Parasoft announced the newest release of Parasoft C/C++test, the unified C and C++ development testing solution for enterprise and embedded applications.
Even organizations that understand the importance of cybersecurity in theory often stumble when it comes to marrying security initiatives with their development and operations processes. Most businesses agree that everyone should be responsible for security, but this principle is not being upheld on a day-to-day basis in many organizations. That’s bad news for everyone.
Start with Implementing SecOps Within an IT Infrastructure in Transition - Part 1
SecOps Pitfalls and Best Practices
Here are some best practices for implementing SecOps:
1. System Access & Users
The " target="_blank">principle of least privilege should always be top of mind for organizations when it comes to system access and users. While you may have modeled it into your policies, achieving security maturity in this area means that you have also embedded the principle of least privilege into your tools and day-to-day processes. By systematically automating and verifying your user access policies, you reduce the risk of human oversight that could enable insider threats.
2. Patching & Vulnerability Management
Patching vulnerabilities seems like an easy enough task, but companies aren’t doing it with nearly enough regularity, giving attackers plenty of time to exploit known vulnerabilities that are months (or even years) old. To mitigate these vulnerabilities and achieve security maturity, your organization’s approach to patching should be standardized, automated, and built with sufficient resiliency to withstand automatic software updates.
3. Infrastructure Control Plane (AWS Console/API)
When operating in the cloud, APIs and management consoles are the functional equivalent of data center access. Unlike with a data center, however, securing only your own networks is not enough to secure the cloud because this approach leaves APIs exposed. To achieve SecOps maturity with respect to the infrastructure control plane, it’s necessary to evolve your security approach by handling public cloud management consoles and APIs with the same level of sensitivity as a data center. This involves automating the shutoff of access to insecure or potentially compromised systems.
4. Networking
Network topologies are still the primary means by which security and operations teams restrict access between systems, but with environments that are more complex and interconnected than ever before, traditional network security controls aren’t sufficient. Instead, servers should be grouped by role, leveraging automation to establish small network paths to model trust between peers, and architecture should run over the WAN rather than LANs. SecOps maturity in this area, therefore, means that you have modeled authentication and authorization and are not relying on the underlying network topology to define security.
5. Runtime & Services
Both operations and security teams benefit from the standardization of runtimes and software management, continuous integration, and streamlined software development life cycles, so the alignment of goals in these areas should be relatively easy. With shared objectives, infrastructure and runtimes can function as a shared utility, allowing engineers to innovate within these common structures. It’s necessary to apply the same principles across teams in order to achieve SecOps maturity with regard to runtimes and services, thereby increasing efficiency and helping to minimize the risk of failure.
As SMBs and enterprises alike continue to leverage cost-effective solutions for developing secure applications in less time, SecOps is becoming a prominent philosophy across organizations of all sizes. By implementing SecOps, companies can reap a multitude of benefits stemming from the integration of operations, security, and development functions and the alignment of their goals, including more efficient operations, reduced resource utilization, fewer cloud and app security issues and disruptions, and more.
Industry News
Datadog announced Security Monitoring, a new product that enables real-time threat detection across the entire stack and deeper collaboration between security, developers, and operations teams.
Pulumi announced the availability of Pulumi Crosswalk for Kubernetes, an open source collection of frameworks, tools and user guides that help developers and operators work better together delivering production workloads using Kubernetes.
CloudBees announced a Preview Program for CloudBees CI/CD powered by Jenkins X, a Software as a Service (SaaS) continuous integration and continuous delivery solution running on Google Cloud Platform.
Rancher Labs announced the general availability of K3s, their lightweight, certified Kubernetes distribution purpose built for small footprint workloads, along with the beta release of Rio, their new application deployment engine for Kubernetes that delivers a fully integrated deployment experience from operations to pipeline.
WhiteSource announced a new integration with Codefresh, the Kubernetes-native CI/CD solution.
Styra is addressing one of the most significant enterprise blockers of Kubernetes: compliance. With Styra, enterprises can move Kubernetes clusters into production en masse while complying with traditional governance, audit, and compliance rules and regulations.
Nureva added 13 agile-themed templates to Span Workspace, Nureva’s expansive cloud-based digital canvas for visual planning and team collaboration.
Threat Stack announced support for AWS Fargate in the Threat Stack Cloud Security Platform.
Tricentis announced the publication of Enterprise Continuous Testing: Transforming Testing for Agile and DevOps, written by Tricentis Founder Wolfgang Platz and Cynthia Dunlop.
JFrog announced the availability of the popular JFrog Platform subscription package Cloud Pro X on AWS Marketplace.
MuleSoft will extend its Anypoint Runtime Fabric to run on Google Cloud.
NeuVector announced the immediate availability of its “Security Policy as Code” capability for Kubernetes services.
Agile Stacks announced the launch of KubeFlex, a new cloud-native software platform enabling zero-touch Kubernetes deployments in data centers and at the edge.
Bacula Systems announced significant enhancements to its backup module for Kubernetes clusters.