DevSecOps Guide
DevSecOps is the DevOps community’s approach to bringing security into the development lifecycle. Businesses want to deliver software, but cannot afford to release unreliable or insecure applications— therefore security needs to be baked in much sooner than it has traditionally been.
DevSecOps shifts security ‘left’ to find and fix vulnerabilities earlier in the software development life cycle. It includes the benefits of DevOps such as developing, deploying and delivering new features at a rapid pace, but it also provides a more proactive approach to identifying and addressing bug in real time to bring security risks significantly down.
Just like DevOps, culture will remain a barrier to a successful DevSecOps solution. In addition to bringing the developers and operation teams together, now they need to figure out how to work with the security team towards the same goals and objectives. Bringing the security team in sooner will help them understand the code and work with the development team in a more productive manner.
devsecops Resources
SD Times news digest: Microsoft previews dual-screen SDKs, CloudVector introduces free API observability tool, and Confluent Platform 5.4
Microsoft announced dual-screen preview SDKs as well as new web standards proposals to enable dual-screen experiences for websites and PWAs on both Android and Windows 10X. The preview SDK for Microsoft Surface Duo includes native Java APIs and an Android Emulator with a preview Surface Duo image that is integrated into Android Studio. Additionally, Microsoft … continue reading
New open-source projects look to secure Kubernetes
Kubernetes security company Octarine has announced two new open-source projects designed to protect against cloud-native security vulnerabilities. The Kubernetes Common Configuration Scoring System (KCCSS) is a framework for rating security risks, and kube-scan is a workload and assessment tool. “Our mission is to make the adoption of DevSecOps best practices simple, understandable, and achievable for … continue reading
Top considerations for DevSecOps to reduce security risk
To understand an enterprise’s current state of software security risk, executives, security practitioners and development teams need information. Benchmarks provide useful information on performance and risk. However, ideas about which benchmarks are most important will differ depending upon the corporate stakeholder to whom you’re speaking. For example, a business decision-maker has to justify the expense … continue reading
Report: Shifting left does not solve security problems
The rise of DevSecOps has stressed the importance of shifting security left in order to provide better protection. A recently released report, though, found shifting left isn’t enough. In order for security to be viewed as more than just an extra step, it needs to be built into the entire life cycle. Puppet, CircleCI and … continue reading
Report: BSIMM10 shows new wave of engineering-led software security in DevOps
The security aspect of DevOps is evolving as new data found a new wave of engineering-led software security efforts originating bottom-up in the development and operations teams rather than top-down from a centralized software security group (SSG). Software security initiatives (SSIs) have identified a number of individuals (often developers, testers, and architects) who are invested … continue reading
Orasi Software and Saltworks Security enter into partnership with open source security leader Sonatype
Orasi Software, a DevOps technology and consulting firm that ensures confident delivery of transformative applications that grow and simplify business, today announced that Orasi and Saltworks Security, an Orasi Company, have entered into a cooperative partnership with Sonatype, an innovator in open source code governance. For the partnership, Orasi and Saltworks will promote Sonatype’s open … continue reading
DevOps Institute named continuous learning track sponsor of DevOps World | Jenkins World 2019
DevOps Institute (https://devopsinstitute.com/), a global member-based association for advancing the human elements of DevOps, today announced its unique role as the Continuous Learning Track Sponsor of DevOps World | Jenkins World 2019 from August 12-15 in San Francisco. The DevOps Institute will host several learning and upskilling opportunities to attendees, including two certification courses led by … continue reading
GitLab turns its focus to DevSecOps
GitLab is taking the next steps in its DevOps initiative with the announcement that it is integrating security into its single application. The company is also releasing auto remediation, security dashboards and plans to release security approvals in an upcoming update. “The advantages of a single application are numerous: A single sign-on eliminates the need … continue reading
Why do the same vulnerabilities keep showing up?
When Jeff Williams, co-founder and CTO of Contrast Security, created the OWASP Top Ten list, first published in 2003, he was proud of the work done; but now more than a decade later, Williams expresses disappointment in the unchanged list. RELATED CONTENT: For effective DevSecOps, shift left AND extend right “My thought at the time … continue reading
A guide to DevSecOps offerings
Contrast Software Contrast Assess produces accurate results without dependence on application security experts, using deep security instrumentation to analyze code in real time from within the application. It scales because it instruments application security into each application, delivering vulnerability assessment across an entire application portfolio. Contrast Assess integrates seamlessly into the software lifecycle and into … continue reading
What does Contrast bring to the table and address DevSecOps in your solution?
Jeff Williams, co-founder and CTO, Contrast Security: Contrast is an integration platform for application security. We use an instrumentation-based approach, so we work from inside the running application layer. From there, we support the entire software life cycle with three things. The first thing is, we help identify vulnerabilities. Typically you want them to be … continue reading
For effective DevSecOps, shift left AND extend right
DevSecOps has come to be known by many as the shifting left of security, making it a key part of software development while code is being written, as opposed to trying to put security onto the application after it’s completed. This follows the trends of DevOps, which moved operational considerations for applications into development, as … continue reading
