devopsy.kinsta.cloud

Tag: Cybersecurity

  • 5G Security: Mitigating Threats in the Era of Hyperspeed and Hyperconnectivity

    5G Security: Mitigating Threats in the Era of Hyperspeed and Hyperconnectivity

    5G is one of the hottest industry buzzwords right now, and for good reason. Beyond its ability to deliver massive capacity, it is expected to be one of the fastest and most pervasive technologies of all time, fundamentally changing every sector of the economy.

    In recent years, we’ve lived through 3G and 4G. So what makes this next generation so revolutionary? Put simply, every emerging technology we are collectively excited about—IoT, VR/AR gaming, autonomous cars and smart cities—is enabled through 5G. This is because this next generation of the mobile network will increase the speed of service by extending high bandwidth and connectivity to the edge, a possibility that wasn’t quite there with 4G. 5G will connect everything around us via a network that is 100x faster than our current cellular connection and 10x faster than home broadband service.

    The technology is ready. From a commercial and business perspective, however, 5G implementation is still in its infancy. When it comes to capitalizing on the many use cases 5G offers, what is the holdup? With faster speeds, enormous data capacity, lower latency and more devices connecting and communicating than ever before, the security vulnerabilities are extreme. Given we are in the early stages of 5G deployments, service providers do not even know the full extent of the security concerns; they are just planning for the number of devices joining the network to grow exponentially. With the proliferation of connected personal devices, data privacy concerns have never been higher.

    To understand the potentially detrimental threats to personal safety and data privacy, we must first look at specific use cases enabled through this technology.

    The 5G Effect

    5G is more than just faster speeds—it is unlocking some of the most highly sought-after technologies of the decade. This is because low latency, or next-to-nothing lag time, allows a device asking something of the network to get a response almost instantaneously. For VR and AR gaming applications, this means a seamless user experience. And while sensory video games are good fun, these same principles can carry over to more serious applications in hospitals and other medical settings: By using a VR headset and special glove to control a robot arm, for example, a surgeon may have the ability to operate on a patient offsite.

    This extreme scenario offers two major risks: network lags and hacked equipment. An IoT-enabled hospital may have tens of thousands of “things” that could be compromised. Emergency room devices cannot afford to be starved for bandwidth if an admin printer is clogging the network. Any glitch in the network may lead to a slight delay in action, resulting in dangerous consequences. Additionally, with nefarious entries into the network through the high volume of vulnerable endpoints, the attack may have dire repercussions.

    A hospital is just one high-stakes environment. Now consider the IoT devices connected to a 5G network operating all around us—autonomous cars, energy grids, home security systems, etc.—the smallest glitch or endpoint vulnerability could lead to life-threatening situations.

    Many people do not realize 5G and IoT will have a major effect on seemingly innocuous devices such as refrigerators, thermometers and even light bulbs. While 5G will enable users to check on these types of appliances remotely through a simple app, convenience comes with consequence as these devices can also be usurped by malicious characters. It is important to recognize what 5G can enable, but also how it will all come together.

    Preparing for the Next-Gen

    Here are some tips on how enterprises can develop an effective 5G-ready security posture that encompasses the entire network:

    Invest in automation: 5G security poses its own Catch-22; because connections happen faster, attacks and breaches also happen faster and potentially with much more reach. To mitigate threats, 5G security will require actionable insights at scale. To achieve this, organizations need security systems that detect and automatically enforce security policy from endpoints to edge and every cloud in between.

    Scale up and out: To avoid a massive bottleneck, a proper 5G security posture will require upgrades to both physical and virtual infrastructures. Developing a secure architecture and solution that can keep up with the pace and scale of 5G without slowing it down is a large, but necessary, undertaking. The trick is to build in machine learning capabilities so the network can get smarter. Malware must traverse the network, so why not use all the data that the network already produces to fight it? A network that is constantly learning and updating is the only way to operate in the 5G landscape.

