Progress announced the latest release of Progress® Semaphore™, its metadata management and semantic AI platform.
Only 52 percent of developers using commercial or open source components in their applications update those components when a new security vulnerability is announced, according to new research conducted by Vanson Bourne for CA Veracode, part of CA Technologies. This highlights organizations' lack of security awareness and puts organizations at risk of a breach.
Software development processes like DevSecOps have helped improve the security of the code developers write. However, these same development processes value speed and efficiency to keep up with the demands of the application economy. As a result, developers rely on components that borrow features and functionality from existing projects and libraries. The research shows that 83 percent of respondents use either or both commercial and open source components, with an average of 73 components being used per application.
While components boost developers’ efficiency, and their use is considered a best practice, these components come with inherent security risks. Despite finding an average of 71 vulnerabilities per application introduced through the use of third-party components, only 23 percent of respondents reported testing for vulnerabilities in components at every release. This may be a result of only 71 percent of organizations reporting to having a formal application security (AppSec) program in place.
What’s more, only 53 percent of organizations keep an inventory of all components in their applications. According to The State of Software Security Report 2017 (SOSS), fewer than 28 percent of companies conduct regular composition analysis to understand which components are built into their applications.
This report shows that development (44 percent) or security (31 percent) teams are most likely to be responsible for the maintenance of third-party commercial and open source components, which suggests a move towards responsibility for the development team. As awareness around open source risk continues to grow, providing developers with the solutions, education and visibility to mitigate risk becomes a critical component to the Modern Software Factory approach to development that helps to build better, more secure, apps faster.
We know that developers care about creating great code, and that means creating secure code. In order to be successful, developers need to have clarity on the security policy and the tools to measure against it. When the goal is clear and we give developers access to those tools, they are able to integrate scanning earlier into the SDLC and make informed decisions that take security into consideration. Through this, we see a marked improvement in secure software development and the resulting outcomes.
Methodology: CA Veracode commissioned Vanson Bourne to survey 400 application developers from the U.S. (200 respondents), UK (100 respondents), and Germany (100 respondents) to understand the maturity of organizations’ component security. Polling was conducted online in February of 2018.
Industry News
Elastic, the Search AI Company, announced the Elasticsearch Open Inference API now integrates with Anthropic, providing developers with seamless access to Anthropic’s Claude, including Claude 3.5 Sonnet, Claude 3 Haiku and Claude 3 Opus, directly from their Anthropic account.
Broadcom unveiled VMware Cloud Foundation (VCF) 9, the future of VCF that will accelerate customers’ transition from siloed IT architectures to a unified and integrated private cloud platform that lowers cost and risk.
Broadcom announced VMware Tanzu Platform 10, a cloud native application platform that accelerates software delivery, providing platform engineering teams enhanced governance and operational efficiency while reducing toil and complexity for development teams.
Red Hat announced the general availability of Red Hat OpenStack Services on OpenShift, the next major release of Red Hat OpenStack Platform.
Salesforce announced new innovations in Slack that make it easier for users to build automations, no matter their technical expertise.
GitLab announced the general availability of the GitLab Duo Enterprise add-on.
Tigera now delivers universal microsegmentation capabilities with Calico.
Tabnine announced a new platform partnership with Broadcom Inc., an integration with IBM, as well as continuing extensions of existing partnerships with Amazon Web Services (AWS), DigitalOcean, Google Cloud, and Oracle Cloud Infrastructure (OCI).
Wallarm released API Attack Surface Management (AASM), an agentless technology to help organizations identify, analyze, and secure their entire API attack surface.
LambdaTest launched KaneAI, an end-to-end software AI Test Agent.
Kubiya has closed its $12 million seed round with a $6 million extension of equity and debt financing and launched a paradigm-breaking new platform, AI Teammates, that enables true delegation of complex tasks to digital colleagues through organic, human-like conversations.
The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the schedule for KubeCon + CloudNativeCon North America 2024, happening in Salt Lake City, Utah from November 12 – 15.
Diagrid announced the latest version of Dapr, a Cloud Native Computing Foundation incubating project maintained by Diagrid, Microsoft, Intel, Alibaba, and others, as well as an update to Conductor, a Software as a Service (SaaS) that helps manage, upgrade, and monitor Dapr on Kubernetes clusters.
Spectro Cloud announced two new formal recognitions of its strengthening position in the government technology space: the Government Software competency from AWS, and ‘Awardable’ status on the CDAO Tradewinds Solutions Marketplace for AI/ML solutions at the tactical edge.