devopsy.kinsta.cloud

Tag: RSAC

Sysdig Adds Runtime to Secure AI Coding Agents

Sysdig this week at the RSA Conference (RSAC) revealed it has created a runtime that makes it possible to securely deploy artificial intelligence (AI) coding tools.

Jonas Rosland, director of the open source program for Sysdig, said the runtime makes it possible to monitor the activity of AI coding agents in real time, including potential credential risks. It also enables investigation of incidents involving AI agent activity, he added.

Additionally, AI agents can be prevented from opening sensitive files or bypassing credential controls. Risky command-line arguments that weaken safeguards, such as allowing unrestricted file writes, are also prevented.

Dangerous activity with developer environments, including reverse shells, binary tampering, and persistence mechanisms, can also be prevented.

As AI coding tools are made available to both professional and citizen-developers alike, the likelihood of a cybersecurity incident involving these tools continues to rise. DevSecOps teams need to enable application developers to safely add plug-ins and skills to these tools. The challenge is that skills can also include a malicious prompt that could potentially instruct an AI agent to, for example, delete a database running in a production environment, noted Rosland.

The only way to prevent those types of attacks is to be able to observe what an AI agent is doing at a granular level, he added. Otherwise, the speed at which AI agents are able to access directories, files and external resources will overwhelm and bypass existing safeguards, said Rosland.

Each application development team will need to determine to what degree to invest in AI coding tools, but a recent Futurum Group survey finds a full 60% of respondents reporting their organization is now actively using AI to build and deploy software.

Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group, said AI coding agents operating in development environments have created a runtime threat surface that governance policy alone cannot contain. Sysdig’s agent runtime signals that controlling AI coding tool behavior requires execution-layer enforcement to provide real-time visibility into agent activity, he added.

For DevSecOps teams extending AI tools to citizen developers, the risk is concrete, noted Ashley. Malicious skills can instruct agents to access unauthorized credentials, tamper with binaries, or delete production data. Runtime enforcement is the control layer that determines what agents can actually execute, said Ashley.

No one knows for sure how proactive DevSecOps teams will be when it comes to securing AI coding tools. It may require a few more major incidents until the full scope of the threat is fully appreciated. In the meantime, DevSecOps teams should remind application developers who experiment with emerging technologies of the potential risks. The more isolated the application development environment being used to write code using AI agents the better. After all, the danger only really manifests when AI agents start accessing every data source available so the most important thing may be to create a sandbox where they are contained to the fullest extent possible.

March 26, 2026
DevOps Connect at RSAC 2021: Insightful Talks, Live Q&A, Workshops, Pilates and More
We are excited to announce the return of DevOps Connect: DevSecOps Virtual Summit on May 19, as part of the RSA Conference 2021. This year, internationally recognized speakers will take a deep dive into “Securing the Cloud Native World.”

DevOps Connect is a full-day event, featuring four different content tracks, with more than 50 speakers, including keynote presentations, demos, insight talks and featured sessions.

The agenda features a mix of topics, including cloud security, CI/CD, Kubernetes, GitOps, AppSec, security risks, shift left, open source, case studies covering DevSecOps and more. Attendees will learn how the finance, manufacturing, healthcare and hospitality industries are securing their cloud environments, and how to better secure and monitor their systems.

DevOps Connect 2021 Lineup

DevOps Connect 2021 features an exceptional lineup of the most prominent and respected security and DevOps leaders, including:
- Featured keynote speaker: Christopher Krebs, former director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and co-founder of Krebs Stamos Group LLC
- Chenxi Wang, founder and general partner at Rain Capital
- Allan Friedman, director of cybersecurity initiatives at National Telecommunications and Information Administration in the U.S. Department of Commerce
- John Willis, senior director of Global Transformation Office at Red Hat
- Cyndi Gula, managing partner at Gula Tech Adventures
- Alessandro Vozza, principal software engineer at Microsoft
- Caroline Wong, CSO at Cobalt
- Thomas Krane, principal at Insight Partners
- Charles J. Kolodgy, principal at Security Mindsets LLC and analyst at Accelerated Strategies Group
- Nisha Kumar, open source engineer at VMware
- Mike Rothman, president at DisruptOps
- Dave Howell, VP at ZeroNorth
- Maciej Mensfeld, senior product manager at WhiteSource
- Matt Wilson, senior product manager at GitLab
- Erkang Zheng, founder and CEO at JupiterOne
- Philippe Humeau, CEO at CrowdSec
- Jennifer Czaplewski, director of product security at Target
- Al Sargent, senior director of product at InfluxData
Former CISA director Christopher Krebs, our featured keynote speaker, will be answering questions from the audience during a live Q&A.

