Tag: rsa conference

  • DevOps Connect at RSAC 2021: Insightful Talks, Live Q&A, Workshops, Pilates and More

    DevOps Connect at RSAC 2021: Insightful Talks, Live Q&A, Workshops, Pilates and More

    We are excited to announce the return of DevOps Connect: DevSecOps Virtual Summit on May 19, as part of the RSA Conference 2021. This year, internationally recognized speakers will take a deep dive into “Securing the Cloud Native World.”

    DevOps Connect is a full-day event, featuring four different content tracks, with more than 50 speakers, including keynote presentations, demos, insight talks and featured sessions.

    The agenda features a mix of topics, including cloud security, CI/CD, Kubernetes, GitOps, AppSec, security risks, shift left, open source, case studies covering DevSecOps and more. Attendees will learn how the finance, manufacturing, healthcare and hospitality industries are securing their cloud environments, and how to better secure and monitor their systems.

    DevOps Connect 2021 Lineup

    DevOps Connect 2021 features an exceptional lineup of the most prominent and respected security and DevOps leaders, including:

    • Featured keynote speaker: Christopher Krebs, former director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and co-founder of Krebs Stamos Group LLC
    • Chenxi Wang, founder and general partner at Rain Capital
    • Allan Friedman, director of cybersecurity initiatives at National Telecommunications and Information Administration in the U.S. Department of Commerce
    • John Willis, senior director of Global Transformation Office at Red Hat
    • Cyndi Gula, managing partner at Gula Tech Adventures
    • Alessandro Vozza, principal software engineer at Microsoft
    • Caroline Wong, CSO at Cobalt
    • Thomas Krane, principal at Insight Partners
    • Charles J. Kolodgy, principal at Security Mindsets LLC and analyst at Accelerated Strategies Group
    • Nisha Kumar, open source engineer at VMware
    • Mike Rothman, president at DisruptOps
    • Dave Howell, VP at ZeroNorth
    • Maciej Mensfeld, senior product manager at WhiteSource
    • Matt Wilson, senior product manager at GitLab
    • Erkang Zheng, founder and CEO at JupiterOne
    • Philippe Humeau, CEO at CrowdSec
    • Jennifer Czaplewski, director of product security at Target
    • Al Sargent, senior director of product at InfluxData

    Former CISA director Christopher Krebs, our featured keynote speaker, will be answering questions from the audience during a live Q&A.

    Workshop Friday

    We are also hosting Workshop Friday, as we wrap up the RSAC 2021, offering live workshops designed to be as interactive and hands-on as possible with experts from Google, JupiterOne, Sysdig and Sonatype. These workshops provide professional guidance and training on a variety of topics, including Site Reliability Engineering (SRE), AWS cloud security and protecting against supply chain attacks. On May 21, attendees will have the opportunity to interact with the experts, share their process, get immediate feedback and personal assistance. Each workshop will be live-streamed through our online platform at no cost to attendees. We have limited spots available. Seats are reserved on a first-come, first-served basis. To save your spot, visit the Workshop Friday website.

    A Unique Virtual Environment and a Few Surprises

    The virtual environment features an auditorium with different tracks where attendees can watch the sessions by industry experts. There will be an expo hall lined with booths featuring interactive chats and downloadable resources. The expo hall will be open throughout the event, giving attendees the opportunity to chat with sponsors, including GitLab, Prisma Cloud by Palo Alto Networks, Sonatype, WhiteSource, Sysdig, JupiterOne, Snyk and more.

    We have a few surprises planned to make this year’s DevOps Connect extra special. Take a break between presentations, grab your yoga mat and enjoy a Pilates class by a certified instructor, dance to the music of our featured DJ and check out how to make a delicious cloud drink by a professional mixologist. You can also participate in a raffle to win a copy of “You Can Stop Stupid” by Ira Winkler, author and president at Secure Mentem, and a copy of “Security Yearbook 2020” by Richard Stiennon, industry analyst at IT-Harvest.

    DevOps Connect 2021 offers the best of a physical environment in a virtual context combined with the advantages and convenience that a virtual environment offers.

    Registered attendees will receive a link to access the virtual environment on-demand. To check out the full agenda and to register, visit the DevOps Connect website.

  • The Time for Collaborative Security Is Now

    The Time for Collaborative Security Is Now

    As Bruce Schneier famously said, “security is a process, not a product.” We commonly see companies pour millions of dollars into cybersecurity products and tools to protect against vulnerabilities and lower risks, and yet, more often than not these ample funds are not enough to defend against attacks. 

    Within the span of two decades, we have seen how social power can be leveraged to benefit the masses with applications like Waze, Airbnb, Uber and many others. This same innovative idea could revolutionize the way the cyber world operates by giving security professionals the edge in identifying potential threats. 

    CrowdSec CEO Philippe Humeau recognizes the capabilities of crowd power to invigorate the cyber realm. The community firewall created by CrowdSec uncovers thousands of malicious IP addresses worldwide and helps cripple hacker behavior before it can evolve into major cyberattacks and data breaches. Additionally, the start up just announced it raised $5 million to help take the collaborative firewall to the next level as they work to transform the cybersecurity landscape. 

    In the interview below, Philippe emphasizes the benefits of collaborative, open and transparent security environments in tipping the scales against the hacking dilemma that plagues companies across the globe. 

    Join Philippe at DevOps Connect 2021 on May 19, during the RSA Conference, where he expands on this topic in his session “The Age of Collaborative Security.” Also, learn more about CrowdSec and see a demo of the tool during his spotlight session, “Introducing CrowdSec, The Open-Source Massively Multiplayer Firewall.”

    To see the full agenda and secure your free spot at the virtual event, visit the DevOps Connect website.

  • How to Bring DevOps and Security Teams Closer Together

    How to Bring DevOps and Security Teams Closer Together

    More often than not, there seems to be friction between DevOps and security teams. Despite having the same end goals of creating the most secure code and preventing any potential security pitfalls, these groups of professionals often lack the unity needed to accomplish these end goals effectively and efficiently. 

