devopsy.kinsta.cloud

Category: IT as Code

  • Cycode Acquires Bearer to Extend ASPM Platform

    Cycode Acquires Bearer to Extend ASPM Platform

    Cycode today announced it had acquired Bearer, a provider of a set of tools for static application security testing (SAST), discovering application programming interfaces (APIs) and identifying sensitive data.

    The provider of an application security posture management platform (ASPM) plans to integrate the Bearer tools into its core platform to enable DevSecOps teams to further consolidate tooling.

    Cycode CEO Lior Levy said the acquisition of Bearer gives Cycode access to a set of tools that take advantage of generative artificial intelligence (AI) to surface suggestions that enable DevSecOps teams to more easily secure modern applications based on, for example, a microservices-based architecture.

    Bearer achieves that goal by continuously scanning for application security issues as developers are writing code, he added. Overall, Bearer claims its approach to scanning is 31% faster than rival tools while simultaneously leveraging tools such as Bearer Assist, currently in beta, to provide more context concerning the level of risk to the business any issue discovered actually represents.

    Those capabilities will be infused into the Risk Intelligence Graph (RIG) that Cycode developed for its ASPM platform.

    Cycode earlier this year added generative AI capabilities to its platform to make it simpler for DevSecOps teams to identify the root cause of vulnerabilities in complex distributed computing environments. The company uses the generative AI platform created by OpenAI to provide a natural language interface for RIG. As part of that effort, Cycode is making available an executive dashboard that, based on all the dependencies uncovered, provides summaries of risks that make it easier to discern what is occurring across an application environment.

    The company is at the forefront of developing ASPM platforms that continuously ingest data to identify and assess application security risks. Those platforms also provide a foundation for consolidating many of the tools that DevSecOps teams currently rely on to secure applications before they are deployed in production environments.

    It’s not clear how quickly organizations are embracing DevSecOps best practices, but given the number of vulnerabilities that continue to be discovered, there is still much work to be done. The challenge is that legacy tools that lack AI capabilities were not designed to enable organizations to practically shift more responsibility left toward application development teams that typically don’t have a lot of cybersecurity expertise, noted Levy. AI makes it possible to now provide those teams with the context required to address application security issues as they write code versus just before applications are deployed, he added.

    In theory at least, the applications deployed today should be significantly more secure than previous generations of applications. In effect, IT environments are steadily becoming more secure. Less apparent, however, is the rate at which modern applications are being deployed to replace legacy applications that are, all too often, rife with known vulnerabilities that cybercriminals can easily exploit. Given the rate at which vulnerabilities can be discovered and patched in those legacy applications, it may take the better part of the rest of this decade to address those issues once and for all.

  • Survey Sees Limited DevSecOps Progress Being Made as Vulnerabilities Mount

    Survey Sees Limited DevSecOps Progress Being Made as Vulnerabilities Mount

    A survey of 2,037 IT and security professionals conducted by the Cloud Security Alliance (CSA) on behalf of Dazz, a provider of a platform for mapping cloud computing environments, finds well over a third of respondents (38%) estimated that 21-40% of their code contains vulnerabilities, while 19% estimated 41-60% of their code contains vulnerabilities. Another 13% estimated they have vulnerabilities in 61-80% of their code.

    As a result, organizations on average have 55.5 security vulnerabilities each day in their remediation queue, with typically at least one being deemed critical, the survey finds. Overall, the average number of vulnerabilities that could be addressed is 1,025 per month, but organizations typically only address 270 within a month.

    In general, there are four phases to a remediation with each phase, on average, requiring between three to six hours so it easy to see how some organizations with limited resources can reach a point where they never catch up. The report noted that more than half of the vulnerabilities that have been remediated reoccur within a month, often because the root cause was never adequately addressed.

    Hillary Baron, senior technical director for research for CSA, said the high number of vulnerabilities that need to be regularly addressed suggested that progress in adopting DevSecOps best practices remains limited. While not every vulnerability is equally critical, it’s clear application development and cybersecurity teams are not yet proactively addressing application security issues, she noted.

    In fact, the survey found that less than a third (30%) of respondents reported there is a good working relationship between the application development teams that typically provision cloud computing environments and the cybersecurity teams that usually are held accountable for maintaining cloud security. Just under half of respondents (49%) said their vulnerability remediation teams comprised four to six members. Most respondents (60%) found it somewhat difficult to identify code owners, with an additional 24% facing moderate difficulty and 5% that found it highly challenging.

