As the majority of businesses are increasingly moving to the online world, employees keep working remotely and more cyberattacks keep happening all over the globe, there is no doubt that embracing DevSecOps should be the new normal for every company. Organizations need to be able to adopt DevSecOps practices and adapt to new and evolving threats in order to protect their data and systems from malicious attacks.
At Cybersecurity 2021: The New Normal Virtual Summit, taking place March 4 and 5, the brightest minds in the security and IT industry will come together to discuss new security threats, empower DevOps teams with the latest security tools and provide practical tips and guidance to help developers and ops teams make the right security decisions to keep their data secure.
The two-day virtual event features thought-provoking discussions, networking opportunities and educational sessions focused on:
DevSecOps tools and practices
The main challenges of security and development teams when it comes to AppSec
Identity and Access Management (IAM)
Passwordless and the long-term future of identity management
Policy-as-Code and how it impacts security
How security threats changed with COVID-19 and what to expect in 2021
How to manage AppSec
How to mitigate API vulnerabilities
How to break the silos and advance towards DevSecOps maturity
How to expand your security program through low-to-no cost initiatives
Time series database for security monitoring
Machine identity management
Top 10 Hacks From the Past Decade
Runtime observability techniques for security and compliance
Securing AWS credentials on DevOps machines
Cybersecurity 2021 features an outstanding lineup of industry leaders, including:
Ira Winkler, author and president at Secure Mentem
Chenxi Wang, founder and general partner at Rain Capital
Ron Gula, president at Gula Tech Adventures
Richard Stiennon, founding member of The Analyst Syndicate and chief research analyst at IT-Harvest
Joe Levy, CTO at Sophos
Rajat Bhargava, founder and CEO at JumpCloud
Myla Pilao, head of security research communications for TrendLabs at Trend Micro
Upasna Gupta, senior product marketing manager for Prisma Cloud at Palo Alto Networks
Julian Waits, general manager of cyber business unit and public sector at Devo
Joseph Feiman, chief strategy officer at WhiteHat Security
Ian Murphy, founder and CEO at CyberOff
Mike Jones, security researcher at H4unt3d Hacker Podcast
Rhys Arkins, director of product management at WhiteSource
TJ Jermoluk, co-founder and CEO at Beyond Identity
Jim Ducharme, general manager of the anti-fraud business unit at RSA
Attendees will have the chance to enter a raffle for a chance to win a free copy of “You can Stop Stupid” by Ira Winkler and another one for a free copy of “Security Yearbook 2020” by Richard Stiennon. There will be valuable resources available for download and attendees will be able to interact with sponsors to learn more about their security tools and services.
John Worrall, ZeroNorth CEO, said the analytics tool pulls vulnerability data generated by a variety of security tools to provide both DevOps and cybersecurity professionals with a single source of truth for assessing security within an application environment.
The ZeroNorth platform is designed to enable IT organizations to orchestrate multiple vulnerability scanning tools within the context of a larger DevSecOps workflow, and can apply analytics to a large pool of security data. That data can be viewed in the context of specific groups, such as a business unit or specific application development and deployment team, or within the context of whichever application generates the most revenue for the business, Worral said.
Additionally, the Advanced AppSec Risk Analytics module will surface types of vulnerabilities detected and the vulnerabilities most encountered, ranked by criticality, along with other trends in types and number of vulnerabilities detected/remediated, such as the number and criticality of vulnerability findings per specific scanner. It also tracks the applications and entities scanned, number of vulnerabilities detected per application/entity and the applications/entities that have the highest risk.
Armed with that analytics data, Worral said it becomes easier for IT teams to prioritize and focus their efforts, in addition to identifying areas of the business that may need additional cybersecurity resources and training. IT leaders can also get a snapshot view of the top application security risks to better assess the organization’s overall security posture, Worral noted.
The Advanced AppSec Risk Analytics module will also surface vulnerability remediation bottlenecks spanning multiple applications within the context of a software development life cycle (SDLC), Worral added. Longer term, Worral said the data collected by the ZeroNorth analytics application will also create an opportunity for the company to apply machine learning algorithms to DevSecOps.
In general, Worral said the only viable path toward achieving DevSecOps is to foster more collaboration between developers and cybersecurity teams. Getting those teams on the same page in terms of the security data that needs to be analyzed is a crucial first step, Worral said.