    Be proactive: History has shown us that whenever we expand our computing power and connectivity capabilities, we also expand the threat landscape. Not only that but as we continue to increase our dependency on communications networks and technologies to move tremendous amounts of data, there is greater potential for serious disaster should they be compromised. This is not the time to sit back and watch how things unfold, as major security risks are on the line.

    The use cases for 5G are plentiful. If we can conquer the threats, we can conquer anything the technology enables us to do—and the possibilities are endless.

    — Samantha Madrid

  • Synopsys Advances DevSecOps via IDE Plugin

    Synopsys Advances DevSecOps via IDE Plugin

    Synopsys has extended the static application security testing (SAST) and software composition analysis (SCA) of the Code Sight plugin it makes available for integrated development environments (IDEs).

    The latest iteration of Code Sight adds the ability to analyze declared and transitive open source dependencies to identify components with known security issues alongside SAST findings without having to exit their IDE.

    Delivered vis the company’s Polaris Software Integrity Platform, the update enables developers to also review known vulnerabilities of flagged components to verify the risk and determine remediation options using vulnerability information from Black Duck Security Advisories (BDSAs). That information is based on data provided by both Synopsys and public CVE records gathered in the National Vulnerability Database (NVD).

    Patrick Carey, director of product marketing for the Software Integrity Group at Synopsys, said the Code Sight plugin enables developers to easily identify and select the best fix for vulnerabilities by providing detailed remediation guidance that directs them to more secure component versions.

    Code Sight also helps developers optimize component selection by including, for example, information regarding open source license risks and potential security and license compliance violations of an organization’s predefined set of open source policies.

    In general, Carey said Code Sight is designed to make it easier for developers to address a broad range of cybersecurity issues while an application is being developed instead of after it’s deployed. The goal is to make it easier for developers to discover and address cybersecurity issues on their own as part of the overall shift toward adoption of best DevSecOps practices, he said.

    The challenge, of course, is most developers have not been trained to identify potential cybersecurity issues in their code. Code Sight fills that gap by surfacing vulnerabilities as developers write code, said Carey. Synopsys plans to continue building on that capability by adding more analytics capabilities to the Code Sight plugin over time, he added. For example, Synopsys earlier this year acquired Tinfoil Security, a provider of dynamic application security testing (DAST) and application programming interface (API) security testing tools that will be employed to surface additional analytics in Code Sight.

    Eventually, the goal is to make identifying cybersecurity issues a natural extension of the quality assurance process within any application development and deployment life cycle, Carey said.

    It’s hard to say with certainty to what degree DevSecOps will be driven by a set of well-defined best practices versus simple evolution of how applications are developed. There’s no doubt cybersecurity professionals have a vested interest in making sure fewer vulnerabilities make it into production application environments. As such, communication between developers and cybersecurity professionals clearly needs to improve. However, the biggest DevSecOps strides any organization might make may simply come down to making the right tools available in the most frictionless way possible to developers.

    In the meantime, there’s no doubt application security has become a major area of focus in the age of digital business transformation. The challenge now is limiting the number of vulnerabilities that might be exploited as more code than ever is developed and deployed at increasingly faster rates.

    — Mike Vizard

  • Certificates a Fly in the DevOps Ointment

    Certificates a Fly in the DevOps Ointment

    The way cybersecurity teams have managed certificates is turning out to be a major impedance that could best be addressed by more organizations adopting best DevSecOps practices in 2020.

    A survey of 108 attendees at the recent DevOps Enterprise Summit 2019 conference conducted by Venafi, a provider of tools for assigning identities to machines, finds 75% of respondents said they are concerned that corporate certificate issuance policies slow down development.

    In addition, 39% of respondents believe developers should be able to circumvent corporate certificate issuance policies to meet service level agreements (SLAs) and about half (48%) said they are confident that developers always request certificates through authorized channels.

    Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, said the root cause of the friction between developers and cybersecurity teams can be traced to reliance on ticket-based systems for managing IT. DevOps teams in the age of the software engineer are building and deploying applications faster than ticket-based systems based on manual requests can keep up with, he said.