    Dazz CTO Tomer Schwartz said the more dynamic application development becomes, the bigger the DevSecOps challenge. Most organizations lacked the visibility required to proactively correlate their DevSecOps practices, he added. For example, more than three-quarters (77%) of respondents said they lacked full transparency into their cloud computing environments, and 6% had no visibility at all.

    In total, the survey finds organizations typically employ a variety of scanning and detection tools to safeguard their cloud environments, with 32% using five to six tools while another 29% report using three to four tools.

    More than three-quarters of respondents (76%) also noted that one in 10 of the alerts these tools generate is a false positive.

    Just under 75% of respondents also noted security teams spend more than 20% of their time performing manual tasks when addressing vulnerabilities, even though 83% reported using at least some automation in their remediation process. A full 61% also noted their organization is using three to six different detection tools, with nearly half (45%) considering increasing their security budgets in 2024, so it’s likely that many will be adding additional tools. In total, 22% dedicated less than 20% of their budget to cloud security, compared to 31% that allocated 21-40% of their budget and 27% that invest 41-60% of their budget to securing cloud environments.

    Unfortunately, less than a quarter (24%) said they feel very prepared for the cybersecurity threats their organization faces. Much of that uncertainty stems from knowing just how many vulnerabilities there really are in production environments and that they are being attacked with greater frequency each day.

  • Survey: Significant Shift in IaC Tool Preferences

    Survey: Significant Shift in IaC Tool Preferences

    A survey of 350 IT professionals conducted by Firefly, a provider of a platform for managing cloud computing environments, suggests usage of infrastructure-as-code (IaC) tools is evolving rapidly in the cloud computing era.

    For example, more than 40% of the respondents reported that, to some degree, they are already using OpenTofu, an open source IaC tool that was launched as a fork of the Terraform IaC in the wake of changes to the software licensing terms it is made available under by HashiCorp. Well over half said they planned to use OpenTofu in the future. That compares to 60% using Terraform today, but only just over 20% said they planned to use Terraform in the future.

    The licensing changes HashiCorp implemented only affect third-party entities within a third-party platform. However, the survey indicates the number of end users affected by that change is more substantial than anticipated. A full 56% of respondents described the changes made to the Terraform license as disruptive.

    The survey also finds there is a lot more diversity in terms of the types of IaC tools being employed, with both the IaC tools from Pulumi and the open source Crossplane framework being advanced under the auspices of the Cloud Native Computing Foundation (CNCF) also gaining traction. The report finds more than 40% of respondents are also using Pulumi, with well more than half planning to use that IaC tool in the future.

    Crossplane, meanwhile, is now being used by 40% of respondents, with 60% planning to adopt it.

    Conversely, the report also notes the number of organizations planning to migrate away from CloudFormation from Amazon Web Services (AWS) is rising. While well over 60% use AWS CloudFormation today, only a third plan to use it in the future.

    Cindy Blake, vice president of marketing for Firefly, said as organizations employ additional cloud platforms, IT teams are clearly looking for tools that make it easier to centralize the management of multiple computing platforms. That trend will only accelerate as more DevOps teams adopt platform engineering as a methodology for managing the building and deployment of applications at scale, she added.

    In fact, noted Blake, it’s already fairly common for IT teams to use two or more frameworks. The report finds 57% of respondents work for organizations that are using two or more frameworks. Overall, the report finds that more than 64% of respondents have also codified more than half of their cloud assets.

    The number of organizations employing IaC tools to programmatically manage infrastructure is only going to increase, said Blake. The report, for example, found that three-quarters of respondents either already are or plan to use IaC tools to configure software-as-a-service (SaaS) application environments. In the longer term, advances in artificial intelligence (AI) will make it simpler for organizations to achieve that goal. Open source tools such as AiAC, for example, already make it possible to leverage large language models (LLMs) to generate code. Those types of tools will eventually eliminate the need to master specific programming languages to provision IT infrastructure as code, noted Blake.

    It’s not clear how IaC tools within the context of DevOps workflow will evolve, but the one thing that is certain is that the number of types of tools being adopted has never been more diverse.

  • Securing the DevOps Pipeline: Tools and Best Practices

    Securing the DevOps Pipeline: Tools and Best Practices

    The DevOps pipeline refers to the set of practices and tools designed to automate and integrate the processes between software development (Dev) and IT operations (Ops) teams. This pipeline facilitates continuous integration (CI), continuous delivery (CD) and rapid deployment practices, aiming to shorten the development life cycle and provide continuous delivery with high software quality. 