Workshop Friday

We are also hosting Workshop Friday, as we wrap up the RSAC 2021, offering live workshops designed to be as interactive and hands-on as possible with experts from Google, JupiterOne, Sysdig and Sonatype. These workshops provide professional guidance and training on a variety of topics, including Site Reliability Engineering (SRE), AWS cloud security and protecting against supply chain attacks. On May 21, attendees will have the opportunity to interact with the experts, share their process, get immediate feedback and personal assistance. Each workshop will be live-streamed through our online platform at no cost to attendees. We have limited spots available. Seats are reserved on a first-come, first-served basis. To save your spot, visit the Workshop Friday website.

A Unique Virtual Environment and a Few Surprises

The virtual environment features an auditorium with different tracks where attendees can watch the sessions by industry experts. There will be an expo hall lined with booths featuring interactive chats and downloadable resources. The expo hall will be open throughout the event, giving attendees the opportunity to chat with sponsors, including GitLab, Prisma Cloud by Palo Alto Networks, Sonatype, WhiteSource, Sysdig, JupiterOne, Snyk and more.

We have a few surprises planned to make this year’s DevOps Connect extra special. Take a break between presentations, grab your yoga mat and enjoy a Pilates class by a certified instructor, dance to the music of our featured DJ and check out how to make a delicious cloud drink by a professional mixologist. You can also participate in a raffle to win a copy of “You Can Stop Stupid” by Ira Winkler, author and president at Secure Mentem, and a copy of “Security Yearbook 2020” by Richard Stiennon, industry analyst at IT-Harvest.

DevOps Connect 2021 offers the best of a physical environment in a virtual context combined with the advantages and convenience that a virtual environment offers.

Registered attendees will receive a link to access the virtual environment on-demand. To check out the full agenda and to register, visit the DevOps Connect website.
May 6, 2021
The Time for Collaborative Security Is Now

As Bruce Schneier famously said, “security is a process, not a product.” We commonly see companies pour millions of dollars into cybersecurity products and tools to protect against vulnerabilities and lower risks, and yet, more often than not these ample funds are not enough to defend against attacks.

Within the span of two decades, we have seen how social power can be leveraged to benefit the masses with applications like Waze, Airbnb, Uber and many others. This same innovative idea could revolutionize the way the cyber world operates by giving security professionals the edge in identifying potential threats.

CrowdSec CEO Philippe Humeau recognizes the capabilities of crowd power to invigorate the cyber realm. The community firewall created by CrowdSec uncovers thousands of malicious IP addresses worldwide and helps cripple hacker behavior before it can evolve into major cyberattacks and data breaches. Additionally, the start up just announced it raised $5 million to help take the collaborative firewall to the next level as they work to transform the cybersecurity landscape.

In the interview below, Philippe emphasizes the benefits of collaborative, open and transparent security environments in tipping the scales against the hacking dilemma that plagues companies across the globe.

Join Philippe at DevOps Connect 2021 on May 19, during the RSA Conference, where he expands on this topic in his session “The Age of Collaborative Security.” Also, learn more about CrowdSec and see a demo of the tool during his spotlight session, “Introducing CrowdSec, The Open-Source Massively Multiplayer Firewall.”

To see the full agenda and secure your free spot at the virtual event, visit the DevOps Connect website.

May 5, 2021
How to Bring DevOps and Security Teams Closer Together

More often than not, there seems to be friction between DevOps and security teams. Despite having the same end goals of creating the most secure code and preventing any potential security pitfalls, these groups of professionals often lack the unity needed to accomplish these end goals effectively and efficiently.

In the interview below, Naomi Buckwalter, director of information security and IT at Beam Technologies, addresses this issue and outlines key ways development and security teams can come together to better accomplish their shared missions. She stresses the importance of security professionals reaching out a hand to their DevOps counterparts to teach them how to be security-forward when writing code. However, she highlights how not every security expert has a developer background, so it really takes these two groups of skilled tech specialists working in unison to fill those knowledge gaps for each other.

Naomi brings over 20 years of IT and security experience to her upcoming session “Six Things Developers Want From InfoSec,” at DevOps Connect 2021, during the RSA Conference. She will expand on some of the key topics discussed in this interview during her talk on May 19 at 4 p.m. EDT.

To see the full agenda and secure your free spot at the virtual event, visit the DevOps Connect website.

May 4, 2021
Live Fireside Chat with Christopher Krebs: How to Combat Disinformation

We live in a digital world where most information is now found online. This makes it increasingly difficult to verify the veracity of information. Threat actors have been taking advantage of the digital landscape to spread disinformation, propaganda and conspiracy theories to manipulate the public and sow doubt, discord and chaos. How can we distinguish between fact and opinion, truth and supposition? How can we spot fake news and tackle disinformation?

Former Director of the Department of Homeland’s Cybersecurity and Infrastructure Security Agency (CISA) and Co-Founder of Krebs Stamos Group, Christopher Krebs, will be speaking about disinformation at this year’s DevOps Connect: DevSecOps on May 19 at 12:00 p.m. EDT. During his keynote session, Krebs will explain what disinformation is, how to recognize fake news and the challenges disinformation poses to cybersecurity teams. He will reveal effective ways to combat disinformation, and how public and private partnerships can help. Krebs will also be answering questions from the audience during the live Q&A session.

