SmartBear announced a new version of its API design and documentation tool, SwaggerHub, integrating Stoplight’s API open source tools.
DevSecOps brings together the best of DevOps with modern security practices. DevOps streamlines and accelerates the product development lifecycle, aiming to automate as much as possible. DevSecOps maintains this automation focus and incorporates security — with a goal of making each step secure and bringing in new tools and practices to make the entire product more secure as well.
With automation practices becoming more ingrained in software delivery processes, it is essential to integrate security. Leaving security as an afterthought could be very costly for a business and its customers. We've all read the headlines related to fines, reimbursement, and lost business that comes when a large company is compromised or breached.
Considering security separately from other DevOps processes can also lead to delays in the delivery of product features, because vulnerabilities must be assessed separately. These delays run counter to the goals and promises of most DevOps groups and organizations.
For example, if a large enterprise processes a large quantity of user data and stores that sensitive data on databases, it is critical to make sure early on that this kind of information can't be hacked. If hackers are able to take total system control and start to exploit the system's vulnerability by gaining access to the servers, this could lead not only to data loss but also to a large expenditure and fines.
That's why it is important to not only pay attention to product delivery automation and speed but also to add security to software updates, critical system vulnerabilities, and correct system access control, which DevSecOps practices assist with.
This 2-part blog will focus on some established and emerging ways that DevSecOps plays a role in product delivery organizations.
DevSecOps Business Value
Applying DevSecOps practices to product delivery has a positive impact on business in the following ways:
1. Ensuring the payoff of automation — by including security testing, it makes sure that vulnerability testing doesn't become a separate process that slows down feature delivery.
2. Avoiding System Compromise — utilizing all the tools in the DevSecOps handbook, makes an attack or compromise less likely. This limits the business' exposure and keeps customers happy.
3. Fast Reaction — when an incident does happen, having the appropriate monitoring in place helps to react quickly and address problems proactively, thereby reducing the risk of a catastrophic incident and helping prevent exposure of critical data.
DevSecOps can also assist with corporate compliance. If a company has sensitive data, it probably falls under some type of compliance structure. PCI-DSS, GDPR and HIPAA were all created to protect important data of various system users. PCI-DSS compliance, in the financial sector, ensures sensitive data security and system non-vulnerability for systems that need to store or use cardholder data. If the organization has non-compliant systems or code, it can be penalized, which can be quite financially painful and potentially lead to a loss of customers.
The General Data Protection Regulation (GDPR), a European privacy regulation issued in 2018, guarantees personal data protection. Before it, any internet resource could save personal data and organizations were not required to delete or manage this data. This could be true, even long after a user ceased using a system. Users also didn't have the right to request that their data be deleted.
Now, the GDPR obliges organizations, upon the user's request, to delete personal and other data from their storage systems. If the organization doesn't do this, it can be subject to substantial penalties. Applying DevSecOps practices can help organizations escape challenges with personal data security, which will ultimately help to decrease reputational and financial risks.
As DevSecOps practices are being implemented by enterprises of all sizes and industries. Baking security into every step of the delivery process is key for reducing costs in the long term and keeping happy, and safe, customers.
Go to DevSecOps Best Practices and Business Value - Part 2, providing DevSecOps best practices.
Industry News
Red Hat announced updates to Red Hat Trusted Software Supply Chain.
Tricentis announced the latest update to the company’s AI offerings with the launch of Tricentis Copilot, a suite of solutions leveraging generative AI to enhance productivity throughout the entire testing lifecycle.
CIQ launched fully supported, upstream stable kernels for Rocky Linux via the CIQ Enterprise Linux Platform, providing enhanced performance, hardware compatibility and security.
Redgate launched an enterprise version of its database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.
Snyk announced the expansion of its current partnership with Google Cloud to advance secure code generated by Google Cloud’s generative-AI-powered collaborator service, Gemini Code Assist.
Kong announced the commercial availability of Kong Konnect Dedicated Cloud Gateways on Amazon Web Services (AWS).
Pegasystems announced the general availability of Pega Infinity ’24.1™.
Sylabs announces the launch of a new certification focusing on the Singularity container platform.
OpenText™ announced Cloud Editions (CE) 24.2, including OpenText DevOps Cloud and OpenText™ DevOps Aviator.
Postman announced its acquisition of Orbit, the community growth platform for developer companies.
Check Point® Software Technologies Ltd. announced new email security features that enhance its Check Point Harmony Email & Collaboration portfolio: Patented unified quarantine, DMARC monitoring, archiving, and Smart Banners.
Automation Anywhere announced an expanded partnership with Google Cloud to leverage the combined power of generative AI and its own specialized, generative AI automation models to give companies a powerful solution to optimize and transform their business.
Jetic announced the release of Jetlets, a low-code and no-code block template, that allows users to easily build any technically advanced integration use case, typically not covered by alternative integration platforms.
Progress announced new powerful capabilities and enhancements in the latest release of Progress® Sitefinity®.