It’s still early on in the adoption of DevSecOps best practices within organizations, however, it’s apparent a lack of cohesion between software developers and cybersecurity teams about which vulnerabilities to prioritize is a major source of dysfunction. Cybersecurity teams tend to create long lists of vulnerabilities discovered within applications without providing much context. Developers are then left to weigh, on their own, when to address a vulnerability versus focusing on writing additional code needed to make an application delivery deadline. Developers take potential vulnerabilities seriously, but there are only so many hours in a day to write code.
Unfairly or not, developers are being held more accountable for application security. The challenge – and the opportunity – is to find a way to make the entire DevSecOps workflow a whole lot less contentious by helping DevOps and DevSecOps teams more aware of which tasks should be prioritized when.
As we close out 2020, we at devopsy.kinsta.cloud wanted to highlight the five most popular articles of the year. Following is the second in our series of the Best of 2020.
As a novice developer, you may be thinking about learning a programming language and starting a fantastic career.
In fact, this question on Reddit inspired the whole article:
The thing is, programming languages represent certain philosophies of its authors and tailored to certain types of problems, i.e., there is no such thing as “the best programming language.”
In this article, I describe major programming languages according to its popularity, usage, demand and ease of learning.
There is market demand and a potential salary range for each language. These are linked to specific personal goals and prior programming experience.
What Questions Should You Ask Yourself Before Diving in?
What kind of projects do you want to work on? If career flexibility is a priority, then learning Python or C++ will allow you to work with different types of programming. If your passion is web development, learning JavaScript or PHP is a smart choice.
How much experience do you have? You won’t want to switch to an advanced programming language, such as Rust, if you don’t have previous programming experience. If you’re new to a language, you’ll want to start at a higher level and be intuitive.
What are your career goals? Do you want to become a freelancer, working for an existing company or work with a startup? Are you trying to be better in your current role?
If you plan to get a job in a large technology company, learn the programming languages they use, e.g., NASA, Google and Facebook use Python.
Many programming languages have similar syntax and qualities—so if you learn one of them, it will be easier for others. The more languages you know, the more flexibility you have in your career and development projects.
In the list below, we will look at the best and most popular programming languages for many of the most common uses, including web development, mobile development, game development and more.
Top Five Programming Languages to Start Your Career
Java
It is probably the best programming language if you are looking for a common language that will be useful in various situations. As for choosing a programming language to learn, there are many resources for people who are thinking about learning Java. Java was released in 1995, which makes it one of the oldest programming languages. It is used on a wide range of platforms and operating systems, including Microsoft Windows, macOS, Linux and Solaris.
That means there will always be jobs for Java developers, making it (perhaps) the best programming language to learn.
Research shows that Java developers can expect to earn between $80,000 and $130,000 per year. If you are thinking about learning your first programming language, think about taking an online course, for example, CodeGym. This course, which contains 40 levels of game-play classes, will teach you all the basics you need to know to start programming in Java. It’s easy to follow—even if you don’t have programming experience—and it is worth checking out.
It is also best used for back-end web development, mobile development and desktop applications.
JavaScript
This programming language works on several platforms. Therefore, it is ideal for websites that will be accessed through various devices and browsers. It is suitable for anyone who designs websites with effects, interactive features, animations and pop-ups—standard features on virtually any brand website these days. If you want to work in a creative environment and add more experience to the user, this is a coding language to learn.
JavaScript is the number one language on the web. The growth of frameworks such as jQuery, Angular and React JS has made JavaScript even more popular.
If you just can’t stay away from the internet, it’s better to learn JavaScript sooner than later. I consider this JavaScript Masterclass an excellent place to start. For cheaper alternatives see this list of free JavaScript courses.
It is also best used for front-end and back-end web development
Learning PHP
PHP—another old language, first appeared on the stage of programming around the same time as Java in 1995. It is a general-purpose language widely used for web development from the early days of the web.
Unlike other languages, which can be quite tricky to use with HTML, PHP can be built directly into the HTML code block. Start and finish instructions are used to enter and exit PHP, making it very easy to use. Although PHP is not as popular as Python or Java, it can be a suitable language to learn because of its simplicity. It is convenient for beginners and you can write your first scripts just a few hours after you start your PHP course.