    Rather than wait on IT Operations teams, DevOps teams are doing an end-run as business leaders push for applications to be deployed faster. In many cases, DevOps teams are attaining certificates directly from a cloud service provider such as Amazon Web Services (AWS), Bocek noted. Unfortunately, that can lead to other issues: More than half of respondents(55%) said their organization experienced a certificate-related outage in the past 12 months. Not all those outages are likely to have resulted from DevOps teams working without internal IT, but it does confirm how deeply flawed the existing process of issuing certifications already is.

    To address that issue, Bocek said organizations will need to shift to an approach for issuing trusted certificates that is based on a standard set of REST application programming interfaces (APIs) and is a natural extension of the DevOps processes baked into a continuous integration/continuous delivery (CI/CD) pipeline.

    Unfortunately, most organizations are not especially aware of best practices for issuing trusted certificates. The Venafi survey found three-quarters of respondents (75%) are unfamiliar with the “Securing Web Transactions 1800-16 Practice Guide,” available in draft form from the National Institute of Standards and Technology (NIST).

    Bocek said the days when cybersecurity teams could employ certificates as a means for governing when applications are deployed are all but over. Cybersecurity teams need to collaborate with DevOps teams to define a set of best DevSecOps processes through which trusted certificates still play a role in helping secure the IT environment without slowing down the application deployment process, he said.

    It may take a while for DevOps teams and cybersecurity professionals to get on the same page in terms of issuing certificates. However, as pressure to deploy applications faster continues to mount, cybersecurity teams will need to adjust their policies and processes. How certificates are issued may be as good a place to start their DevSecOps transition as any.

    — Mike Vizard

  • Predict 2020: What Will the New Year Bring?

    Predict 2020: What Will the New Year Bring?

    With the holiday season upon us, our thoughts naturally turn to the next year and what it has in store for us. Will we come into more money? Will we find true happiness? Will there be better integration between DevOps and security? Will there be more Kubernetes instances? The first two may be a little hazy, but it’s a good bet the second two will be discussed during Predict 2020 Virtual Summit, Jan. 23, 2020, where an all-star lineup of industry luminaries will offer up their visions for the future.

    Crystal ball? Check. Swami hat? Check. Insight relevant to the industry? Check. Very smart people who know what they’re talking about? Double check.

    Similar to last year’s event, Predict 2020 will feature a virtual environment with a conference lobby, presentation theater, expo hall and more. More than a series of YouTube live presentations, it is truly a conference experience from the comfort of your desk.

    Speakers

    Our keynote speakers for this daylong event include analysts, practitioners, venture capitalists and thought leaders from the realms of DevOps, cloud native, cybersecurity, digital transformation and IT. Each will share their best predictions for the year 2020 and beyond.

    Among those slated to speak are:

    There will also be an exhibit hall where you can interact with other attendees and sponsors, watch videos and download more information.

    It should be a great day of learning and networking right from the comfort of your own chair.

    Registration and Sponsor Info

    You can register now at https://predict2020.io. Attendance is free.

    If you are curious about what the experts, pundits and luminaries think will be the big trends and stories of the coming year, mark your calendar and attend Predict 2020.

    Save Your Virtual Spot

    — Alan Shimel

  • DevSecOps Requires Teamwork for Success

    DevSecOps Requires Teamwork for Success

    While the manifestos surrounding the current development pipelines may differ, there is one concept that remains constant: teamwork. All the various frameworks populating the development landscape bring together teams of people to build and deliver applications. This is especially true of DevOps, which focuses on a technical culture with defined roles on a quest for responsiveness. 

    Yet, many organizations seem to be failing miserably when it comes to bringing cybersecurity into IT operations, especially where DevOps is concerned. New research from Tanium, a purveyor of endpoint management and security platform solutions, illustrates that all is not well where cyber and IT operations intersect.

    Tanium commissioned Forrester Consulting to survey more than 400 IT leaders at large enterprises to uncover the challenges, consequences and gaps they face when managing and securing their endpoints. That research revealed that two-thirds (67%) of businesses say that driving collaboration between security and IT ops teams is a major challenge.