    The DevOps pipeline typically includes planning, coding, building, testing, releasing, deploying, operating and monitoring, enabling teams to develop and deploy software more efficiently and with fewer errors.

    By automating workflows and integrating various development and operational activities, the pipeline supports the rapid iteration of software releases. This not only accelerates the pace of software development but also ensures that quality and performance standards are met throughout the application’s life cycle.

    Due to the critical nature of the DevOps pipeline, security is becoming a top priority. Some of the most devastating cyberattacks in recent years were related to breaches in DevOps pipelines, which led to global-scale supply chain attacks.

    The Need for Security in DevOps

    DevOps, by its very nature, encourages speed and efficiency. However, this drive for rapid software development and deployment can sometimes overlook the critical aspect of security. That’s why it’s essential to weave security into the fabric of the DevOps pipeline, an approach known as DevSecOps. By doing so, we can ensure that security isn’t an afterthought but an integral part of the development process.

    Incorporating security into the DevOps pipeline offers multiple benefits. First, it helps identify and rectify security vulnerabilities early in the development process, reducing the risk of security breaches. It also fosters a culture of shared responsibility, where the development, operations and security teams work together toward the common goal of creating secure software.

    Tools for Securing the DevOps Pipeline

    Securing the DevOps pipeline requires a set of tools that align with the DevOps philosophy of automation and continuous improvement. Let’s explore some of these tools.

    Static Application Security Testing (SAST)

    SAST, also known as white-box testing, is a tool that helps locate security vulnerabilities in the codebase without executing the application. It makes it possible to identify issues early in the development process, even before the code is run.

    SAST works by analyzing the source code, bytecode or binary code, looking for patterns that might indicate a security flaw. The strength of SAST lies in its ability to pinpoint the exact location of the security vulnerability in the codebase. This makes it easier to fix the issue, thus saving time and resources.

    Dynamic Application Security Testing (DAST)

    DAST, a type of black-box testing, involves testing the application in its running state. It’s designed to find security vulnerabilities that can’t be spotted during static analysis.

    DAST works by simulating attacks on the application and observing its response. It can identify security issues like cross-site scripting (XSS), SQL injection and security misconfigurations. The beauty of DAST is that it views the application from an attacker’s perspective, thus providing a real-world assessment of its security. However, DAST can’t identify vulnerabilities in the source code and relies on the application being in its running state for testing.

    Software Composition Analysis (SCA)

    Software composition analysis (SCA) is designed to provide visibility into the open source components used in the software. It helps identify any security vulnerabilities, licensing issues or outdated libraries in the open source components.

    SCA works by creating a bill of materials (BOM) that lists all the open source components used in the software. It then compares this list against various databases that track open source vulnerabilities. If a match is found, SCA flags the component, allowing the developers to take necessary actions.

    Endpoint Detection and Response (EDR)

    Endpoint detection and response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. EDR tools continuously monitor endpoint and network events and record the information in a central database where further analysis, detection, investigation, reporting, and alerting take place.

    EDR is like a surveillance system for your DevOps pipeline. It keeps an eye on endpoint activity, and if it detects a potential threat, it alerts developers and security staff. EDR is not just about detection; it also provides tools for responding to security incidents. It helps isolate affected systems, block malicious activities and even roll back systems to their pre-attack state.

    Container Security Tools

    In a DevOps environment that increasingly relies on containerization, container security cannot be overlooked. Container security tools provide a means to enforce security policies and protect containerized applications.

    These tools offer functionalities like image scanning, runtime protection and network segmentation. Image scanning helps identify vulnerabilities in the container images. Runtime protection monitors the container’s activities in real-time, looking for any signs of compromise. Network segmentation allows for isolating containerized applications, thus limiting the blast radius in case of a security incident.

    Best Practices for Securing the DevOps Pipeline

    Integrate Security Early (Shift Left)

    The concept of ‘shifting left’ in DevOps refers to integrating security measures early in the development process. Instead of treating security as an afterthought, it becomes a part of the software development life cycle from the get-go.

    Implementing security early allows us to identify and address potential vulnerabilities before they become a significant issue. It saves us time and resources by preventing security breaches instead of responding to them. Besides, it fosters a proactive approach to security, emphasizing prevention over remediation.