    In the interview below, Naomi Buckwalter, director of information security and IT at Beam Technologies, addresses this issue and outlines key ways development and security teams can come together to better accomplish their shared missions. She stresses the importance of security professionals reaching out a hand to their DevOps counterparts to teach them how to be security-forward when writing code. However, she highlights how not every security expert has a developer background, so it really takes these two groups of skilled tech specialists working in unison to fill those knowledge gaps for each other.

    Naomi brings over 20 years of IT and security experience to her upcoming session “Six Things Developers Want From InfoSec,” at DevOps Connect 2021, during the RSA Conference. She will expand on some of the key topics discussed in this interview during her talk on May 19 at 4 p.m. EDT.

    To see the full agenda and secure your free spot at the virtual event, visit the DevOps Connect website.

  • Live Fireside Chat with Christopher Krebs: How to Combat Disinformation

    Live Fireside Chat with Christopher Krebs: How to Combat Disinformation

    We live in a digital world where most information is now found online. This makes it increasingly difficult to verify the veracity of information. Threat actors have been taking advantage of the digital landscape to spread disinformation, propaganda and conspiracy theories to manipulate the public and sow doubt, discord and chaos. How can we distinguish between fact and opinion, truth and supposition? How can we spot fake news and tackle disinformation?

    Former Director of the Department of Homeland’s Cybersecurity and Infrastructure Security Agency (CISA) and Co-Founder of Krebs Stamos Group, Christopher Krebs, will be speaking about disinformation at this year’s DevOps Connect: DevSecOps on May 19 at 12:00 p.m. EDT. During his keynote session, Krebs will explain what disinformation is, how to recognize fake news and the challenges disinformation poses to cybersecurity teams. He will reveal effective ways to combat disinformation, and how public and private partnerships can help. Krebs will also be answering questions from the audience during the live Q&A session.

    Krebs is a founding partner of the Krebs Stamos Group, and previously served as the first director of the federal CISA for two years. Before that, he served in various roles at the Department of Homeland Security (DHS), responsible for a range of cybersecurity, critical infrastructure and national resilience issues. He has also directed U.S. cybersecurity policy for Microsoft and advised industry and government clients on complex cybersecurity and business risk matters while serving in positions with Obsidian Analysis and Dutko Consulting.

    DevOps Connect: DevSecOps has been part of the RSA Conference for six years in a row. This year, the main focus of the event is on “Securing the Cloud Native World.” Krebs has joined a stellar lineup of DevOps, cybersecurity and IT thought leaders as the DevOps Connect 2021 featured keynote speaker. Attend his live session, “Disinformation: As Dangerous as Cyber and Physical Threats,” and check out all the other breakout sessions to learn more about cloud security, DevSecOps, cybersecurity threats—such as disinformation—and more.

    For more information and to register for free, visit the DevOps Connect 2021 website. Save your spot today and learn how to better secure, monitor and maintain the security of your systems.

  • Acting Rationally Regarding Coronavirus: RSAC Conference Update

    Acting Rationally Regarding Coronavirus: RSAC Conference Update

    With all the hype surrounding the coronavirus, let’s take a step back, take a breath and not give in to emotional conference mob fear-mongering

    We have all read the headlines: Mobile World Congress in Barcelona has been canceled. Facebook pulled the plug on a smaller conference next month in San Fransisco. IBM Security has pulled out of RSA Conference next week. Health and safety are everyone’s concerns, but are we acting rationally regarding coronavirus?

    RSA Conference (RSAC) put out an update on Friday (use that link to stay up to date on RSAC) with some great metrics on some of the risk factors and attendance numbers. It is also important to note that RSAC is expected to draw a crowd of about 50,000 visitors (some of them attending the DevOps Connect: DevSecOps Days event that we produce).

    Yes, eight vendors have withdrawn from exhibiting at RSAC. Six of these were from China and frankly, given current travel restrictions, probably couldn’t get here anyway. One is from Canada and one from the U.S. (presumably that is IBM).

    But should we give in to emotional conference mob fear-mongering? There is some serious clickbait nonsense being bandied about, including “RSA in Doubt After IBM Pulls out of Conference.”  To be fair, the clickbait headline was updated, but still, that is just fear-mongering at its worst.

    Why would IBM and the Canadian company pull out? Well, two obvious reasons. One is for the safety of their employees and their potential customers. The other is economic if they feel attendance will suffer. But while I don’t have any facts to back it up, I would have to assume that unless the event is outright canceled, vendors pulling out at this late date won’t be refunded their deposits and payments. This is true not only of their fees to RSAC but also of the money they’ve ponied up for hotels, airfare, party deposits, etc. While potential liability for unnecessarily exposing people to the virus could be a legal option, reasonable precautions are being taken. So I don’t think economics play into the decision to pull out.

    As of Friday, RSAC reports that including the members of the canceled vendors, only 0.79% of attendees had canceled their attendance. I would assume that the overwhelming majority of these were attendees from Asia or other impacted regions who could not get flights here anyway. Something like 82% of attendees are from the U.S. On top of this, RSAC is taking additional precautions to keep the conference as germ-free as possible.

    I was in touch with RSAC management earlier last week regarding the DevSecOps event. At that point, I was informed that they were working closely with the City of San Francisco to do everything possible. They are following CDC and WHO guidelines. BTW, CDC still says the impact here in the U.S. to coronavirus is low.

    So, then, are we seeing an overreaction to coronavirus? The security industry, more than the mobile application or other tech industries, is more attuned to risk management. Are we managing this risk adequately? Are we giving in to the fear-mongers among us? The flu has killed so many thousands more people (albeit with higher infection rates), but that has never caused us to shut down conferences or question gathering in groups.

    Personal health and safety is everyone’s own right and responsibility, as well as the responsibility of the authorities. Of course, you should do what you think is best for you and your family. But I think times like this call for a moment of lucidity and the use of the risk management fundamentals so many of us practice in our professional lives.

    Those of you who know me personally know I am a huge Pittsburgh Steelers fan. Their coach, Mike Tomlin, has a saying that I think applies to this situation: “We don’t live in our fears, we live in our hopes.” I hope the current trend of withdrawing from our community is not one that will continue. I refuse to give in to exaggerated fears.

