Backslash Security introduced its Fix Simulation and AI-powered Attack Path Remediation capabilities.
A surprising amount of organizations aren't embracing automation when it comes to securing cloud deployments, according to the State of DevSecOps 2024 report from Datadog.
At least 38% of organizations leveraging AWS had deployed workloads or completed sensitive actions manually through the AWS console in a production environment within a 14-day period, meaning they are relying on manual click operations instead of automation.
Adoption of infrastructure as code (IaC) also varied across cloud providers. IaC is considered a critical practice when securing cloud production environments, as it helps ensure that human operations have limited permissions on production environments, all changes are peer reviewed and issues are identified earlier in the process. The report found that in AWS, over 71% of organizations use IaC through at least one popular IaC technology. This number is lower in Google Cloud, at 55%.
"These findings from the State of DevSecOps show that there is still room for improvement when it comes to embracing automation for the sake of improving security," said Andrew Krug, Head of Security Advocacy at Datadog. "Modern DevOps practices go hand-in-hand with strong security measures — and in fact, security helps drive operational excellence across the organization. While security starts with visibility, securing applications is only realistic when practitioners are given enough context and prioritization to understand which security signals matter and which are irrelevant."
Other key findings from the report include:
■ While attacks from automated security scanners represent the largest number of exploitation attempts, the vast majority of these attacks are harmless and only generate noise for defenders. Out of the tens of millions of malicious requests that were identified coming from such scanners, only 0.0065% successfully triggered a vulnerability.
■ A substantial number of organizations continue to rely on long-lived credentials — one of the most common causes of data breaches — in their CI/CD pipelines, even in cases where short-lived ones would be both more practical and more secure. 63% used a form of long-lived credential at least once to authenticate GitHub Actions pipelines.
■ Java applications are the most impacted by third-party vulnerabilities; 90% of Java services are susceptible to one or more critical or high-severity vulnerabilities introduced by a third-party library, versus an average of 47% for other programming languages.
Methodology: For the report, Datadog analyzed tens of thousands of applications and container images, along with thousands of cloud environments to assess the security posture of applications today and evaluate the adoption of best practices that are at the core of DevSecOps.
Industry News
Check Point® Software Technologies Ltd. announced the appointment of Nadav Zafrir as Check Point Chief Executive Officer.
Sonatype announced that Sonatype SBOM Manager, its Enterprise-Class Software Bill of Materials (SBOM) solution, and its artifact repository manager, Nexus Repository, are now available in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS).
Broadcom unveiled the latest updates to VMware Cloud Foundation (VCF), the company’s flagship private cloud platform.
CAST launched CAST SBOM Manager, a new freemium product designed for product owners, release managers, and compliance specialists.
Zesty announced the launch of its Insights and Automation Platform.
Progress announced the availability of Progress® MarkLogic® FastTrack™, a UI toolkit for building data- and search-driven applications to visually explore complex connected data stored in Progress® MarkLogic® platform.
Snowflake will host the Llama 3.1 collection of multilingual open source large language models (LLMs) in Snowflake Cortex AI for enterprises to easily harness and build powerful AI applications at scale.
Secure Code Warrior announced the availability of SCW Trust Agent – a solution that assesses the specific security competencies of developers for every code commit.
GFT launched AI Impact, a new solution that leverages artificial intelligence to eliminate technical debt, increase developer efficiency and automate critical software development processes.
Code Metal announced a $13M seed, led by Shield Capital.
Atlassian Corporation has achieved Federal Risk and Authorization Management Program (FedRAMP) “In Process” status and is now listed on the FedRAMP marketplace.
Check Point® Software Technologies Ltd. announced that it has received a Leader ranking in The Forrester Wave™: Mobile Threat Defense Solutions, Q3 2024 report.
Mission Cloud announced the launch of Mission Cloud Engagements - DevOps, a platform designed to transform how businesses manage and execute their AWS DevOps projects.
Accelario announces the release of its free TDM solution, including database virtualization and data anonymization.