    SAST and DAST are useful in integrating security early. SAST tools analyze code in its static state to identify vulnerabilities, while DAST tools test applications in their running state to detect security flaws.

    Automate Security Processes

    Automated security scans can be incorporated into the continuous integration/continuous delivery (CI/CD) pipeline. Each time a code push occurs, these scans are triggered, allowing for immediate feedback on potential security issues. Automated scans can detect a broad range of vulnerabilities, from code defects to configuration errors.

    Configuration management tools like Chef, Puppet, Ansible and Terraform can help manage configurations and enforce security policies. They ensure that all systems are configured correctly and consistently, reducing the risk associated with manual configuration.

    Regular Security Audits and Compliance Checks

    Regular security audits and compliance checks are essential in securing the DevOps pipeline. They provide an opportunity to review and update security measures, ensuring they are effective and up-to-date.

    Security audits should be comprehensive, covering all aspects of the DevOps pipeline. They should evaluate security controls, identify potential vulnerabilities, and recommend remedial measures. Compliance checks ensure that security practices align with relevant regulations and standards.

    In conclusion, securing the DevOps pipeline requires a holistic approach that integrates security into every aspect of the development process. It involves shifting security left, automating security processes, conducting regular audits and compliance checks and fostering a culture of collaboration.

  • Dell Brings DevOps to Edge Computing Environments

    Dell Brings DevOps to Edge Computing Environments

    Dell Technologies today updated its edge computing platform this week to make it simpler to programmatically provision infrastructure using DevOps best practices.

    Phil Burt, senior director of project management for edge computing at Dell Technologies, said version 2.0 of Dell NativeEdge adds additional declarative blueprints based on YAML files and the Topology and Orchestration Specification for Cloud Applications (TOSCA) framework.

    Blueprints for Telit, Litmus and PTC for manufacturing use cases, Deep North for retail, Dell Streaming Data Platform for analytics and Rancher Labs K3s for Kubernetes environments are provided.

    Those blueprints make it simpler to either deploy applications on a lightweight operating system that Dell developed optimized for edge computing platforms or any other software stack an IT organization may prefer, he added.

    Dell is also adding support for the virtual Trusted Platform Module (vTPM) and UEFI Secure Boot capabilities to apply zero-trust IT principles to edge computing platforms using hardware-based cryptography and secure storage for encryption keys, certificates and passwords.

    Finally, Dell is also making available a three-year subscription plan for NativeEdge to lower the total cost of deploying edge computing platforms.

    Dell relies on virtual machines it developed for edge computing platforms to deliver software. IT teams can then opt to deploy monolithic applications or container-based applications running on an instance of Kubernetes deployed as an extension of the virtual machine provided by Dell. Those platforms can then also automatically connect to a network to provide the connectivity required.

    Regardless of approach, Dell is providing a method to programmatically orchestrate the management of highly distributed edge computing environments, noted Burt.

    In the longer term, Dell is also researching how to apply generative artificial intelligence (AI) to the management of edge computing environments using the data its monitoring tools provide, he added.

    While edge computing has been around in one form or another for decades, as more organizations start to process and analyze data at the point where it is created and consumed, the number of applications deployed at the network edge has increased substantially. As such, the number of applications that need to be built and deployed at the edge using DevOps best practices is growing exponentially. In fact, managing those workloads is only going to become that much more challenging as more AI models are deployed at the network edge.

    Of course, not every workload at the edge is managed by an IT team. For years, many organizations have relied on operational technology (OT) teams that have historically deployed applications at the network using manual processes. Organizations that embrace DevOps practices to automate the deployment of workloads at the edge will naturally have to navigate some cultural issues alongside the technical challenges encountered when programmatically deploying software.

    It’s not clear how much software will be running at the network edge in the years ahead, but as the capabilities of the IT infrastructure made available continue to increase, so will the complexity of the applications that will be deployed. The challenge, as always, is going to be finding the best way to manage all that distributed software at what will soon be an unprecedented level of scale.

  • AWS Cost Management in 2024

    AWS Cost Management in 2024

    AWS cost management involves strategies and practices aimed at controlling and optimizing the expenses associated with using Amazon Web Services (AWS). As businesses scale and diversify their use of AWS services, it becomes crucial to manage costs to ensure cloud expenditures remain aligned with business objectives and budgets. Effective cost management in AWS encompasses understanding billing and account structures, monitoring usage and costs in real-time and making informed decisions about resource allocation and deployment.