    That lack of collaboration has a cascading effect, impacting the overall security hygiene of the enterprise and exposing systems to even common threats. Simply put, teamwork requires much more than just building camaraderie between security, operations and development folks; success requires that various team members come together to support the culture of DevOps. 

    Strained relations between those players can lead to security failures, an assumption evidenced by Tanium’s research. The survey results indicated that security and IT ops teams with strained relationships more often struggle with basic IT hygiene, taking nearly two weeks longer to patch IT vulnerabilities than teams with healthy relationships.

    It is those types of issues that can weaken the confidence of  IT decision-makers to make the correct decisions. The report claims that they have a misplaced sense of confidence, with 80% certain they can act on the results of vulnerability scans but only 49% feel confident they have full visibility into all the hardware/software assets on their environment. 

    According to Tanium, that misplaced confidence is attributable to the increased investment in IT security and operational tools. However, just increasing security budgets does not always deliver on improved capabilities. As the survey results indicate, throwing money at the cybersecurity problem often creates a false sense of security regarding how well businesses can protect their IT environment from threats and disruption.

    Many of those threats seem to fall through the cracks, a problem often blamed on the lack of end-to-end visibility of endpoints and their health. Solving that particular issue requires that IT security professionals interact more effectively with their IT operations and development counterparts (again, teamwork). Further exacerbating the problem is that many applications and services still operate in silos, which inhibits the visibility and control needed to properly protect the environment.  

    “According to our research, most teams are confident in their ability to take timely action on the results of their vulnerability scans. However, further investigation shows teams are admittedly suffering from visibility gaps of all hardware and software assets in their environment, which undermine these efforts to take action. With around 50% of IT leaders showing confidence in asset and vulnerability visibility, you’re essentially leaving your security to a coin flip,” said Chris Hallenbeck, Americas Chief Information Security Officer at Tanium. 

    Ultimately, Tanium recommends adopting a unified endpoint security solution to address the gaps in protection, while also encouraging security and IT ops teams to work more closely together. However, it is likely it will take more than just that to fully integrate security into the DevOps pipeline. Cybersecurity pros will need to get involved in the development pipeline to ensure that security becomes a foundational element of the application development and delivery process. 

    — Frank Ohlhorst

  • CIOs See Dramatic Change Ahead

    CIOs See Dramatic Change Ahead

    Driven by heightened competition and a rapidly changing business environment, many enterprises now find themselves faced with decisions that could make or break their future.

    Consider this: Within three years, 44% of respondents to the 2019 Harvey Nash / KPMG CIO Survey expect to fundamentally change their product, service offerings or business model. It’s a finding that spans enterprises both large and small, the survey said.

    This could explain why IT leaders reported their technology budget to be increasing the most in 15 years. The report found 45% of respondents favor budget increases for money-saving technology efforts, such as task automation. Interestingly, almost two-thirds, or 63% of organizations, report that considerable amounts of their enterprise technology efforts are managed outside of the control of their IT department.

    However, the survey showed those organizations where the IT team is formally involved in business technology decision-making have better business outcomes. These enhanced outcomes include improving new product time-to-market and employee experience to be better than their competitors. Still, four in ten companies are not formally involving IT in those business-led IT decisions.

    Increased investments in automation and artificial intelligence (AI) are expected to place considerable churn on the workforce. CIOs are expecting to witness one in five jobs being replaced by AI/automation within the next five years. However, 69% of CIOs also expect enough new jobs to replace those positions lost to automation.

    “Boards are asking their CIO and technology team to prioritize automation of jobs. How organizations adapt to automation will increasingly become a priority, and many are not at all ready,” said Albert Ellis, CEO of Harvey Nash.

    Despite CIOs enjoying a rising influence within their organizations, fewer CIOs have seats on the board of directors at their organization—having fallen significantly from 71% who held board seats just two years ago to 58% today.

    The 2019 Harvey Nash/KPMG CIO Survey, conducted between December 2018 and April 2019 across 108 countries, is based on the responses of 3,645 CIOs and technology leaders.