Again, the popularity and wide use of PHP means that work opportunities are relatively easy to find. An average PHP developer can expect to earn around $80,000 per year. However, there is potential to make much more as a freelancer.
Take an advanced PHP course, which will teach you everything you need to know to find your first job as a programmer. It doesn’t matter if you’re studying your first language, or if you’re an experienced developer looking for the best programming language to add to your resume—PHP is a great choice!
Python is a useful step toward more advanced forms of programming languages. Python provides a high degree of website readability and is used by companies such as Reddit, Google and even NASA.
It is seen as entry-level programming that does not require too much prior knowledge. It may be ideal for relatively new professionals to help small businesses that want to expand their presence on the internet without having to resort to advanced professionals. Python is a relatively simple programming language that is very easy to pick up if you already have programming experience. That makes it one of the best to learn if you are already working as a developer and want to increase your resume quickly.
The code on Python is designed to be readable. It uses a lot of white spaces, which makes it a pretty easy language to learn while you’re studying it.
One of the most useful Python’s features is its compatibility with data analysis systems and scientific applications. It is a popular language in scientific communities and is often used by researchers to write their programs.
An average Python developer can expect to earn about $100,000 per year. However, there is little room for wage growth.
If you think Python is the best programming language to further your career, consider enrolling in a BitDegree course. The Python Basics Course includes everything you need to know to start writing programs on Python and contains less than four hours of lecture material.
It is best used for back-end web development, desktop applications, and data analysis.
C#
C# is another object-oriented, general-purpose language based on C. It is considered a suitable programming language for building applications native to Microsoft platforms. Microsoft initially developed it as part of its .NET framework for building Windows applications. C# uses a syntax similar to other languages such as C++. Therefore, it is easy to pick it up if you come from a different C family language.
C# is not only a suitable language for developing Microsoft applications, but also a language used by mobile device developers to build cross-platform applications on the Xamarin platform. Besides, anyone interested in VR development should think about learning C# as it is the recommended language for building 3D and 2D video games using the popular Unity game engine, which produces one-third of the best games on the market.
If mobile application development or virtual reality is your business, consider learning C#. Many mobile device developers use C# to create cross-platform applications on the Xamarin platform. Although it is not the most convenient programming language for beginners.
As was mentioned at the beginning, there is no best programming language to learn. The best language for you will depend on your experience, your current knowledge and reasons to learn a new language.
While there are many options, you should be able to narrow down your language choice by what you want to learn from it.
Remember to consider the following:
Programming experience, because some languages, such as Python and Java, are more suitable for beginners who have never programmed before.
What you want to do with the language. Different languages are used for different things.
How much time do you have? Some languages are much more demanding than others.
Make your choice based on your interests and the type of software development you want to get into. Here is a brief summary:
External web development: JavaScript.
Internal web development: JavaScript, Java, Python, PHP.
Mobile development: Java, C#.
Game development: C#.
Desktop applications: Java and Python.
To Sum Up
Programming and developer communities are evolving faster than ever.
Various new programming languages are emerging that are suitable for different categories of developers (beginners and experts) as well as for other applications (web applications, mobile applications, game development, distributed systems, etc.).
This list simply scratches the surface of existing programming languages. Still, the simple fact is that with the right coding skills, you will be perfectly prepared to offer valuable technical support and become an asset to any organization.
VMware has acquired SaltStack as part of an effort to unify IT and security operations management. The announcement was made during the online VMworld 2020 conference this week.
SaltStack has developed an open source IT automation platform to automate IT operations. In recent months it has been extended to also address security and compliance management.
At the same time, VMware released a bevy of updates to its security portfolio, including VMware Carbon Black Cloud Workload. That offering combines vulnerability reporting with workload hardening software for both legacy platform and microservices-based applications deployed on Kubernetes clusters. It also includes elements of AppDefense, which VMware developed to harden workloads running on VMware vSphere platforms.
VMware also announced VMware NSX Advanced Threat Prevention, which combines NSX Distributed IDS/IPS with malware detection software and network traffic analysis (NTA) technologies acquired from Lastline Inc.
Finally, VMware announced it has committed to reselling a secure web gateway from Menlo Security as part of the VMware SD-WAN portfolio and formed an alliance with Zscaler to manage security as a service.