    I do want to announce two things, though, in regard to this coronavirus situation. First, for any conference organizers who have made the decision to cancel their event for this reason (it is your event, your decision), MediaOps is offering a conference disaster program (CDP) that will allow you to use our virtual conference platform and team to take your event virtual with almost all of the features of an in-person conference.

    We have produced more than 10 virtual conferences in the last year or so that have drawn tens of thousands of visitors with hundreds of sessions, exhibit halls, interactive booths, signage, live chat and more. You can go to the home page of Predict 2020, our most recent virtual event, and click “Recent Events” to get an idea here, but just a caution, registration is required. Please see our press release on this for details. It is important that the tech community continues to engage in the very important exchange of ideas, learning and community that is so vital to our success and progress.

    Secondly, Accelerated Strategies Group, DevOps Institute,  JumpCloud and MediaOps are hosting a survey to learn about what you and your organizations are doing in light of the coronavirus outbreak and whether this is forcing you to rethink actions and behaviors going forward—not just for attending conferences, but as part of disaster recovery and business continuity. For instance, is this situation changing your views around working remotely versus working in a large office, going to customer premises or international engagements? Help us gather the information—please take moment and head over to http://acceleratedsurvey.com to answer a few questions.

    As is the mission of Accelerated Strategies, all of the research and analysis will be made available to everyone to use without registration or any payment. Because “knowledge wants to be free.” I couldn’t think of a better example of why that mission is so important.

    “We appreciate being invited to support the efforts of Accelerated Strategies to learn how this global situation will impact people professionally. We know that the JumpCloud community has been impacted, so we are thankful to be able to help in a small way,” said Rajat Bhargava, co-founder and CEO of JumpCloud. “Supporting primary research into the impact of coronavirus across this community is important work, and will hopefully help shape the actions that organizations can take with their teams and business to successfully navigate the future.”

    “DevOps Institute’s mission is to advance the Humans of DevOps and we are obviously concerned about the impact on the thoughts and behaviors of our global community,” said Jayne Groll, CEO of DevOps Institute. “The best way to overcome the hype and adapt to changing times is to collect and share community data.”

    Finally, Mitchell Ashley, CEO of managing analyst of Accelerated Strategies Group, Groll and I sat down for a video discussion of the coronavirus discussion and the reasons behind the survey. The video appears just below. For information, we recorded this just before the news of IBM Security’s withdrawal from RSAC came out.

    [videopress 5RyZpLsG]

    — Alan Shimel

  • Announcing DevOps Connect: DevSecOps Days Virtual Summit

    Announcing DevOps Connect: DevSecOps Days Virtual Summit

    We just wrapped up our fifth annual DevSecOps Days @ RSA Conference 2019, featuring an exceptional lineup of speakers and a variety of informative sessions, providing an unparalleled experience for all. If you couldn’t make it to San Francisco for RSAC or missed any sessions, we’ll be hosting a virtual version of DevSecOps Days @ RSAC Tuesday, April 2.

    You’ll hear stories from DevSecOps practitioners discussing how they made the cultural transformation from legacy development and deployment processes to integrated systems that include security as a part of the process—not as an overseer or bottleneck to secure application development.

    Similar to the environment we created for the DevOps Experience and Predict 2019 virtual events, DevOps Connect: DevSecOps Days Virtual Summit will feature a virtual environment with a conference lobby, presentation theater, expo hall and more. DevOps Connect: DevSecOps Days Virtual Summit is more than a series of YouTube live presentations; it is a true conference experience, from the comfort of your desk.

    Join John Willis, Chenxi Wang, Shannon Lietz, James Wickett and other industry luminaries for a deep dive into the world of DevSecOps. Register now to attend live Tuesday, April 2. Registration is FREE, but space is limited. Reserve your spot now!

    [su_button url=”https://devopsconnectdevsecops.com/#join-us” target=”blank” background=”#DC2E2A” size=”5″ center=”yes”]SAVE YOUR VIRTUAL SPOT[/su_button]


    [su_divider]

    [su_button url=”https://devopsconnectdevsecops.com/#join-us” target=”blank” background=”#DC2E2A” size=”5″ center=”yes”]SAVE YOUR VIRTUAL SPOT[/su_button]
    [su_divider]

    MediaOps is the company behind technical communities devopsy.kinsta.cloud, Container Journal, Security Boulevard and DevOps TV, and events including DevOps Experience, Predict 2019 and, now, DevOps Connect: DevSecOps Days. Our virtual events take place in the industry’s first truly immersive, virtual reality conference environment. More than a series of Google Hangouts, DevOps Connect: DevSecOps Days is a true virtual conference, replete with theaters for each of the keynotes and presentations, a conference lobby to chat and socialize, and a real virtual expo floor with virtual exhibitor stands equipped with video, downloads and even swag for attendees.

    Follow us on Twitter at @devopsdotcom and @securityblvd for event updates. Use the hashtag #devsecopsdays and let us know if you are going!

    — saleem

  • Survey Finds Mixed Progress on DevSecOps

    Survey Finds Mixed Progress on DevSecOps

    A survey of 5,558 IT professionals published today by Sonatype in collaboration with CloudBees, Carnegie Mellon’s Software Engineering Institute, Signal Sciences, 9th Bit and Twistlock finds 27 percent of organizations have mature DevOps practices in place, while another 48 percent are still working on improving them.

    Despite the DevOps works that remains to be accomplished, however, the survey also noted that 47 percent of respondents still manage to deploy code multiple times a week.

    The survey, announced at the RSA Conference, also finds that 25 percent of respondents now consider security to be a fundamental element of quality assurance process. But responses among the 23 percent of respondents who identified themselves as developers suggest implementing best DevSecOps practices remains a significant challenge. For the third year in a row, about half of developers reported they don’t have enough time to address cybersecurity issue.

    The survey, however, also noted that organizations that do implement best DevSecOps practices see substantial benefits:

    • Elite DevSecOps practices are 700 percent more likely to have fully integrated and automated security practices across the DevOps pipeline.
    • Almost two-thirds (62 percent) of respondents with elite programs have an open source governance policy in place that is improved via automation.
    • Organizations with elite DevSecOps practices are three times more likely to provide application security training to developers.
    • A full 81 percent of those with elite practices have a cybersecurity response plan in place.
    • More than half (51 percent) of respondents with elite practices leverage automated security products to identify vulnerabilities in containers.

