Gearset announced its new CI/CD solution, Long Term Projects in Pipelines.
Nearly two decades ago, proponents of the DevOps movement rallied against traditional software models that called for the developers who write code to be organizationally and functionally separate from those who deploy and support the code. Despite taking a few years, DevOps gained full adoption, and Agile development practices like automated build and test became the status quo after Gartner got on board with the concept in 2011.
Security and Compliance Enter the Arena
Looking back, it's safe to say that Agile and DevOps delivered on their promise of continuous integration and delivery. Development and operations teams were finally provided the flexibility to make changes and improvements during phases, accelerating the delivery of quality software. Despite DevOps's widespread adoption and success, other teams were siloed, including security and compliance. In the nascent stage of DevOps, security and compliance were often sidelined, creating bottlenecks and being labeled as the culprits for delayed releases.
In 2014, the landscape was jolted by an 80% surge in security breaches from the previous year, with over one billion records compromised across 1,500 incidents, as reported by Security Week. High-profile companies like Home Depot, JP Morgan Chase, and eBay were victims of cyberattacks. These events triggered a shift in development paradigms, placing security and compliance in a pivotal role.
Configuration errors gave rise to DevSecOps, and organizations began integrating security into the Agile development process from the outset. Although the term "DevOps" may seem a bit antiquated, DevSecOps thrives, contingent on embracing the necessary cultural and procedural changes. DevSecOps is bolstered by technology but hinges on a company-wide security-conscious mindset and adopting automated security testing tools.
Exploring Platform Engineering
Recently, platform engineering has become the next big thing, sparking interest in its focus on developing self-service internal developer platforms (IDPs) for streamlined software delivery and lifecycle management. As Gartner states, "Platform engineering is an emerging technology approach that can accelerate the delivery of applications and the pace at which they produce business value."
Gartner expects that by 2026, "80% of software engineering organizations will establish platform teams as internal providers of reusable services, components, and tools for application delivery. Platform engineering will ultimately solve the central problem of cooperation between software developers and operators."
In platform engineering, the platform is supported by layered services or tools, created and maintained by a dedicated product team, designed to help the needs of software developers by essentially stitching together components to create a frictionless developer experience. This methodology incorporates Agile, DevOps, and DevSecOps principles and complements them, offering broader benefits when considered collectively.
Key Synergies:
■ Developer Experience and Productivity – DevSecOps improves support across IT Ops, security, and compliance, not just developers.
■ Automation – DevSecOps hinges on policy-as-code automation for infrastructure and compliance, while platform engineering expands automation throughout the development cycle.
■ Self-service – Platform engineering builds on the services-oriented, automated approach of DevSecOps, facilitating self-service capabilities and empowering developers in security and compliance.
■ Accelerate Value – At the core of tech enablement, from platforms to tools and processes, is the acceleration of high-quality, resilient, and secure application delivery.
As platform engineering gains traction, the integration of DevOps and DevSecOps remains vital, underscoring the enduring relevance of these practices despite the potential for new nomenclature. The evolving roles of DevOps and DevSecOps within the scope of platform engineering are not to be underestimated, as they are central to the rapid development and deployment of applications in an increasingly security-conscious world.
Industry News
Rafay Systems has extended the capabilities of its enterprise PaaS for modern infrastructure to support graphics processing unit- (GPU-) based workloads.
NodeScript, a free, low-code developer environment for workflow automation and API integration, is released by UBIO.
IBM announced IBM Test Accelerator for Z, a solution designed to revolutionize testing on IBM Z, a tool that expedites the shift-left approach, fostering smooth collaboration between z/OS developers and testers.
StreamNative launched Ursa, a Kafka-compatible data streaming engine built on top of lakehouse storage.
GitKraken acquired code health innovator, CodeSee.
ServiceNow introduced a new no‑code development studio and new automation capabilities to accelerate and scale digital transformation across the enterprise.
Security Innovation has added new skills assessments to its Base Camp training platform for software security training.
CAST introduced CAST Highlight Extensions Marketplace — an integrated marketplace for the software intelligence product where users can effortlessly browse and download a diverse range of extensions and plugins.
Red Hat and Elastic announced an expanded collaboration to deliver next-generation search experiences supporting retrieval augmented generation (RAG) patterns using Elasticsearch as a preferred vector database solution integrated on Red Hat OpenShift AI.
Traceable AI announced an Early Access Program for its new Generative AI API Security capabilities.
StackHawk announced a new integration with Microsoft Defender for Cloud to help organizations build software more securely.
MacStadium announced that it has obtained Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Level 1, meaning that MacStadium has publicly documented its compliance with CSA’s Cloud Controls Matrix (CCM), and that it joined the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.
The Cloud Native Computing Foundation® (CNCF®) released the two-day schedule for CloudNativeSecurityCon North America 2024 happening in Seattle, Washington from June 26-27, 2024.
Sumo Logic announced new AI and security analytics capabilities that allow security and development teams to align around a single source of truth and collect and act on data insights more quickly.