    At the core of AWS cost management is the ability to visualize and analyze cloud spending. AWS provides detailed billing reports and cost management tools that enable users to track their usage patterns, identify trends and pinpoint areas of inefficiency. Many organizations use third-party tools to get more detailed insights and savings recommendations. This data-driven approach allows organizations to adjust their cloud usage to avoid unnecessary costs, such as by shutting down idle resources or choosing more cost-effective service options.

    Furthermore, cost optimization techniques, such as selecting the appropriate pricing models (e.g., Reserved Instances, Savings Plans), optimizing resource utilization (e.g., scaling resources to match demand) and applying cost allocation tags for granular tracking, are critical components of AWS cost management. These practices help businesses allocate cloud costs accurately across departments or projects, enabling better planning, budgeting and accountability.

    The Importance of Cloud Cost Optimization for DevOps Teams

    Cloud cost optimization is crucial for DevOps teams to ensure efficient resource utilization and cost-effectiveness in cloud environments. As cloud infrastructure becomes more complex and dynamic, DevOps teams face the challenge of balancing performance, scalability and cost. By adopting cost optimization strategies, teams can identify wasteful spending, optimize resource allocation and ensure that cloud investments align with business goals and operational requirements.

    For DevOps teams, cloud cost optimization involves continuous monitoring, analysis and adjustment of cloud resources. This iterative process allows for the fine-tuning of systems to achieve optimal performance without overspending. Techniques such as auto-scaling, choosing the right instance types and employing cost-effective cloud services are part of this optimization. 

    Additionally, implementing budgeting controls and cost alerts helps prevent unexpected expenses, enabling teams to allocate resources more efficiently and respond quickly to changes in demand. Through effective cost optimization, DevOps teams can contribute to the overall financial health of an organization by maximizing the value of cloud investments while supporting rapid development and deployment cycles.

    AWS Cost Management Best Practices in 2024

    Cloud cost management is evolving. Here are some of the best practices that will become more important in 2024 and beyond.

    Adopt Serverless Architectures Where Appropriate

    Serverless architectures, also known as function-as-a-service (FaaS), allow developers to build and run applications without having to manage any servers. This means you only pay for what you use, which can significantly decrease costs when compared to traditional server-based architectures.

    In addition, serverless architectures can scale automatically to meet demand, eliminating the need for manual intervention. This can free up valuable time for your IT team to focus on other important tasks. Furthermore, serverless architectures are highly flexible, allowing for rapid development and deployment of new features and applications. This can significantly reduce time-to-market, which can provide a competitive advantage in today’s fast-paced digital economy.

    Utilize Spot Instances for Flexible Workloads

    Another effective strategy for AWS cost management is to utilize Spot Instances for flexible workloads. Spot Instances are spare AWS EC2 instances that are available at up to 90% off the On-Demand price. This means you can significantly reduce your AWS costs by strategically bidding on and using Spot Instances when demand is low.

    However, it’s important to note that Spot Instances are not suitable for all workloads. They are best suited for flexible, interruptible workloads that can withstand occasional downtime. This includes tasks such as batch processing, data analysis and non-critical background tasks.

    In addition, it’s crucial to have a robust strategy in place to handle Spot Instance interruptions. This can include setting up Auto Scaling Groups, using Spot Fleet or leveraging third-party tools. By effectively managing Spot Instances, you can significantly reduce your AWS costs while maintaining operational efficiency.

    Implement FinOps Principles

    FinOps, or cloud financial management, is a set of principles and best practices designed to help organizations manage and optimize their cloud costs. Implementing FinOps principles is a critical component of AWS cost management in 2024.

    FinOps involves three key principles: Visibility, optimization and governance. Visibility means having a clear understanding of your cloud usage and costs. This can be achieved through comprehensive tagging, detailed cost reporting and regular cost reviews.

    Optimization involves ensuring that you’re using your cloud resources efficiently. This can involve right-sizing your instances, leveraging savings plans and reserved instances and automating your resource management.

    Governance involves setting up policies and procedures to manage your cloud costs. This can include setting up budget alerts, implementing cost approval workflows and regularly auditing your cloud usage and costs.

    Leverage AI for Cost Optimization

    Leveraging artificial intelligence (AI) for cost optimization is a growing trend in AWS cost management. AI can analyze vast amounts of data quickly and accurately, providing valuable insights into your cloud usage and costs.