SaltStack provides VMware with an IT automation framework that can be applied across multiple clouds running virtual machines and containers. The current vRealize IT automation framework is optimized for instances of VMware vSphere.
Tom Corn, senior vice president for the Security Business Unit for VMware, said VMware’s entire approach to security is predicated on making it easier for IT operations teams rather than cybersecurity professionals to implement security controls. There are simply not enough cybersecurity professionals available to implement cybersecurity controls when DevOps teams are rolling out and updating application workloads multiple times a week, he said.
Cybersecurity teams will continue to define what controls will need to be put in place, but it will be left to the IT operations teams to implement those controls in much the same way responsibility for application security is now also being shifted left as part of best DevSecOps practices.
Corn said it’s clear IT security is a team sport that requires greater collaboration among IT operations teams, developers and cybersecurity professionals. VMware has been investing in security technologies with an eye toward making it easier for IT operations teams to automate security operations in much the same way any other IT task is being automated, he noted.
That convergence isn’t going to occur overnight. There are many challenges including culture. Many cybersecurity professionals view IT operations and developers as being equally responsible for many of the root causes of a cybersecurity breach. It may be a while before cybersecurity teams have enough confidence in the ability of IT administrators and developers to proactively address cybersecurity issues before and after applications are deployed in production environments.
Of course, there’s no alternative. The days of waiting two months or more for a security review as part of a waterfall development process are over. Security, like it or not, needs to become as agile as the rest of IT.
Today at MediaOps, we are really excited to announce the launch of RecruitOps, a new and exciting way for companies to find the right candidates for hard-to-fill technical positions. It’s also a great place to find your next career stop.
Sitting at the nexus of a worldwide audience of the biggest DevOps, cloud-native and cyber talent pool in the world—and a destination where organizations ranging from startups to enterprises come to stay relevant—devopsy.kinsta.cloud and other MediaOps destinations provide the perfect partner for this mission.
The Usual Suspects Don’t Work
For the last three or four years, I’ve been receiving multiple calls every week asking if we can help organizations find talent to fill their open reqs. Finding and hiring good DevOps, cloud-native and cyber talent is difficult and expensive and can be frustrating. Many companies have discovered that job boards and LinkedIn-type solutions create lots of noise, yielding slim pickings of viable candidates. Most candidates are misfits, either skills-wise or geographically.
Also, traditional recruiters are not only expensive but they also operate in factory mode, often flooding your inbox with resumes of candidates they haven’t actually vetted first. There is a better way to do this—we think we have cracked the formula.
By the same token, I receive messages on LinkedIn every day from people I don’t even know asking to help them find a DevOps or cyber job. The process of applying and being one of many résumés in a pile is not something they excel at navigating.
Over the years we have tried job boards and relationships with large job fulfillment organizations. None of them were very successful. They were just not an effective way of matching our large audience of DevOps professionals with the many companies and organizations looking to find the right talent to fill their technical roles.
RecruitOps: A Better Way
My co-founder at MediaOps, Martin Logan, has lived this dilemma for years now. His full-time roles have been in building large engineering, product and DevOps teams in the online travel, retail, mortgage and gaming industries. He has tried every method you can think of.
What Martin discovered was that the most effective method was to work with a small group of recruiters. These recruiters had to be very familiar with the technology and technical requirements of a requested position. They had to be able to talk the technical talk and understand it. More than that, though, they had to understand the culture and environment in which the candidate would work and what it would take to be successful there. This kind of information is best gained by developing a strong personal relationship with the hiring manager and the manager of the prospective technical position.
That is the model we have built RecruitOps around. Our founding recruiters are people Martin has personally invested months and years in training. They know how to find the perfect fit for your technical roles. They know how to work with your organization and what it takes to be successful. They will not throw résumés at the wall to see what sticks.
This is not a high-volume, résumé factory. At RecruitOps our recruiters are very familiar with the technical requirements that candidates must possess. They spend a lot of time with the hiring manager and position manager to understand what the perfect candidate must have skills-, temperament- and team fit-wise.
Our RecruitOps recruiters then spend a lot of time getting to know the candidates before they send them to you. Combining devopsy.kinsta.cloud, Security Boulevard, Container Journal and even the DevOps Institute, our pool of talent for these technical jobs is deeper than just about anyone. We will find you the perfect fit guaranteed, or you don’t owe anything.