    Brian Dawson, DevOps evangelist at CloudBees, said the survey results show that despite the gains being made by some organizations, there is much work to done in terms of overcoming technical hurdles and cultural tribalism. For example, 35 percent of all respondents said their No. 1 challenge in application security is that they find out about the problem too late in the process. Nearly half (46 percent) of organizations without a DevOps practice do not have application-level credentials encrypted. Half of respondents (50 percent) with a cloud infrastructure said they rely on their cloud service provider to secure their IT environment, and 28 percent of respondents admitted they do not protect secrets such as passwords, API keys and certificates.

    The core issue most organizations need to focus on first is to firmly establish a DevSecOps mindset, said Dawson. Much progress has been made in driving adoption of DevOps practices. Now those principles need to be extended to include automating the implementation of security controls as applications are being built and deployed. The survey noted that 63 percent of organizations that have elite DevOps practices are now informing developers of cybersecurity issues directly within the tools provided to the DevOps team. Armed with that information, it becomes much easier to incorporate security fixes within the overall application lifecycle management process.

    It may be a while before best DevSecOps process are widely implemented. But as cybersecurity issues continue to be incorporated within the quality assurance process, it’s now only a matter of time before applications become much more secure.

    — Mike Vizard

  • DevOps Chat: Promoting Innovation at the RSA Conference

    DevOps Chat: Promoting Innovation at the RSA Conference

    RSA Conference is where the world comes to meet Security. For the last 14 years, the Innovation Sandbox Contest was where you could find out what the up and coming companies in security were up to.

    This year RSAC is doing something else in addition. The Launch Pad is where to come to if you have a great idea. You can pitch to VCs, the community and your peers – get great feedback.

    In this chat we speak with Cecilia Marinier of RSAC about Sandbox, Launch Pad and so much more that is RSAC. Listen to the chat, go to RSAC and enjoy.


    Transcript

    Alan Shimel: Hey everyone. It’s Alan Shimel, devopsy.kinsta.cloud, Security Boulevard and you’re listening to another DevOps Chat. Today’s DevOps Chat is gonna focus on well, what for me is my favorite conference of the year, the RSA Conference in San Francisco, which this year is the week of March 4. And one of the great things about RSA conference is there’s so many things going on. I’m happy to be joined actually by someone from the RSA conference team. Cecilia Marinier, Marinier. Cecilia, I hope I didn’t mess that up terribly. My French is … that New York accent just doesn’t work with French. I’m sorry [laughs]. But Cecilia, you there?

    Cecilia Marinier: I am here. Thank you. And you did a great job with my last name. Thank you.

    Shimel: Why don’t you say it right, though, for everyone?

    Marinier: Okay. So my name is Cecilia Marinier.

    Shimel: Marinier. Oh, you can almost taste the French food in the way you even say it. Anyway, I just got back from France, Cecilia and so I appreciate it. But you’re with RSA Conference. Why don’t you give our audience a little bit of background on what your position is and your own journey on how you got here?

    Marinier: Absolutely. Thank you. So I work with the RSA Conference. I joined them about five years ago and I started actually working with just the RSA Conference Innovation Sandbox content having a strong interest in innovation in cyber security. Prior to that, I was working with a small boutique consulting firm that consulted US government clients on security intelligence issues and one of the main focal areas was cyber security, which is what drove my interest into actually joining RSA conference. And tying that together with innovation is just how I got started on this journey and from there, it’s just been a super wonderful ride with RSA conference. Just keep on building out these incredible programs focused on innovation.

    Shimel: Correct. So I’ve had the pleasure of being involved with the innovation sandbox contest now for a number of years. I would say it’s gotta be going on what seven or eight years they’re doing it? Maybe more at RSA already?

    Marinier: Yeah. Actually it’s 14 years.

    Shimel: 14.

    Marinier: This is our 14th year.

    Shimel: Oh my God.

    [Crosstalk]

    Marinier: I know. But it started off under – [laughs] I know. Well, it started off under a different name back in 2005 and then in 2009, it actually changed into the current form, which is the innovation sandbox contest. But there were really incredible company that came through that you might recognize like source buyer and Imperva in those first couple of years so it’s –

    Shimel: I remember those years. And maybe that’s why I said seven or eight years because since they’re using their name, the Sandbox. But in any event, we’re very careful to use the name Innovation Sandbox Contest because we don’t wanna confuse people. Again, there’s so much going on at RSA conference. There’s also the RSA Sandbox where people kinda have hands on experiences with different tools and so forth and security, and cyber security. Correct?

    Marinier: Exactly. The RSA Conference Sandbox actually hosts three sandboxes, plus sands _____ _____ and each sandbox has these hands on activities and it’s in the internet of things. IoT village. It has also ICS village looking at _____ systems and finally, we are – this year, we’re bringing in wireless hacking village too. So it’s a really exciting time for the sandbox in addition to the innovation sandbox contest.

    Shimel: Absolutely. That is exciting. I remember seeing it last year. That’s some great stuff. But when we talk about the Innovation Sandbox Contest _____ _____ for those of you maybe from my DevOps audience or who have not had the pleasure of attending RSA Conference, it really is a showcase for new technology, for new sec companies to get in front of some of the top, top people who are judges for this contest and really show them what you got. Right? And like you said, companies like Imperva and Marty’s _____ source fire and many others have been recognized over the years at the Sandbox Innovation or Innovation Sandbox contest. So it really is great.

    Why don’t, if you can, Cecilia, let’s talk a little bit. What is the process? How do the companies get selected? How is a winner picked? Give our audience a little insight?

    Marinier: Absolutely. So right now is the submission period and right now, any company that is less than five years old and less than $5 million in revenue can apply online for the contest and there’s an application process. You send in a 3 minute video that can be taped in your offices. It doesn’t have to be professionally made. And all those submissions are then sent to the judges and our judges are extraordinarily awesome this year. I’m really proud of the diversity.

