DevSecOps Guide
DevSecOps is the DevOps community’s approach to bringing security into the development lifecycle. Businesses want to deliver software, but cannot afford to release unreliable or insecure applications— therefore security needs to be baked in much sooner than it has traditionally been.
DevSecOps shifts security ‘left’ to find and fix vulnerabilities earlier in the software development life cycle. It includes the benefits of DevOps such as developing, deploying and delivering new features at a rapid pace, but it also provides a more proactive approach to identifying and addressing bug in real time to bring security risks significantly down.
Just like DevOps, culture will remain a barrier to a successful DevSecOps solution. In addition to bringing the developers and operation teams together, now they need to figure out how to work with the security team towards the same goals and objectives. Bringing the security team in sooner will help them understand the code and work with the development team in a more productive manner.
devsecops Resources
Focused on application vulnerabilities? You’re missing the bigger picture
In today’s era of digital transformation, every organization must focus on application security. However, focusing on security vulnerabilities alone is unwise because it’s nearly impossible to prioritize what needs to be done. “DevOps teams are sitting in front of a table with the keys to the kingdom on their computers,” said Jake King, co-founder and … continue reading
4 DevSecOps mistakes to avoid
DevSecOps isn’t just a practice, it’s a continuous learning experience. If you want to be successful faster, avoid these common misconceptions. #1: Business as usual is good enough Cybercriminals are constantly changing their tactics. If your organization’s application security practices are static, they aren’t as robust as they should be. RELATED CONTENT: How to get … continue reading
How to get DevSecOps right
DevOps and security teams are learning how to work together, albeit somewhat awkwardly in these early days of DevSecOps. One reason why it can be difficult to get the partnership “right” is that people define DevSecOps in different ways. “If you asked a room of 10 people to define DevSecOps, you’d get 15 definitions. I … continue reading
SD Times news digest: Microsoft previews dual-screen SDKs, CloudVector introduces free API observability tool, and Confluent Platform 5.4
Microsoft announced dual-screen preview SDKs as well as new web standards proposals to enable dual-screen experiences for websites and PWAs on both Android and Windows 10X. The preview SDK for Microsoft Surface Duo includes native Java APIs and an Android Emulator with a preview Surface Duo image that is integrated into Android Studio. Additionally, Microsoft … continue reading
New open-source projects look to secure Kubernetes
Kubernetes security company Octarine has announced two new open-source projects designed to protect against cloud-native security vulnerabilities. The Kubernetes Common Configuration Scoring System (KCCSS) is a framework for rating security risks, and kube-scan is a workload and assessment tool. “Our mission is to make the adoption of DevSecOps best practices simple, understandable, and achievable for … continue reading
Top considerations for DevSecOps to reduce security risk
To understand an enterprise’s current state of software security risk, executives, security practitioners and development teams need information. Benchmarks provide useful information on performance and risk. However, ideas about which benchmarks are most important will differ depending upon the corporate stakeholder to whom you’re speaking. For example, a business decision-maker has to justify the expense … continue reading
Report: Shifting left does not solve security problems
The rise of DevSecOps has stressed the importance of shifting security left in order to provide better protection. A recently released report, though, found shifting left isn’t enough. In order for security to be viewed as more than just an extra step, it needs to be built into the entire life cycle. Puppet, CircleCI and … continue reading
Report: BSIMM10 shows new wave of engineering-led software security in DevOps
The security aspect of DevOps is evolving as new data found a new wave of engineering-led software security efforts originating bottom-up in the development and operations teams rather than top-down from a centralized software security group (SSG). Software security initiatives (SSIs) have identified a number of individuals (often developers, testers, and architects) who are invested … continue reading
Orasi Software and Saltworks Security enter into partnership with open source security leader Sonatype
Orasi Software, a DevOps technology and consulting firm that ensures confident delivery of transformative applications that grow and simplify business, today announced that Orasi and Saltworks Security, an Orasi Company, have entered into a cooperative partnership with Sonatype, an innovator in open source code governance. For the partnership, Orasi and Saltworks will promote Sonatype’s open … continue reading
DevOps Institute named continuous learning track sponsor of DevOps World | Jenkins World 2019
DevOps Institute (https://devopsinstitute.com/), a global member-based association for advancing the human elements of DevOps, today announced its unique role as the Continuous Learning Track Sponsor of DevOps World | Jenkins World 2019 from August 12-15 in San Francisco. The DevOps Institute will host several learning and upskilling opportunities to attendees, including two certification courses led by … continue reading
GitLab turns its focus to DevSecOps
GitLab is taking the next steps in its DevOps initiative with the announcement that it is integrating security into its single application. The company is also releasing auto remediation, security dashboards and plans to release security approvals in an upcoming update. “The advantages of a single application are numerous: A single sign-on eliminates the need … continue reading
Why do the same vulnerabilities keep showing up?
When Jeff Williams, co-founder and CTO of Contrast Security, created the OWASP Top Ten list, first published in 2003, he was proud of the work done; but now more than a decade later, Williams expresses disappointment in the unchanged list. RELATED CONTENT: For effective DevSecOps, shift left AND extend right “My thought at the time … continue reading
