Site Search
Software security often evokes negative feelings among software developers because it is associated with additional programming effort, uncertainty, and road-blocking activity on a fast release cycle. Secure software developers must follow a number of guidelines that, while intended to...
Faster DevOps processes also create new challenges. It was difficult enough to add security into a traditional waterfall software development lifecycle with monthly or quarterly releases, but now software updates are released several times a day! What can developers do to build and maintain more secure applications? Here are some ways to encourage better security practices throughout the DevOps lifecycle.
The purpose of CI/CD security goes beyond identifying and remediating vulnerabilities—it also emphasizes keeping pace with other CI/CD processes. A secure CI/CD pipeline allows teams to find and fix issues without disrupting the overall CI/CD flow, achieving security without delaying or rolling back software releases.
Your operational tools deliver continuous monitoring and alerting for applications deployed in the cloud. So why doesn’t your security suite do the same? Although no single path to a secure DevOps approach works for every organization, Tim Prendergast offers a set of key principles and...
Agile development and DevOps depend on an automated pipeline to build, test, and deploy code quickly. Security is all too often viewed as a manual task that is too difficult to automate and is left for later—not a good decision!
Security specialists, especially at large organizations, believe that better security comes from robust independent gating. On the other hand, DevOps has proven that you can safely deploy orders of magnitude faster than human gating can achieve. What's needed to add security to DevOps are tools that work well with rapid-cycle CI/CD pipelines and an approach that reinforces the DevOps culture and process changes.
Implementing application security (AppSec) programs on a large scale can often seem chaotic and unwieldy. Without the proper knowledge to implement robust AppSec tools, DevSecOps on a large scale can be overwhelming.
As organizations continue to pursue their digital transformations, their IT infrastructures are expanding in both size and diversity. Many are seeing the addition of two new technologies in particular: containers and Kubernetes.
DevSecOps is a growing movement to incorporate security into DevOps practices in order to ensure flaws and weaknesses are exposed early on through monitoring, assessment, and analysis, so remediation can be implemented far earlier than traditional efforts. By failing fast with security testing, organizations reduce risk of a security incident and decrease the cost of rework.
In most organizations, the transition to DevSecOps cannot happen without tools. A DevSecOps stack is a set of security tools that facilitate fast, automated security checks at every stage of the software development lifecycle (SDLC). This article covers the key principles of a successful DevSecOps stack, and the primary technologies that typically comprise the stack.
In this interview, Jeff Payne, the CEO and cofounder of Coveros, explains why major companies just aren’t that good at security. He discusses how you can better protect your business, as well as why DevOps can and should be a key to your success.
DevSecOps is about more than just the tools—it is an organizational, operational, and strategic transformation. So, as a “thorough or dramatic change in form or appearance” across the three main pillars of an organization, how can we expect a DevSecOps transformation to take place overnight?
Have you wondered where QA professionals fit into a DevSecOps transformation? Stacy Kirk thinks they should champion the transformation. Regardless of where your company is on its journey to DevSecOps, quality must be at the forefront for optimal effectiveness and customer value. This means promoting feedback loops that use monitoring and reporting tools effectively, and most importantly, it means creating a culture of collaborative communication and continuous improvement.