Backslash Security introduced its Fix Simulation and AI-powered Attack Path Remediation capabilities.
Software developers and security teams have a well-known antagonistic relationship. Dev teams often feel plagued by the restrictive security standards placed on them by security teams that inhibit their ability to rapidly write applications, while security teams view developers as one of the biggest threats with which they have to grapple.
As DevOps proliferates organizations in the never-ending race to deliver more customer value, faster, security is being forced to rethink its approach. The goal of DevOps is to accelerate the development of software and apps by breaking down the long-established barriers between development and operations. As part of this transformation, it also requires organizations to collaborate with security teams and reevaluate how they approach security in a DevOps world.
There are three core challenges that must be addressed in order for security and DevOps to be in lockstep:
1. Speed
In a world of continuous delivery, security has to be able to keep up with the new pace of development. This is no easy feat as dev cycles are much shorter, going from months to weeks and, in some cases, even days. Therefore, security tools at the DevOps level must be easy to integrate and maintain in order to support a continuous delivery flow. Increased levels of automation, state-of-the-art threat modeling and real-time vulnerability alerts are required. It is also critical that security becomes a component of pre-deployment checklists in dev, staging and production environments. This “shift left” is a best practice for DevOps that all organizations should adopt.
2. Break Down Barriers
At the heart of DevOps success is breaking down long-established silos and creating cross-functional, collaborative teams. Security, development, and operations must work cohesively in pursuit of a common set of goals to deliver successful DevOpsSec. This mandates that security teams serve as consultants to DevOps teams rather than acting as a roadblock, telling developers to go back and fix bad code. One way to help solve this problem is to explore and expand the automation of security solutions.
3. Skills Gap
Security teams must learn new skills in order to understand and integrate technology into the dev process. With development predominantly happening in the cloud, security teams must now be knowledgeable in areas such as API and coding so they can support the new agile development process.
By addressing these three core challenges, security teams can support the growth and success of DevOps. Ultimately, security teams need to look at DevOps through the same lens as a customer-facing web app by establishing a set of standards and best practices. However, it is important to note that post-deployment application security is equally as important as during the development stage. So, getting DevOps security right is only part of the transformation that security teams must undertake.
Industry News
Check Point® Software Technologies Ltd. announced the appointment of Nadav Zafrir as Check Point Chief Executive Officer.
Sonatype announced that Sonatype SBOM Manager, its Enterprise-Class Software Bill of Materials (SBOM) solution, and its artifact repository manager, Nexus Repository, are now available in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS).
Broadcom unveiled the latest updates to VMware Cloud Foundation (VCF), the company’s flagship private cloud platform.
CAST launched CAST SBOM Manager, a new freemium product designed for product owners, release managers, and compliance specialists.
Zesty announced the launch of its Insights and Automation Platform.
Progress announced the availability of Progress® MarkLogic® FastTrack™, a UI toolkit for building data- and search-driven applications to visually explore complex connected data stored in Progress® MarkLogic® platform.
Snowflake will host the Llama 3.1 collection of multilingual open source large language models (LLMs) in Snowflake Cortex AI for enterprises to easily harness and build powerful AI applications at scale.
Secure Code Warrior announced the availability of SCW Trust Agent – a solution that assesses the specific security competencies of developers for every code commit.
GFT launched AI Impact, a new solution that leverages artificial intelligence to eliminate technical debt, increase developer efficiency and automate critical software development processes.
Code Metal announced a $13M seed, led by Shield Capital.
Atlassian Corporation has achieved Federal Risk and Authorization Management Program (FedRAMP) “In Process” status and is now listed on the FedRAMP marketplace.
Check Point® Software Technologies Ltd. announced that it has received a Leader ranking in The Forrester Wave™: Mobile Threat Defense Solutions, Q3 2024 report.
Mission Cloud announced the launch of Mission Cloud Engagements - DevOps, a platform designed to transform how businesses manage and execute their AWS DevOps projects.
Accelario announces the release of its free TDM solution, including database virtualization and data anonymization.