    So one of the things that we do when we’re looking at Innovation Sandbox Context to ensure that the company will be successful, is we have all the people who are interested and understand what it takes to make a successful company. So we have our venture capitalist. We have our siso who’s the buyer. We have an entrepreneur, a veteran entrepreneur who this year is actually Shlomo Cramer who has been a –

    Shimel: Who?

    Marinier: Veteran on the stage. Shlomo Cramer from Cato Network and Imperva and Checkpoint. So Shlomo will be our entrepreneur and then we also have a chief strategy officer who’s representing what it’s like to be a buyer inside a large company. So we cover the gamut of what will it take to actually take this to market and I think that’s one of the – why this is always choosing very successful companies. Even most recently, if you look at Phantom which was acquired by Splunk or if you look at Unify ID who won in 2017 and they received good funding right afterwards, it’s a great Launchpad for a lot of different – I shouldn’t say Launchpad. It’s a great place for companies to actually showcase their latest products. The only other caveat is the product has to have come out between December 1st 2017 and December 1st 2018. So we’re looking at those start ups that have launched their product and if they’re ready to go to market, they can apply online for Innovation Sandbox Contest.

    Shimel: Excellent. Excellent, excellent, excellent. I will include the URLs for all that, guys, with the show notes here in the podcast. And Cecilia, I really should chime in in that yeah, there’s been a lot of quote on quote famous companies that won but what I always loved about the sandbox contest was the pure democracy of it. Right? It’s really as open to any company that’s under five years and under $5 million and the three minute limit on the video, they mean three minutes. I, myself, have worked on these videos in the past and I know we’ve word smithed them and talked faster to get as much as we can in on those three minutes as possible but it really is.

    You don’t have to be a blue chip VC-backed company here to invest or to enter and even to win. There’s been companies that weren’t DC backed at the time over the years that have won, if I’m not mistaken.

    Marinier: Yes.

    Shimel: Yep. And I remember – and wound up leading where – it’s hard to draw. It’s a dotted line but it wound up leading to those companies getting funding as a result of winning as well. So it really is. It’s a prestigious thing to win. Now, if someone’s out here listening and say, “Oh, I may go to RSA Conference this year,” and by the way, if you are, there’s some discount codes available on Security Boulevard and devopsy.kinsta.cloud through our RSA Conference partnership, if you are looking to attend. But if you are looking to attend, Cecilia, how can the attendees interact and see what’s going on and participate in Sandbox Innovation Contest?

    Marinier: Well, actually, the conference itself has really made big strides in trying to build an ecosystem around innovation. So in addition to the Innovation Sandbox Contest, which does have a break while the judges is evaluating the companies to chose a winner and the attendees for that particular event can go meet the top 10. There’s kiosks there. But in addition, we’ve created a couple other opportunities for the attendees to see what’s happening in innovation and cyber security and one of those areas is called the early stage expo. And this area has 50 startups this year. We’re up to 50 startups and it also has a small briefing center and yeah, it’s an amazing opportunity. It’s located right next to the sandbox that was talked about earlier and it runs from Tuesday through Thursday so you can check the hours online for that.

    Additionally, if you are an entrepreneur but you’re not quite there yet and you wanna learn a little bit more about how to become an entrepreneur, we have a half day how-to seminar on Monday which covers how to get funding, how to get in front of the busy CISO, how to go to market and the journey of an entrepreneur. So all of these are elements that are tied into what’s going on in innovation itself. And then also, additionally, we have this new event that we’re launching which I’m pretty psyched about which is called RSA Conference Launch Pad. And I’m happy to share more about that with you right now or we can wait and put it on hold and I’ll tell you a little bit later [laughs].

    Shimel: No, no. Go ahead. That cat’s out of the bag. Let’s go.

    Marinier: All righty. So the thing about RSA Conference Innovation Sandbox Contest that we noticed was that we’d had a lot of strong, solid companies that I would almost say later stage startups. What we thought would be really cool and what we saw in some of the submissions that were just in the cusp of getting ready to launch their product but had not quite done so yet and so they didn’t qualify during that year. And what we wanted to do was offer them a different opportunity, which, again, is to get in front of this audience but this time, they’re going just in front of three venture capitalists and there’s three very strong venture capitalists based here in Silicon Valley that their names are gonna be really well-known when you see them.

    And this is kinda more like a “Shark Tank” kind of event where you’ll go and they’ll be pitching in front of the audience and maybe one of these venture capitalists might just put some money towards one of the companies. There will only be three of them. It’s not a winner take all. It’s literally just an opportunity for people to see what are the venture capitalists interested in, what kinda questions are they asking, and then also to kinda get a glimpse into an earlier stage start up. So it’s really fun and exciting and that’s on Tuesday afternoon and that will be a really fun event as well.

    Shimel: Excellent. Excellent. You know what amazes me, Cecilia? So I’ve been in the – we’ve spoke off mic and I’ve been going to RSA Conference since like 2002, 2003 maybe. And what amazes me is I remember back in maybe around 2005 or 2006, I had started something called the Security Bloggers Network. We had our security bloggers meet up every year. This is when blogging about security was first becoming really popular, ’04, ’05. And RSA Conference, actually, was a catalyst and a sponsor of this back then. We’ll be doing it again this year. I think it’s the … I don’t know, 15th or 12th. I forget how many years. We’ve been doing it a long time.

    Anyway, we were talking back then and I remember hearing people say something like, “Do you know there are 600 or 700 security companies in the world? There’s no way the market can support that many …” We didn’t call it cybersecurity. It was InfoSec. “There’s no way the market can support that many InfoSec companies.” And now, we look at RSA Conference today and there’s something like 500 companies or so exhibiting at RSA in that range. And we –

    Marinier: Yeah. There is.

    Shimel: Do you know the number? I don’t.

    Marinier: I believe there are 600 going to be on the floor this year, plus the 50 at early stage expo. So over 600 is what I was –

    Shimel: Well, there you go.

    Marinier: Comfortable saying over 600 for sure [laughs].