    For example, AI can identify inefficiencies in your cloud infrastructure, such as underutilized instances, unnecessary data storage, or expensive data transfer. By addressing these inefficiencies, you can significantly reduce your AWS costs.

    In addition, AI can provide predictive analytics, allowing you to forecast future cloud usage and costs. This can help you plan your budget more accurately and make informed decisions about resource allocation.

    Use Sustainable Computing to Reduce Costs

    Sustainable computing, or green computing, is the practice of using computing resources efficiently while minimizing environmental impact. By adopting sustainable computing practices, you can not only reduce your environmental footprint, but also reduce your AWS costs.

    One strategy is to use energy-efficient instances, such as those powered by the AWS Graviton2 processor. These instances deliver superior performance while consuming less power, resulting in lower costs.

    Another strategy is to utilize AWS’s carbon footprint tool, which can help you measure the carbon emissions associated with your AWS usage. By reducing your carbon emissions, you can reduce your environmental impact and potentially qualify for carbon credits, which can offset your AWS costs.

    In conclusion, AWS cost management in 2024 requires a comprehensive approach that includes adopting serverless architectures, utilizing Spot Instances, implementing FinOps principles, leveraging AI and using sustainable computing. By following these best practices, you can effectively manage your AWS costs, optimize your cloud infrastructure and ensure the maximum return on your cloud investments.

  • Arm Extends Processor Architecture to Transform IT

    Arm Extends Processor Architecture to Transform IT

    Arm today extended its processor portfolio to add two offerings that increase the performance-per-socket provided by 50% and performance-per-watt provided by 20%, respectively.

    Part of the Arm Neoverse Compute Subsystems (CSS) family of processors, these third generation Neoverse IP processors include an Arm Neoverse CSS V3 design to improve performance and Arm Neoverse CSS N3 design to improve energy consumption. Arm, for example, envisions the first instances of the N3 being used in networking and data processing units (DPUs) that require thermal design power measurement of as low as 40 watts.

    Dermot O’Driscoll, vice president of product solutions for the Infrastructure Line of Business at Arm, said Arm is already working with partners to manufacture these next-generation processors that will find their way onto system-on-chip (SOC) subsystems. Arm assumes responsibility for configuring, optimizing and validating a complete compute subsystem for key use cases on behalf of its partners, he noted.

    As part of that effort, Arm is continuing to work with partners to provide early access to SoCs to enable their software development teams to construct applications using simulation and emulation tools as next-generation platforms are being developed and deployed, he added.

    That approach helps ensure that software that is optimized for these processors is available at the time when SoCs become available, noted O’Driscoll. Variations of those Arm processors now routinely show up everywhere from the network edge to cloud computing environments to provide IT teams with an alternative to x86 processors that, so far, are not able to match the price/performance of Arm processors that are also more energy efficient.

    DevOps teams are under more pressure than ever to improve application performance without increasing the overall carbon footprint of their IT environments. Achieving those goals will require everything from more energy-efficient processors to modernized software that makes optimal use of IT infrastructure resources, especially as more inference engines are deployed to run artificial intelligence (AI) models, noted O’Driscoll.

    The challenge right now is many DevOps teams lack the tools needed to track overall energy consumption within the context of their application environment, but as DevOps continues to evolve, it will only be a matter of time before energy consumption metrics become a standard element of an observability platform being relied on to optimize DevOps workflows.

    In the meantime, as IT infrastructure environments continue to evolve, IT teams should expect to be deploying applications on a wide range of Arm, X86, graphical processor units (GPUs) and other classes of processors designed to optimize specific types of workflows. At the same time, Arm is advancing the development of “chiplets” that are optimized to run specific types of workloads within a larger SoC rather than deploying different platforms to run a specific class of processors.

    It may take a while for IT teams to wrap their arms around all the different processor options that are now at their disposal, but as the number of processor architectures being used continues to expand, the need for DevOps expertise will continue to increase.

  • Why DevOps is Key to Software Supply Chain Security

    Why DevOps is Key to Software Supply Chain Security

    DevOps is designed to increase business value and responsiveness through rapid, high-quality service delivery, made possible through fast-paced, iterative IT service delivery. The term DevSecOps emerged as a way to remind us that security was always intended to be part of the software delivery process. However, with the barrage of attacks on the software supply chain showing no signs of abating, the question now is whether even the tightest DevOps pipelines can maintain the pace-protection balance.