No Risk to You
Yes, that is another feature of RecruitOps: There is no risk on your end. If our candidate does not work out, you don’t owe anything. There is no money upfront—it’s a risk-free proposition all around. You literally have nothing to lose and great technical team members to gain.
Does this sound like a better way for you? If so, head over to RecruitOps.com and get started today.
Likewise, if you are looking for your next career move, head over to RecuitOps and put yourself on our radar. It is the first step in working with us to find you the perfect fit as well.
In the Middle of a Pandemic?
I know what some of you are saying: Wow, we are in the middle of a COVID-induced economic catastrophe. Isn’t this an odd time to start a recruiting business? You may be right. But we think this is the perfect time to start RecruitOps. Companies are realizing that there is actually some great talent available. Still hard to find, but more available than six months ago, perhaps.
Also, organizations that are digitally transforming need help from technical people to make these transformation happen in a secure manner. We are betting smart organizations are adding great talent if they can get it because great talent is always in demand.
Are you a smart organization looking to add great talent? Head on over to RecruitOps.com.
SonicWall has added a line of multi-gigabit switches to its software-defined (SD)-branch offering that unifies the management of wireless access points and firewalls that include software-defined wide area network (SD-WAN) capabilities.
Dmitriy Ayrapetov, vice president of platform architecture for SonicWall, said the switches will replace a series of switches that SonicWall had been reselling from Dell Technologies. SonicWall spun out of Dell at the end of 2018 after being acquired in 2012.
SonicWall has been making a case for unifying the management of remote office networking via a central management console dubbed Capture Security Center. To achieve that goal, the company embedded SD-WAN capabilities in its firewalls while expanding its portfolio to include wireless access points and switches.
Ayrapetov said in the wake of the COVID-19 pandemic, interest in centralizing the management of remote offices has increased for two reasons: First, IT teams are no longer inclined to travel to remote offices unless there is an absolute requirement; and second, following the economic downturn brought on by the pandemic, there’s more interest in reducing costs—an issue SonicWall addresses by consolidating the management of networking and security.
As part of its SD-Branch offering, SonicWall also makes available client software in multiple forms, providing IT teams with capabilities such as URL filtering to block access to malicious websites that can be applied to any device on the network, including systems that employees are using to work from home. That capability makes it possible for IT organizations to enforce cybersecurity policies regardless of where employees are located or what network they are using to access IT resources in a branch office, said Ayrapetov.
Longer-term, Ayrapetov said it’s clear organizations are moving toward zero-trust networking architecture to better ensure cybersecurity using SD-WANs and other technologies to access cloud applications. However, in the short-term, most organizations will continue to rely on virtual private networks (VPNs) to access IT resources located in a branch office, on-premises data center or public cloud.
SonicWall has been making a case for its Boundless Cybersecurity platform, which can be broadly applied across a distributed computing environment. At the core of that platform is its Capture Advanced Threat Protection (ATP) cloud sandbox service that relies on deep memory inspection in real-time, machine learning and cyber threat intelligence to identify malware and other potential threats.
As part of that architecture, SonicWall also provides zero-touch deployment capabilities, which eliminate the need for extensive cybersecurity expertise to deploy its appliances and services.
It’s not clear to what degree organizations will be consolidating the management of networking and cybersecurity. However, the smaller the organization, the more likely one team is managing both networking and security. As the number of cybersecurity threats organizations face continues to rise at a time when IT budgets are under massive pressure, chances are high many larger IT organizations soon also will be consolidating the management of networking and security.
The COVID-19 global pandemic has ushered a significant priority shift for the digital workplace. As development teams become completely remote, executive priorities are rapidly adapting to meet the gravity of these unanticipated times.
But, were IT leaders prepared for such a dramatic shift? What are they doing to evolve? To answer these tough questions, let’s turn to the data. A March 2020 study, conducted by Adobe and Fortune, surveyed 200 chief information officers (CIOs) on how their priorities are changing to meet the needs of a global crisis. Here’s what they found.
Remote Work
As it turns out, the majority of enterprises (84%) report they were prepared for remote work, with a slight increase for SMBs, at 94%.
“Like most business leaders, CIOs now have to rethink priorities, or at least reorder them, and we must reinvent ourselves now as virtual leaders,” said Adobe CIO Cynthia Stoddard.