    While automation and AI may, or may not, displace workers in the future enterprises are counting on them today to help close their perceived skills shortage. According to respondent’s, enterprises continue to find it a challenge to obtain the talent they need. In fact, respondents reported skills shortages at their highest level since 2008.

    The employees most difficult to find are those in data analytics (44%), cybersecurity (39%) and artificial intelligence (39%).

    Finally, respondents surveyed who consider their organizations to be digital leaders (those who see themselves as very effective or extremely effective at using digital technologies to advance their business strategies, performed better than their competitors on every aspect surveyed.

    According to the survey, digital leaders outperformed in time to market (53% versus 34%), customer experience (65% versus 49%), revenue growth (55% versus 43%) and profitability in the previous year (50% versus 37%). Digital leaders, the survey said, are also more likely to introduce ‘major new changes to products and services’ in the next three years (55% versus 39%) and focus on profitability.

    — George V. Hulme

  • Privileged Access Management at the Speed of DevOps

    Privileged Access Management at the Speed of DevOps

    Privileged access management (PAM) is clearly a very important element of effective cybersecurity. PAM has been ranked number one on Gartner’s Top 10 Security Projects for two consecutive years, and it is number four on the CIS Top 20 Critical Security Controls. The struggle for many organizations, however, is they have also embraced DevOps culture, and the traditional approach to PAM clashes with the principles of a DevOps environment. Thankfully, it is possible to effectively manage privileged access in a DevOps environment—it just takes a new approach.

    Challenges of Privileged Access Management

    Despite advances in identity and access management and the existence of things like two factor or multi-factor authentication and biometric authentication, most organizations still rely on a simple username and password to authenticate an individual and grant access to network resources, applications and data.

    The concept of least privileged access—ensuring that users only have access to things they really need access to—has been preached since the dawn of cybersecurity and, when done right, can be an effective strategy. The problem is it’s tedious to do right and it’s very easy to lose track of who has privileged access to what.

    That’s where a PAM solution comes in. The whole point of privileged access management is to provide a way to track and manage who has access to what—to grant access when it is needed and revoke access when the need no longer exists. Unfortunately, there is a lot of confusion about PAM and the effort to manage privileged access is challenging for many organizations.

    Enterprise Management Associates (EMA) conducted a survey on the state of privileged access management. The survey included responses from companies representing different company sizes and industries around the world and focused on IT and cybersecurity professionals—most of whom are familiar with PAM and are directly responsible for managing or granting privileged access to users.

    There were some concerning findings from the survey regarding the perception of PAM. Twenty percent of organizations that reported using a dedicated PAM solution believe it somewhat or greatly reduces user productivity. Many respondents also expressed frustration about the amount of time required to manage privileged access. Half of the survey participants cited manually granting temporary privileges as either very (29%) or extremely (21%) time consuming, and half also said manually revoking temporary privileged access as very (33%) or extremely (17%) time consuming.

    PAM and DevOps

    As challenging as traditional PAM solutions might be for businesses around the world, they pose an even greater hurdle for organizations that have embraced DevOps. A recent episode of the Defense in Depth podcast, hosted by David Spark and Allan Alford, focused on some of the challenges of PAM. A listener had written to complain that “the traditional approach to PAM breaks everything that is DevOps. Regardless of what your PAM provider says about their ability to scale with your dev cycles, they’re lying about the real level of effort.”

    That seems like a fair assessment. Pretty much every company is somewhere on the cloud journey—and working within a DevOps framework on some level. Companies often face backlash from the DevOps team—with some going so far as to boycott efforts to introduce security tools that can’t keep up with the pace of DevOps in the cloud.

    DevOps developers express frustration about trying to build an automatic scaling, horizontal infrastructure and being dragged down by demands from the security team to install agents and change authentication modules. They complain it often means rewriting all of the scripts, resulting in significant and unnecessary effort for a solution that ultimately can’t scale properly in the DevOps environment.

    That is, unfortunately, true when it comes to traditional PAM solutions. Next generation PAM solutions, however, are built with the cloud and DevOps in mind. They are lightweight, automated, scalable and capable of integrating seamlessly with common tools and platforms.