    It’s important to note that the term “software supply chain” has been used primarily to refer to the tools and processes used to build and deploy software applications. Now, however, with the rise of infrastructure-as-code (IaC), the term also refers to tools and processes used to build and deploy IT infrastructure.

    Meet Mandates, Reduce Risk

    Software supply chain attacks such as SUNBURST, HTTP/2 Rapid Reset or the breaches associated with the MOVEit vulnerability have fed news cycles for the last few years, and that likely won’t change anytime soon. Attacks on the software supply chain increased 742% since 2020. What we are seeing as a result are new concerns about supply chain security and DevOps requirements. This has led to confusion and often a mish-mash of tooling that may exacerbate rather than mitigate supply chain security issues.

    Arguably the most impactful salvo over the software supply chain security line was president Biden’s 2021 Executive Order 14028, which established new mandates, including the delivery of SBOMs, as minimum requirements for software used by the U.S. federal government. More recently, the FDA has mandated that “all medical devices running software must create and maintain” SBOMs. I expect to see government and industry requirements increase over time.

    These are just a couple of relatively recent examples. There are many more—and no doubt many more to come.

    So, if you’re moving at the speed of DevOps, how do you address these current and future mandates for software supply chain security, as well as the continually emerging vulnerabilities and attacks? I would venture to say that only by moving at the speed of DevOps—and within the parameters of the DevOps model—can organizations not only meet mandates but also effectively reduce risk for the business.

    Indeed, it’s not a matter of whether DevOps is viable within the current security climate but what requirements need to be added to support and enhance current DevOps work.

    New Guidelines, New Processes, New Tools and New Data

    In response to these new threats and regulations, the software community has been working on developing and updating guidelines to help organizations improve the security of their supply chains—for example, SLSA, NCSC UK supply chain security guidance and NIST cybersecurity supply chain risk management. However, these new guidelines can be complicated and require new processes and new tools.

    Before adding any new tooling or changing any processes, it’s critical to examine existing tools to determine whether and to what extent they satisfy supply chain security mandates. Organizations must also evaluate how well existing processes work to protect the business, then strategically add/subtract from there as needed.

    No matter what solutions are leveraged, more and different tools generate reams of more and different data. What’s important — and to whom? How do I manage the data? When can I trust it? Where do I store it? What problems does the new data help me solve? Organizations will need a way to effectively sift this information and deliver the right data to the right teams at the right time. To preserve the ability to quickly and continuously innovate, it will be important to focus on shifting security left as well as integrating automation whenever and wherever possible.

    As new security metadata becomes available, such as from SBOMs, new solutions for managing that metadata will be key. An open source initiative sponsored by Google, GUAC is designed to integrate software security information, including SBOMs, attestations and vulnerability data. Users can query the resulting GUAC graph to help answer key security concerns, including proactive, preventive and reactive concerns.

    Continue to Shift Security Left

    Another way that organizations can maintain their DevOps momentum while protecting the software supply chain is to continue to invest in shifting security left in the software supply chain. The software community has been talking about this for some time, but many organizations struggle to implement impactful changes. Security teams must work to understand how software is built and collaborate with development and DevOps teams to ensure that improvements are made to both application and infrastructure-as-code supply chains.

    We need to go beyond shift-left vulnerability analysis to ensure that we are evaluating the quality of configuration-as-code (for both applications and infrastructure), that we are taking advantage of new recommendations, and that we are leveraging new attestation solutions designed to work with pipelines such as sigstore and Tekton Chains. After all, the sooner an issue is discovered, the more quickly it can be addressed and the less disruptive and costly it is to fix it.

    No One-Size-Fits-All Solution

    While all of these solutions mentioned here are helpful, there is no single product or framework that will enable organizations to maintain the security-innovation balance. Success, rather, will require a focus on agility, flexibility and effective communication and collaboration—the very hallmarks of the DevOps model.

    Rather than being obviated by the demands of software supply chain security, DevOps provides the opportunity to integrate the kinds of protections that can prevent or mitigate supply chain vulnerabilities and breaches. DevOps also enables organizations to quickly and effectively respond to new threats and new requirements.

    With that said, there’s no doubt that organizations will need to think differently about how they manage software security, including the strategic evaluation and integration of tools that will meet current and future regulatory mandates and, more importantly, protect the business over time. Organizations may also need to think about weighing security over speed, at least until all of the pieces of the software supply chain protection puzzle are in place—but also when future circumstances warrant a fresh look at how to best balance the DevOps pace-protection balance.