    Shimel: Yeah. So there you go. There are more than that just exhibiting at RSA Conference this year so the growth in the market. But to give them something like this early stage expo is really such a leg up because you know what? I’ve been on both sides of this from this divide and it’s not cheap. It’s not cheap going to any conference in San Francisco. It’s not cheap exhibiting at a conference in San Francisco. And I don’t mean to single out San Francisco. It’s not cheap, period, doing conferences. And but in the case of RSA, it very much is a question of, “Well, if you’re not there, people ask why. Are you really a player? Are you serious? How could you not be at the biggest event of the industry?”

    And so giving them a sort of fast track, and quite frankly, a bit of a discount to get your foot in the door, it’s a great thing. So kudos to RSA, to RSA Conference for doing this and I think it’ll be really cool. I encourage people to go check out some of the folks in the Launchpad because that’s where you’ll find _____ _____.

    Marinier: And also, yeah, in that early stage expo area, it is exactly like you said. It’s what we’ve heard from the people who are exhibiting in that area is they love it because the people who come into early stage expo are really interested in learning more about each of the companies and they’ll stop. And the kiosks are not that large but they all have just an interesting background and story and there’s a lot of people that walk through and just really enjoy getting to have that personal attention from the CEO of the company because they’re so – these companies are so small that you’re meeting the CTO. You’re meeting the CEO. So it’s really a cool little area. I really hope that your listeners all get to stop by and check it out.

    Shimel: Absolutely. And just to be clear, usually the expo floor for RSA opens up the Monday night, which I think is March 4th this year.

    Marinier: It is.

    Shimel: Will the innovation area, the Launch Pad area and Sandbox be open Monday?

    Marinier: No. So Innovation Sandbox Contest runs from 1:30 PM to 4:30 PM on Monday, March 4th.

    Shimel: On Monday.

    Marinier: Yes. And it closes and then that’s when we go over to the welcome reception. We encourage people to go over to the welcome reception at the Moscone. We’re actually going to be at the Marriott this year so please come to the Marriott.

    Shimel: Oh, okay.

    Marinier: That’s where we’re gonna be for all the innovation –

    [Crosstalk]

    Shimel: Okay. I didn’t know that. So they are still using Marriott this year. I thought the construction on Moscone was gonna be finished and everything was moving in.

    Marinier: I thought so too and the construction has –

    [Laughter]

    The construction actually has been promised to be done but the area that they were anticipating, the thing that Innovation Sandbox Contest has grown so big that we need to have this size room that can hold 2,000 people and so that’s why we’re there, we’re over at the Marriott this year. And hopefully, in the future, they’ll be able to – it will change and we’ll all be in the same area but the Marriott is really close to Moscone West so I hope –

    Shimel: Oh, no, no, no. It’s right around the corner between Jillian’s. You go Moscone, Jillian’s, and the Marriott. And I should also mention that also Monday starting at 9:00 AM in the morning, I’ll be running for the fifth year, our DevOps Connect DevSecOps days event in Moscone. RSA Conference obviously puts us on and I was lucky. I got moved to Moscone last year, Cecilia. We were like the first people in this beautiful room up in … I guess it’s Moscone North. It’s a brand new section. It’ll be up there and I think it was us and the Cloud Security Alliance. We were right next to each other and …

    Marinier: You’re making me jealous. You’re making me jealous, Alan.

    Shimel: I’m sorry. I don’t wanna rub it in but I was told we’ll have the same room this year. So we start at 9:00 AM. We’ll run through 4:00 PM but there’s plenty of time to run back and forth here from the Marriott to the Moscone. It’s literally a couple of steps.

    Marinier: Yep. It’s very close.

    Shimel: So I encourage everyone to do do both. And then the launch pad is … will run through the whole expo?

    Marinier: The Launchpad is the event on Tuesday with the sharks, with the venture capitalists and then the early stage expo areas opens right after that as Launch Pad closes. As soon as Launch Pad finishes that event, we open the whole space, the Sandbox and the Early Stage Expo. Actually, it’s opened with the Cyber Ops, which is kind of a fun little networking event in addition to opening the space. And then it will be open from 8:00 AM to 4:00 PM on Wednesday and from 8:00 AM to 3:00 PM on Thursday.

    Shimel: Fantastic. Well, Cecilia, when we started, I told you that once we start talking shop, the time just flies. So I’m sorry to say that we’re about out of time. But just man, I’m already really pumped for RSA Conference this year but I always am but I’m really excited for what’s going on with the Sandbox, Innovation Sandbox Contest, the Launchpad, the Startup Showcase. If you’re not moving forward in this business, you’re dying, as they say, right? And RSA Conference continues to move forward in being innovative and getting these new companies a shot at getting their bite at the ring or grabbing the ring or whatever you wanna call it, bite at the apple. So congratulations to you and the team for doing this and thanks for doing it.

    Marinier: Thank you.

    Shimel: And we’re looking forward to it. We’ll be there. We’ll check it out. Maybe we’ll report. There’s a good chance we might be on Broadcast Row over in Moscone West during the week doing some video broadcasting. And if so, maybe we can get you and some of the folks from the Sandbox contest and the showcase in and we can make them movie stars or at least YouTube stars [laughs].

    Marinier: Sounds great. Sounds great.

    Shimel: All righty. Fantastic. Cecilia Marinier. Close?

    Marinier: Excellent. Very good.

    Shimel: I’m getting there, man.

    [Crosstalk]

    A French model on the internet like the commercial says. Anyway, Cecilia, thank you so much for being our guest here on DevOps Chat. Good luck with RSA Conference. It’s coming up in a few months. Hey, Sandbox Contest applications are available if you’re listening. Go do it. And you’re eligible and you think you’ve got a shot here, I would encourage you. But for now, this is Alan Shimel for devopsy.kinsta.cloud and Security Boulevard and you’ve just listened to another DevOps Chat. Have a great day everyone.

    — Alan Shimel

  • Aqua Security Survey Finds Sharp Rise in DevSecOps

    Aqua Security Survey Finds Sharp Rise in DevSecOps

    A new survey of 80 cybersecurity professionals that attended the recent RSA Conference 2018 event finds the number of organizations that have a formal or informal DevSecOps team in place has increased by several orders of magnitude year over year.