    Rethinking Privileged Access Management

    Based on the survey, organizations understand the importance of privileged access management, but they struggle with finding a way to implement it effectively. The question from the podcast illustrates how PAM is also a significant issue for DevOps environments because traditional PAM solutions do not integrate or scale effectively.

    At the same time, we all know that PAM is a crucial element of effective cybersecurity. It’s not acceptable to just not manage privileged access, but it also doesn’t make sense to suffer through the headaches and frustration introduced by traditional solutions. Organizations need to find new privileged access management tools that work in the cloud and can scale automatically to provide PAM at the speed of DevOps.

    — Tony Bradley

  • GitLab Research Reveals DevOps and Cybersecurity Disconnects

    GitLab Research Reveals DevOps and Cybersecurity Disconnects

    DevOps and cybersecurity teams have a complicated relationship, which impacts code quality, research shows

    Finger-pointing has long been the name of the game when it comes to cybersecurity failures. After all, who should be responsible when so-called bad code or bad practices are blamed for the latest incident? 

    A recent survey by DevOps lifecycle tool company GitLab reveals a significant disconnect between application developers and cybersecurity professionals—a disconnect that could only lead to more security woes and additional finger-pointing. GitLab surveyed more than 4,000 app development and cybersecurity professionals and brought some light to the complicated relationship between both. 

    For example, some 49% of the cybersecurity professionals surveyed claimed they struggle to get developers to make the remediation of vulnerabilities a priority. Sixty-eight percent of those same security professionals believe less than half of the developers they work with can identify security vulnerabilities before new code moves into the test cycle. 

    While cybersecurity professionals like to point the finger at the developer community, there are two sides to the survey. Almost 70% of the developers surveyed said that while they are expected to create secure code, they get little help or guidance from the cybersecurity experts with whom they work. Perhaps the fault lies with the lack of mechanisms to make cybersecurity a priority in many organizations. “We don’t have clear guidelines about security, so the different services present different levels of security,” noted one developer in the report.

    While developers and cybersecurity professionals may be at odds, the report also revealed there is plenty of additional blame to go around. Case in point is the revelation that many organizations don’t make cybersecurity a priority. Some 44% of those surveyed reported they are not judged on security vulnerabilities in their code. That creates an environment where developers don’t have to consider cybersecurity issues when writing code.

    With developers, cybersecurity professionals and even the companies they work for all at odds about the responsibilities of proper cybersecurity hygiene, one has to wonder how tomorrow’s vulnerabilities will be prevented.

    “Our research tells us that while most developers are aware of the dangers that vulnerabilities present and want to dramatically improve their security capabilities, they often still lack organizational support for prioritizing secure code creation, increasing secure coding skills and implementing automated scanning and testing tooling to make that happen sooner rather than later,” said Colin Fletcher, GitLab’s manager of market research and customer insights.

    Solving the blind spots around cybersecurity is going to take a different approach, one that further tears down the silos created around cybersecurity teams and development teams. There is a little bit of irony in that observation; after all, DevOps is all about tearing down silos and creating functional teams. 

    It’s also an irony not lost on those at GitLab. The company promotes solving the cybersecurity issues by adopting a good DevOps practice, where cybersecurity becomes an integral part of the DevOps process. According to GitLab, incorporating cybersecurity into DevOps will have the positive result of the combined team being three times more likely to discover security bugs before code is merged into operations.

    The report offers some significant conclusions that support GitLab’s claims. For example, some of the security top findings include:

    • Sec teams are three times more likely to discover bugs before code is merged with a good DevOps practice in place, and are 90% more likely to test between 91% and 100% of code than in an organization with early-stage DevOps.  
    • Nearly half of security pros surveyed (49%) said they struggle to get developers to make remediation of vulnerabilities a priority.
    • Half of security professionals said bugs were most often found by them after code is merged in a test environment.  
    • Mostly remote teams are 23% more likely to have mature security practices than primarily office-based teams.
    • Only 44% report security vulnerabilities are a performance metric for developers in their organizations.