We are living in a golden age of virtual collaboration tools—teams have Slack, GitHub, Zoom, Microsoft Teams and many other options. Yet, 53% of CIOs still cite communication as the biggest hurdle to remote work. Nevertheless, half of the CIOs surveyed reported their organizations are still actively hiring, indicating steady growth for IT.
New Technologies
Regarding technological adoption, some organizations are struggling to keep pace. Twenty percent of CIOs report serious shortfalls in technology tools. Interestingly, less than 25% of CIOs estimated increased financial spending for areas such as public cloud, infrastructure and artificial intelligence/machine learning (AI/ML).
“Indeed, nearly all CIOs (90%) surveyed said they use a public cloud service for at least some of their data, but most is housed on-premises,” said Giselle Abramovich. “Only one in three organizations store half or more of their data in a public cloud.”
One thing most enterprises agree on is the need for better security—seven in 10 anticipated increased financial investments into cybersecurity.
Artificial Intelligence
Only 50% of enterprise CIOs said they use AI in one or more projects (25% for SMB CIOs). However, it seems to be a growing discipline, as 90% of the organizations that have implemented AI have done so in the past year.
Though AI has garnered significant interest, there are hurdles to actual implementation. According to the report, “the biggest issues related to AI include getting data in order, funding and finding the right talent.” With more people online and the importance of distanced communication, it is likely that investments into AI will increase, especially for use in IT support and customer interactions.
“We’re making AI a strategic priority at Adobe. AI implementation is difficult for many organizations because it’s still new to most businesses, and there is a shortage in talent that has a deep understanding of it,” said Stoddard.
Analysis: Impact on DevOps
CIOs are in a unique position. Leaders are reevaluating business practices and also reassessing their technological investments. As the Adobe/Fortune study shows, many companies were prepared for 100% remote work, albeit some more than others.
To endure a COVID-19 economical drought, CIOs are taking action. The report indicates increased investment into remote tools, AI and cybersecurity, while aligning hiring and new infrastructure to reach these goals.
Institutions with a previous investment into cloud infrastructure as well as scalability practices, such as serverless, are likely well-equipped for increased online interaction and unanticipated usages. In this virtual realm, automation is also key to streamline deployments and monitor applications in remote fashions.
Though the report doesn’t differentiate between company types, it’s likely that digitally native enterprises are well-equipped as well. In addition, the trend from physical storefront to “brick and click,” has only been magnified by the current climate, forcing retail and banks to invest heavily in digital technologies and DevOps.
From a DevSecOps standpoint, increased end-user online action means an increased number of threats. Thus, security strategies for containers and service meshes should be reevaluated.
By repositioning priorities, IT can adapt to the new state of interaction. With deliberate execution, CIOs and all executives alike could find themselves on the right side of the river once the economy resumes.
With the rise of DevSecOps comes a whole new need for training and upskilling. It isn’t a secret that the cybersecurity skills gap will only continue to grow. The security skills gap combined with the rise of DevSecOps has introduced hidden challenges organizations must address.
The Rise of DevSecOps
While DevOps accelerates agility and scalability of organizations, it may also expand risks of threats—particularly if security is an afterthought in an organization’s cloud strategy. In a recent survey, 52% of companies admitted to scaling back security measures to meet a business deadline or objective. Similarly, 68% said their CEOs demand that DevOps and security teams prioritize accelerating business processes.
Even when organizations race to release updates despite security consequences, the threat landscape is becoming more complex, faster and automated. In the third quarter of 2018, FortiGuard Labs noted almost 34,000 new malware variants—a 40% increase over the second quarter and a 126% increase over the first quarter. Cyber criminals now use advanced technologies such as artificial intelligence (AI) and swarm technology—as well as DevOps itself—to create single-use malware that targets a particular organization across several points of the attack surface.
Thus, companies have realized that security must be woven into the DevOps approach–hence the birth and rapidly increasing adoption– of DevSecOps.
The Security Skills Gap
At the same time that organizations are embracing DevSecOps, the paucity of skilled IT talent persists. A report from 451 Research on the IT skills shortage notes organizations are facing talent gaps across a range of IT specialties, including database administration (31%), general network administration (36%) and server/systems administration (43%).