    The survey, conducted by Aqua Security, finds 62 percent of respondents have a formal or informal DevSecOps team. That’s up from last year, during which a similar survey found only 13 percent of respondents had a DevSecOps team in place.

    It’s still early days when it comes to implementing DevSecOps processes. But Andy Feit, vice president of go-to-market for Aqua Security, said the survey also makes it clear that these formal and informal DevSecOps teams have access to budget dollars. More than three-quarters of respondents (76 percent) said their application security budget has increased over the past five years. One-quarter (25 percent) reported the application security budget went up between 10 percent and 30 percent, and another 14 percent said budget dollars being allocated to application security increased by more than 40 percent.

    Well over half of respondents (57 percent) said they have the human and financial resources in place to implement DevSecOps. A total of 70 percent of respondents said they believe their culture can embrace the change needed to fuse security and DevOps. Nearly half the respondents (47 percent) reported they are fairly or very mature in their implementation of DevSecOps, while another 39 percent ranked themselves as maturing.

    The three most important elements of DevSecOps as ranked by respondents ranked applying security across the app life cycle (61 percent), automating application security controls (52 percent) and involving DevOps in security processes (43 percent).

    The shift to DevSecOps is occurring in tandem with increased reliance on microservices that are based on containers. As that shift occurs, Feit said IT organizations are rethinking their approach to application security. In delivering applications as a series of microservices, it becomes critical to apply a more granular approach to securing those applications that developers can apply as they build applications. Cybersecurity professionals will then be able to focus more of their efforts on crafting the security polices that developers implement, he said.

    It may take a while longer before cybersecurity professionals gain enough confidence in containers to deploy them on physical servers with relying on a hypervisor to provide isolation. But it’s also now only a matter of time before developers insist on deploying containers applications on bare-metal servers to attain the maximum amount of performance possible by eliminating all the overhead added by a virtual machine. As that shift occurs, IT organizations will need new tools to secure and manage containers running on bare-metal servers.

    As the same time, it’s clear that securing all those containers will require new processes such as DevSecOps because instead of patching applications to remediate them, developers will more easily replace specific containers to add new functions. Less clear is whether the adoption of DevSecOps will be driven from the top down or more as a grassroots initiative driven by the mutual self-interest of developers and IT security professionals. Regardless of the approach, cybersecurity as it is known today will not only be much different, but also arguably better.

    — Mike Vizard

  • DevOps Connect: DevSecOps Edition Complete Session Videos

    DevOps Connect: DevSecOps Edition Complete Session Videos

    [nextpage title=”Introduction” ]

    The third annual “DevOps Connect: DevSecOps” held at RSA Conference 2017 shows just how far DevOps has matured in recent years from IT subculture to mainstream practice. In the presentations in this slide show, you’ll see firsthand accounts where enterprises have transformed legacy methodologies to DevOps practices, building more healthy cultures and, of course, more secure software.

    [/nextpage]

     

     

     

     

    [nextpage title=”Breaking Bad Equilibrium” ]

    Breaking Bad Equilibrium

    John Willis

    In DevOps we try to identify and fix bad equilibrium. We constantly look for discontinuity in the areas of technical debt, collaboration, risk and work-life balance. In this presentation, John Willis looks at some other successful fields that address equilibrium and discontinuity in their respective fields. Willis looks at areas of behavior economics, cognitive psychology and game theory. He also has some fun with a few pop culture books, movies and game shows as examples of bad and/or Nash equilibrium.

    You can see this presentation here.

     

    [/nextpage]

    [nextpage title=”A Tale of Two Stories” ]

     

     

    Building Security In: A Tale of Two Stories

    Laksh Raghavan

    The holy grail for software security professionals is to make their development teams treat functional and non-functional requirements as equal citizens. This becomes even more challenging in “agile.” Wouldn’t it be great if you had a quick and easy means by which you can write pertinent and actionable “security stories” and place them into the backlog of all your scrum teams so that they can get prioritized and completed along with “user stories”? The challenge, however, is making this scalable and seamless in a large enterprise with diverse sets of frameworks, application stacks and programming languages. In this talk, Raghavan shares tales from the trenches of implementing such a system—what worked, what proved challenging and the associated outcomes.

    You can see this presentation here.

    [/nextpage]

    [nextpage title=”2016 State of DevOps Report” ]

     

     

    DevOps and Security: What We’ve Learned from the 2016 State of DevOps Report

    Dr. Nicole Forsgren & Jez Humble

    Four years and more than 20,000 survey respondents later, Forsgren and Humble have learned a lot about what makes IT and organizational performance awesome. They also have learned some things about the role that security plays in technology transformations. Their latest research includes insights into trunk-based development, lean product management and employee engagement. Watch this talk for practical takeaways that will  make your teams and technology transformations even better.

    You can see this presentation here.

    [/nextpage]

    [nextpage title=”Bits and Bytes” ]

     

    Where Bits and Bytes Meet Flesh and Blood: DevOps, Cybersecurity and IoT

    Joshua Corman

    We’ve heard software is eating the world. Corman says software is infecting the world. Our dependence on connected technology is growing faster than our ability to secure it—in areas affecting public safety and human life. Adding millions of lines of code and connecting everything to everything else exposes cyber-physical systems to new accidents and adversaries, Corman contends in this talk. This is truly where bits and bytes meet flesh and blood.

    Despite best practices, modern software development and security have allowed 100 of the Fortune 100 to lose intellectual property and sensitive information—even our governments routinely succumb to adversaries. These failure rates cannot stand with the consequences of failure being measured—not in record count—but in human lives and GDP. Paradoxically, Corman says, it may take DevOps to rise to these challenges. Rugged DevOps is finding un-obvious common ground and breakthroughs like software supply chain principles, greater visibility and response agility, and immutable infrastructure. Corman says we must be better, and provides his view of what better looks like.

    You can see this presentation here.

     

    [/nextpage]

    [nextpage title=”Release engineering” ]

     

    The Intersection of Release Engineering and Rugged DevOps

    Paul Reed

    At RSAC 2016, release engineering’s role in rugged DevOps was discussed with a focus on how it relates to software delivery supply chains and the increasingly critically important topic of security and security management.

