, and Sider’s new programming language support
Qualcomm has announced it’s first augmented reality reference design. The new Qualcomm Snapdragon XR1 AR Smart Viewer Reference Design aims to reduce commercialization time for OEMs to deliver high-quality immersive experiences. According to the company, users get a 30% reduction in overall power consumption in the system, the 2D app framework provides a systems-level feature … continue reading
SD Times news digest: OpenSSF lays out new technical vision, Anchore and GitLab on DevSecOps, and ActiveState’s new funding for security-first development
Since inception last year, the Open Source Security Foundation (OpenSSF) community has been focused on helping developers use and share high-quality software with security handled proactively. As a continuation of its commitment, the foundation is creating a Criticality Score as well as a Security metrics dashboard for open-source projects that will help prioritize which open-source … continue reading
Developers take a larger role in security
As companies shift their businesses to engage with customers online, developers are becoming a center point for innovation. So as these companies build out DevOps and DevSecOps practices, they’re assembling teams around the developer to ensure that as they’re building new features at a rapid pace, security and operations components move along with that. Yet … continue reading
Easing the development burden
Installing and configuring a fully integrated multi-software tool DevSecOps environment can be a long, tenuous burden for many organizations, often taking months from start to finish. Consider, instead, standardizing on a single application delivery platform — a set of integrated development, security, and operations tools — to increase productivity and accelerate installation and configuration of … continue reading
2020: Security issues increase as the world suddenly becomes more digital
The year 2020 saw a tremendous shift towards doing business online due to COVID-19, and cybercriminals have taken this opportunity to up their attacks, both in frequency and scope. The FBI reported that the number of complaints about cyberattacks to their Cyber Division is up to as many as 4,000 a day. That represents a … continue reading
IBM releases Code Risk Analyzer to shift security left
IBM has announced the Code Risk Analyzer, a focused effort to bring security and compliance analytics to DevSecOps. The Code Risk Analyzer can be configured to run at the beginning of a developer’s code pipeline and it reviews and analyzes Git repositories for known issues with any open-source code that needs to be managed. It … continue reading
Beware of these creatures lurking in your DevSecOps teams
Halloween is upon us, and while much of the world is focused on scary creatures like ghosts, ghouls, or werewolves, DevSecOps teams have a few scary creatures of their own to deal with. From the Dracula-like developer stuck in a world from centuries ago who is thwarting the creation of secure apps, to the DevOps … continue reading
AppSec vs. DevSecOps, and what that means for developers
Traditional application security is different in two key ways from what has come to be known as DevSecOps. First, modern software companies are integrating application security into their DevOps pipelines, so security becomes part of the flow. Second, it’s also about DevOps being built into application security. Patrick Carey, who leads product strategy in the … continue reading
Report: 73% of developers sacrifice security for speed
A majority of developers feel forced to sacrifice security for the speed that today’s development cycles require. A recent report from WhiteSource found 73% of security teams at organizations are forced to cut corners, and the AppSec tools they use are to check the box towards DevSecOps improvements and are not effectively used. “There are … continue reading
SD Times news digest: Windows app development updates, GitLab 13.4, and the Auth0 Marketplace
Microsoft has announced new ways for Windows developers to build applications. The company announced it is working on a unified app platform that will enable developers to leverage new and existing code. With Project Reunion, the company is working to unify access to Win32 and UWP APIs. “We will provide a common platform for new … continue reading
Progress acquires Chef to extend DevOps and DevSecOps offerings
Progress announced that it entered into a definitive agreement to acquire Chef to provide complete infrastructure automation to build, deploy, manage and secure applications in modern multi-cloud and hybrid environments, as well as on-premises. Progress is set to acquire the company for $220 million in cash and is expected to close next month. “Chef has … continue reading
SD Times news digest: Checkmarx teams up with GitLab on DevSecOps, Google DevTools update, and Microsoft TileCode
Checkmarx has announced it will integrate its application security testing solutions directly into the GitLab pipeline. Developers will now have access to automatic SAST and SCA security scans in the event of pull or merge requests, eliminating time-consuming manual scans and allowing developers to find and fix vulnerabilities earlier in the SDLC and make security assessments … continue reading