    GitLab also revealed there is another consideration, one of ownership. According to the report: 

    No part of software development raises more issues about ownership than the subject of security. The idea that everyone is responsible for security might be the ideal but it can also be part of the problem as everyone can easily turn into no one. Security professionals often complain about being on the outside, while developers and operations teams can resent being told how to prioritize their work. Our survey responses indicate developers are taking more responsibility for security, but of course a lot of work remains. In fact, only 20% of those surveyed rated their organization’s security efforts as good, while 36% said they were fair and 24% said they were poor.

    — Frank Ohlhorst

  • GitLab Expands Scope of DevOps Ambitions

    GitLab Expands Scope of DevOps Ambitions

    GitLab, with the release of its 12.0 update, is extending the reach of its namesake continuous integration/continuous delivery (CI/CD) platform to include both cybersecurity professionals and traditional IT operations staff.

    John Jeremiah, senior product marketing manager at GitLab, said the goal is to provide organizations with a single CI/CD platform that unifies the management of everything from source code to best DevSecOps processes.

    To address that latter requirement, GitLab 12.0 adds a dashboard designed specifically for security personnel along with the ability for cybersecurity teams to approve merge requests and automatically apply patches for vulnerabilities detected. Those capabilities complement existing support for scanning and secrets detection.

    New capabilities embedded in the platform for IT Operations professionals include an operations dashboard and an embedded incident management capability that makes it easier to create a coordinated response to a specific event.

    GitLab 12.0 also adds support for feature flags to better manage the application delivery process, along with a platform-as-a-service (PaaS) environment to provision and maintain the infrastructure needed for developing and launching an application.

    Jeremiah said the new and existing capabilities in GitLab will make it possible for organizations to unify their DevOps tool chains in a way that also enables IT operations teams and cybersecurity professionals to be included in the process.
    At the same time, GitLab is making DevOps more accessible by eliminating many of the silos between various tools that have emerged over the years, including, for example, built-in support for feature flagging versus requiring organizations to acquire and maintain a separate tool, he noted.

    Because those capabilities are embedded in the platform, organizations will be able to make the cultural shift required to adopt DevOps more easily, he added. IT teams don’t always know what other tools they will need as their DevOps skills mature. With all the tools embedded in GitLab readily available, it becomes easier for organizations to expand their DevOps processes as the organization starts to implement more sophisticated processes, Jeremiah said.

    That approach is starting to resonate with the 100,000-plus developers actively using the GitLab platform and more than 2,000 contributors actively contributing code to the underlying open source platform, he added. GitLab in March saw its millionth merge request.

    It’s too early to tell how broadly any CI/CD platform might be able to consolidate the DevOps toolchain. Developers are notorious for adopting new tools as they see fit. Internal IT teams, of course, are not always excited to be asked to support yet another tool. The right level of balance between ultimate flexibility and the need for a standard set of processes that can be implemented across multiple application development teams must be determined by each organization.

    In the meantime, DevOps processes are starting to expand beyond traditional development team to now include IT operations staff and cybersecurity personnel. The challenge now that they’ve been invited to the proverbial DevOps party is making them feel welcome and appreciated.

    — Mike Vizard

  • Motorola Solutions: Driving a Thriving Security Culture

    Motorola Solutions: Driving a Thriving Security Culture

    It’s crunch time in the cybersecurity industry. For too long, many companies have remained unmoved by the increasing threat of cyberattacks, despite increased digitization of their products and services. Customer data is the new gold, and some organizations are leaving the door to their vault wide open.

    In saying that, secure development is complex and not without its challenges, especially at scale. In my experience, it is an uphill battle to win over developers on secure coding and best practices. In the mind of a busy programmer working to achieve strict delivery deadlines, security is not a priority over feature development and function—it is instead seen as a tedious task that interrupts their creative flow. However, if we are going to ready ourselves in the battle against those who seek to do harm, this culture needs to change.