    This year, J. Paul Reed explores what we’ve learned in the past year about the intersection of release engineering and rugged DevOps.

    He takes take a deeper dive into specific release engineering techniques and tools that can not only start you on the path to effectively managing your software supply chain, but also pay concrete dividends in making your software’s security posture better and help you remediate issues more quickly when a security issues arises.

    He also explores some nascent trends on the frontier of software delivery and security management, including the role of human factors and systems safety in the broader context of fast, sustainable and, yes, secure delivery of increasingly critical software components in our society.

    You can see this presentation here.

    [/nextpage]

    [nextpage title=”Next Gen Security” ]

     

    Next Gen Security Needs You!

    Shannon Lietz

    Next-generation software deserves security from the start and better collaboration to effectively reduce the real risks posed by attackers. Some might say this is heresy, but given the endless trend of security breaches from traditional methods, likely not. The ideal state of security has always been to achieve continuous improvement or level 5 maturity. By this very intention, security has always been a significant factor in the production of software but relatively difficult to commoditize because of its complexity.

    Using DevSecOps methods and principles, simplicity and high-fidelity controls are emerging within the software industry to help organizations forecast and react faster to attackers. Lietz’s talk provides an essential road map for security practitioners to tackle how to bring DevSecOps to their organization and avoid common pitfalls that have come from early day lessons.

    You can see this presentation here.

     

     

    [/nextpage]

    [nextpage title=”DevOps in a Regulated Environment” ]

     

     

    Implementing DevOps in a Regulated Environment: The Aetna Experience

    Duane Schleen

    One of the big challenges organizations are facing is how to introduce DevOps principles to regulated industries. Industries such as health care or financial services must adhere to stringent security and governance controls, which often make it difficult to adopt new technology stacks such as DevOps and containerization. If you have adopted an agile approach to software development and have plans for moving to DevOps, microservices and containerization, what processes do you follow to avoid compliance missteps? This talk shares Aetna’s journey of modernizing its application stacks and infrastructure.

    Schleen covers which considerations went into the design and selection of the DevOps methodologies, which applications were moved to microservices and containerization first and what was observed as a result. Schleen also covers how security departments can help the business understand the advantages of DevOps and containers—removing fear rather than adding fear. Finally, Schleen details the experience of architecting security across a rapidly changing application environment, and how continuous integration and continuous monitoring can go hand in hand in delivering application agility, but also security vigilance and competency.

     

    You can see this presentation here.

     

    [/nextpage]

    [nextpage title=”Ops Happens” ]

     

     

    Ops Happens: DevOps After Deployment

    Damon Edwards

    Listen to enough DevOps conference talks and it all starts to sound like: “deployment, deployment, deployment.” But what happens after deployment? What does DevOps mean for other traditional enterprise operations activities such as incident response, problem management and compliance?

    Damon Edwards tackles these questions in this session. Here, Edwards examines what happens when the “go fast” ethos of DevOps inspired delivery teams meets the “be stable, be secure, be compliant” mandate of traditional enterprise operations organizations.

    Damon also identifies DevOps-inspired principles and practices being leveraged by high-performing enterprises who are currently transforming their operations organizations.

     

    You can see this presentation here.

     

    [/nextpage]

     

    [nextpage title=”Requirements Gathering” ]

     

     

    Requirements Gathering for a Successful Rugged DevOps Implementation

    Hasan Yasar

    It is a must to include secure coding practices in application development life cycles to produce rugged software. Yet, each organization’s development pipeline and application is different compared to others. It is also necessary to have preparation prior to having a successful implementation of rugged DevOps. This includes organizational culture, security policy, development platform, application technical stack, operational team involvement and foremost secure coding practices. The questions are: how to assess, what to find as bottleneck, train whom on what, what to measure and, finally, how to monitor. Then, build up your customized integrated DevOps platform where you can build a rugged application along with other quality attributes such as compliances, secure testing, performance monitoring.

    The burgeoning concepts of DevOps include a number of concepts that can be applied to increasing the security of developed applications. These include adding risk-based architectural design, automated security testing techniques such as fuzz testing, software penetration testing to the software development cycle or the continuous integration cycle. Applying these and other DevOps principles can have a big impact on creating an environment that is resilient and secure. In this session, Yasar explains how his company figured the right requirements and then how you can utilize this in your own organization for Rugged DevOps.

    You can see this presentation here.

    [/nextpage]

    [nextpage title=”Getting Security Up to Speed” ]

     

    Getting Security Up to Speed

    Oleg Gryb

    So, you’ve adopted agile software development life cycle and your DevOps team runs continuous integration/continuous deployment. But what about security? If you haven’t figured out yet how to speed up your security processes , it can easily become a bottleneck and slow down the whole software development process. Gryb shows how to avoid this.

    Gryb discusses how to replace old security processes with the new processes, and how to add more security automation tools that utilize existing quality assurance test cases.

    You can see this presentation here.

    [/nextpage]

    [nextpage title=”Scaling Rugged DevOps” ]

     

     

    Scaling Rugged DevOps to Thousands of Applications 

    Tim Chase, Aaron Rinehart, Jeff Williams

    Most of the talks on rugged DevOps are trivial. Write a script to hook up your scanner to Jenkins, and your WAF to your SIEM, feed the results to developers via JIRA, and claim victory. If you have multiple tools, maybe push the results into ThreadFix. But very quickly your cup will runneth over with vulnerability reports that need to be manually triaged. If you try to scale, you’ll need a dump truck and an army. If you want to really scale rugged DevOps, you need to get the humans out of the critical path.

    In this talk, this trio explores how large enterprises handle this challenge by instrumenting their application portfolio, assessing and protecting applications in parallel and integrations enabling instant notification directly to stakeholders. The result is continuous protection during both development and operations.

     

    You can see this presentation here.

     

    [/nextpage]

    [nextpage title=”Other articles” ]

    Other devopsy.kinsta.cloud Articles you might like:

    Security @ the Speed of DevOps Survey: Efforts Still Lag

    The Elusive Definition of DevOps

    DevOps in 2017: From Building to Executing

    [/nextpage]

    — George V. Hulme