The dearth of seasoned cybersecurity professionals looms even larger, with an estimated skills gap of just under 3 million individuals. Understandably, 53% of respondents to a report from ESG admitted to a significant shortfall of cybersecurity skills at their organization. These figures represent the general cybersecurity personnel needed to support and secure traditional network environments, to say nothing of DevOps.
Overcoming the Hidden Challenges
In DevOps, any security implementation that hinders speed will be seen as a threat to their primary objectives. Traditional IT teams and DevOps teams are often at odds here. IT will suggest the use of security tools that DevOps sees as causing bottlenecks, which runs counter to their primary objectives. However, while DevOps may be highly proficient at building applications, they often lack the expertise and skills to do so securely.
An answer to this challenge is to add a cybersecurity specialist to each DevOps team to create a DevSecOps team. This DevOps security specialist (or team of specialists) can guide application developers through the shared responsibility model, helping them stay on track with both development and security requirements. They’re also there to provide strategies for consistent security policies across and between all their cloud workloads and services, all while protecting the DevOps mission of reliability and high performance.
With DevSecOps in place, the team can choose, implement and manage tools that will better equip them to meet the goals of speed and security. Take, for instance, the use of security solutions that are offered as a service (SaaS) or web application firewalls, which can auto-scale. That allows publicly facing web apps to grow as needed, without compromising security. The right tools can also be eased into deployment with minimal effort. Some even have built-in functions that cover security during deployment, maintenance, scaling and for all the fine-tuning that needs to take place throughout ongoing use and development.
Once an organization has augmented DevOps with DevSecOps, teams can integrate security from day one of each new project. DevSecOps team can also develop the necessary cloud security playbooks and ensure that those guidelines are followed. DevSecOps can even directly affect the bottom line when they help prevent violations against regulatory requirements and the fees and penalties that come with them.
Closing the Gap
The fact remains, though, that good skills are hard to find. This makes it harder to have a DevSecOps team in place. Applications being built in or migrated to the cloud need to be protected against new threats that propagate across workloads—and from cloud platform misconfigurations at the user interface and application programming interface levels.
Addressing this challenge requires a concerted effort on the part of both the private and public sectors to develop just-in-time training and education programs to develop cybersecurity skills that are critical for every organization, and furthermore educate for cloud security and DevSecOps practices. More and more organizations are in need of training programs that focus on the cloud security skills necessary to upskill their current and future workforce.
Failure to understand and implement a security strategy can make an organization susceptible to policy and enforcement gaps, as well as risk to business continuity and digital operations, which can determine whether or not your organization is able to thrive in today’s digital landscape.
Proactive DevSecOps
As organizations evolve from DevOps to adding a DevSecOps practice, the talent shortage continues to loom large. This shortage could pose significant security risks to your organization. But, you can play an active role in bridging the skills gap by identifying training programs and certifications available for your teams focused on security. Employees completing these trainings and earning relevant certification can then work with IT security and DevOps teams to provide the security that enables the speed you need to remain competitive.
42Crunch this week announced it has extended an existing alliance with Microsoft to now include support for Microsoft Azure Pipelines for its REST API Static Security Testing Tool. Previously, 42Crunch only provided support for the Microsoft Visual Studio integrated development environment (IDE).
Dmitry Sotnikov, chief product and marketing officer for 42Crunch, said support for the Microsoft IDE assumes that developers will run security tests themselves. By integrating its API security testing tool with the Microsoft continuous integration/continuous delivery (CI/CD) platform, it now becomes possible to make testing APIs for security vulnerabilities part of a DevOps process, he said.
That approach means organizations don’t have to rely on developers to remember to run a security test on their APIs. Instead, security testing of APIs becomes just another gate in the CI/CD process that gets automatically conducted, he noted.
The company has already integrated its API security testing tool with other CI/CD platforms at the request of individual customers. 42Crunch will be moving to make those integrations commercially available in the months ahead, said Sotnikov.
As IT organizations have become more adept at thwarting attacks aimed at end users, cybercriminals are now increasingly focusing their efforts on APIs. Akamai, a provider of content delivery networks, recently reported that from December 2017 through November 2019 it observed 85,422,079,109 credential abuse attacks across its customer base. Nearly 20%, or 16,557,875,875, of those attacks were against hostnames that were clearly identified as API endpoints. Many of those attacks involve, for example, unexpected injections of values to a call made to an API, noted Sotnikov.