    Marilyn Barrios is the senior cybersecurity training manager at Motorola Solutions, running the security training program for its team of more than 6,000 developers across the globe. Her goal is to ensure that those on the front lines of the company’s extensive software development are equipped with the knowledge, tools and ongoing training required to combat the growing global cybersecurity threat.

    To accomplish this, Barrios created an impressive internal security culture, one that thrived not only from a core skills perspective, but also in understanding its paramount importance in overall software quality. Her people-first, positive approach engaged the development team, created excitement about security and morphed into something far more powerful than a simple compliance exercise.

    “Ensuring that our products are secure is our highest priority. That’s why we’re working to create a culture of security-first thinking across the company—so people not only understand cybersecurity and why it is vital to maintaining a high standard of software quality, but are also excited to learn more,” she said.

    With such a large development team covering multiple facets of the business, insight into each individual’s security knowledge and current skill level could be elusive and difficult to collate. Barrios sought to streamline this process, working toward a holistic solution that would deliver key metrics and relevant training in the languages and frameworks that were actively being used in the business while remaining engaging enough to be revisited—even for more senior engineers.

    Marilyn and her team worked to implement an immersive, engaging training experience for their developers. Starting with a boot camp run by security superstar Jim Manico, the developers learned offensive coding techniques before playing in tournaments to test their defensive skills against the attacks they had just seen in action. This setup proved effective and eye-opening for the participants.

    “In really diving deep into how cyberattacks can be executed, the team saw how easy it was to do a lot of damage at the application level,” Barrios noted. “By then practicing how they can defend against these attacks, developers’ eyes were opened to how they can help if they keep security a priority in their work. They enjoyed the experience and it was also beneficial for them.”

    I was proud to see how well she and her team at Motorola Solutions executed a comprehensive, engaging and fun security training program that not only lifted security awareness IQ overall, but also helped to identify a new group of champions to keep the critical message of cybersecurity best practices thriving long-term within the organization.

    It was also interesting to learn that the eventual winner of the tournament did not start the program as the most experienced and security-aware developer. The boot camp was instrumental in rapidly upskilling the individual, and the gamified aspect of the training ensured a high level of engagement and information retention.

    “Our eventual tournament winner was so excited with the boot camp, and he was so engaged with the training tool. He practiced so much in a two-month period, improving so significantly, that he ended up winning the tournament,” Barrios said. “From there, he recruited even more champions, piqued their interest in security and helped them along to become advocates in their respective groups.”

    Barrios’ broader goal of creating a strong buzz that encourages an organic security culture to grow within the company is certainly on track.

    Gamified training, team events driven by tournament initiatives and the incentive to keep engaging with AppSec have resulted in something very positive: Developers not only are working to have a better understanding of security, but also actively seek to uphold company best practice initiatives day to day.

    Motorola Solutions saw measurable improvement when using tools and training compatible with the creative, problem-solving mindset of many developers, enjoying a training participation rate of more than 90%, with security accuracy increasing 24% across the global tournament that followed. Its internal security champion program has also seen immense support, growing by more than 1000% in the last 18 months. The company currently boasts 173 champions across its various product lines and will double that again over the next year. It has set a goal of at least one champion per scrum team—an initiative that holds incredible value in continuing momentum and spreading positive security influence across the organization.

    Driving a positive security culture takes time, planning and dedication, but alongside the right tools and training, Barrios’ advice is a sound reminder that clear goals and communication are powerful in achieving widespread support and change: “Always tie objectives to the ‘why.’ You should know why you’re trying to meet a goal or influence change; don’t just give a direction with no context.

    “For us, it’s easy: we make it personal. Motorola Solutions is responsible for delivering key communications over mission-critical infrastructure and devices for public safety and commercial enterprises. First responders, citizens and front-line workers alike are relying on this technology to be as secure as possible, so we emphasize the importance of learning best practices,” she said.

    With every other day seemingly bringing bad news about the latest large-scale data breach, it is refreshing to see an organization with a highly successful security program—one that can only get stronger as its developers continue to train and become the security superheroes we need to protect our digital world.

    — Pieter Danhieux