The REST API Static Security Testing Tool can locate API contract files in the repository and run more than 200 security checks based on OpenAPI standard requirements, authentication, authorization and data validation. This makes sure that no new or changed API be deployed in production without meeting those standards.
Issues discovered are also prioritized by impact and each issue is accompanied by a knowledge base article explaining the issue, its severity, exploit scenario and suggested ways to fix it.
Sotnikov said the REST API Static Security Testing Tool provides a tangible means for DevOps teams to embrace best DevSecOps processes. Too much of what passes for DevSecOps today amounts to little more than attempting to blame developers for cybersecurity issues, he noted, adding organizations that want to embrace DevSecOps in a meaningful way need to put tools into the hands of DevOps teams that enable them to address vulnerabilities once they are discovered and prioritized.
It’s also critical to provide those tools within the context of existing DevOps processes; otherwise, developers are likely to resist changes to their existing workflow processes, Sotnikov said.
It remains to be seen how DevOps and cybersecurity teams will meld their respective cultures to drive DevSecOps. It is likely cybersecurity teams will continue to define controls and discover vulnerabilities. However, as DevOps teams continue to make security a natural extension of the quality assurance process associated with building any application, the number of vulnerabilities being discovered after an application is deployed in production should decline steadily.
The race to out-innovate one’s competition has led to high performing organizations chasing increased deployment velocities but often ignoring the quality of parts being used to manufacture their applications.
It was 2003 when Bruce Schneier penned, “Today there are no real consequences for having bad security, or having low-quality software of any kind. Even worse, the marketplace often rewards low quality. More precisely, it rewards additional features and timely release dates, even if they come at the expense of quality.” Seventeen years later and it can sometimes feel like we haven’t grown enough.
As nimble organizations aim to deliver new innovations faster, using DevOps principles, the question of how and where security fits into the equation has spawned bigger conversations around what DevSecOps really means. And, in some circles where DevSecOps is even a different principle—security should already be a part of DevOps.
This is why we do the DevSecOps Community Survey every year—to better understand how organizations are adapting, what previous challenges were overcome, what new challenges may have popped up and to examine what approaches are being prioritized within teams to better identify risks. These questions, and many others, are extremely important and it’s why we’re embarking on the seventh annual DevSecOps Community survey. And, we’re looking for you to help us understand that state of DevSecOps.
Since we first started this survey, seven years ago, we’ve seen a consistent maturation of DevOps practices and the combination of automated security. More and more respondents highlight that their practices have evolved and adapted to a DevSecOps mentality—or, that they have the ambition to do so.
That said, we know we’re still in the early stages of so many DevSecOps transformations and while people may recognize the need for governance policies with DevOps, the theory doesn’t always make it into practice. The insights we gain from this survey allow us to provide concrete information back to the community on what those who have successfully transformed themselves are doing well—and what their journey looked like.
For instance, from over 5,500 respondents who took last year’s survey, we saw that more than 47% of them were deploying changes into production multiple times per week. This meant that as adversaries are getting faster at exploiting vulnerabilities, DevOps organizations that can identify cybersecurity risks and remediate them sooner can better defend themselves.
While we’ve learned that security is difficult to ignore when it’s embedded where developers already are, there is a lot more to understand about current practices. The voice of the community these past seven years has been invaluable, and we recognize that the experiences of those in the community can help us learn what resources are needed in order to support this ongoing cultural shift.
In this year’s survey, for the first time, we’re also aiming to understand how responders feel about their jobs and the environments they work in. DevSecOps is a culture and we want to better understand the cultural attributes the elite DevSecOps practices employ.
Please take a few minutes to fill out the 2020 DevSecOps Community survey today; help us help the industry by better comprehending how the DevSecOps community has matured over the past year. And, you may even win one of our prizes—a Macbook, AirPods Pro or an Oculus Quest. Everyone who takes the survey will also receive first look at the results.
Ayrapetov said in the wake of the COVID-19 pandemic, interest in centralizing the management of remote offices has increased for two reasons: First, IT teams are no longer inclined to travel to remote offices unless there is an absolute requirement; and second, following the economic downturn brought on by the pandemic, there’s more interest in reducing costs—an issue SonicWall addresses by consolidating the management of networking and security.