Krebs is a founding partner of the Krebs Stamos Group, and previously served as the first director of the federal CISA for two years. Before that, he served in various roles at the Department of Homeland Security (DHS), responsible for a range of cybersecurity, critical infrastructure and national resilience issues. He has also directed U.S. cybersecurity policy for Microsoft and advised industry and government clients on complex cybersecurity and business risk matters while serving in positions with Obsidian Analysis and Dutko Consulting.

DevOps Connect: DevSecOps has been part of the RSA Conference for six years in a row. This year, the main focus of the event is on “Securing the Cloud Native World.” Krebs has joined a stellar lineup of DevOps, cybersecurity and IT thought leaders as the DevOps Connect 2021 featured keynote speaker. Attend his live session, “Disinformation: As Dangerous as Cyber and Physical Threats,” and check out all the other breakout sessions to learn more about cloud security, DevSecOps, cybersecurity threats—such as disinformation—and more.

For more information and to register for free, visit the DevOps Connect 2021 website. Save your spot today and learn how to better secure, monitor and maintain the security of your systems.

May 3, 2021
Announcing DevOps Connect: DevSecOps Days Virtual Summit

We just wrapped up our fifth annual DevSecOps Days @ RSA Conference 2019, featuring an exceptional lineup of speakers and a variety of informative sessions, providing an unparalleled experience for all. If you couldn’t make it to San Francisco for RSAC or missed any sessions, we’ll be hosting a virtual version of DevSecOps Days @ RSAC Tuesday, April 2.

You’ll hear stories from DevSecOps practitioners discussing how they made the cultural transformation from legacy development and deployment processes to integrated systems that include security as a part of the process—not as an overseer or bottleneck to secure application development.

Similar to the environment we created for the DevOps Experience and Predict 2019 virtual events, DevOps Connect: DevSecOps Days Virtual Summit will feature a virtual environment with a conference lobby, presentation theater, expo hall and more. DevOps Connect: DevSecOps Days Virtual Summit is more than a series of YouTube live presentations; it is a true conference experience, from the comfort of your desk.

Join John Willis, Chenxi Wang, Shannon Lietz, James Wickett and other industry luminaries for a deep dive into the world of DevSecOps. Register now to attend live Tuesday, April 2. Registration is FREE, but space is limited. Reserve your spot now!

[su_button url=”https://devopsconnectdevsecops.com/#join-us” target=”blank” background=”#DC2E2A” size=”5″ center=”yes”]SAVE YOUR VIRTUAL SPOT[/su_button]

[su_divider]

[su_button url=”https://devopsconnectdevsecops.com/#join-us” target=”blank” background=”#DC2E2A” size=”5″ center=”yes”]SAVE YOUR VIRTUAL SPOT[/su_button]
[su_divider]

MediaOps is the company behind technical communities devopsy.kinsta.cloud, Container Journal, Security Boulevard and DevOps TV, and events including DevOps Experience, Predict 2019 and, now, DevOps Connect: DevSecOps Days. Our virtual events take place in the industry’s first truly immersive, virtual reality conference environment. More than a series of Google Hangouts, DevOps Connect: DevSecOps Days is a true virtual conference, replete with theaters for each of the keynotes and presentations, a conference lobby to chat and socialize, and a real virtual expo floor with virtual exhibitor stands equipped with video, downloads and even swag for attendees.

Follow us on Twitter at @devopsdotcom and @securityblvd for event updates. Use the hashtag #devsecopsdays and let us know if you are going!

— saleem

March 12, 2019
Bridge the DevSecOps Experience Divide with Cross-Functional Teams

Last week’s DevOps Connect event at RSA Conference offered up a ton of wisdom and real-world examples of the power of DevSecOps. With its best-ever attendance after several years and impressive participation levels, this year’s event stands as a good harbinger for the growing interest that the security community has in vesting itself in the DevOps phenomenon.

But there’s still a lot of work to do in helping security professionals shift their mindsets and fully understand what DevSecOps is all about. Questions from the audience offered evidence of some of the trepidation and misconceptions that still exist in the security community.

For example, after one of the first talks of the day, an audience member asked about a typical point of confusion for those new to DevOps—namely, the misunderstanding that the melding of disciplines and the requirement that DevOps team members flex their skills across traditional IT boundaries also means that everyone in IT must be renaissance men and women with a range of in-depth knowledge about all IT specialties.

“Not everyone can know .NET, not everyone can know Python, not everyone can know firewalls,” the audience member said. “I’ve been doing this a long time and it takes a lot to become an expert in any one of these categories. And yet I’m hearing, ‘Oh, everyone needs to know it all.’ They can’t, so how do you deal with that?”

This was a valuable question to revisit here, because the response from one particular speaker offers up an extremely important tenet that everyone in the DevSecOps world needs to keep in mind. The answer came from Paula Thrasher, a longtime DevOps evangelist in one of the hardest spaces to implement cutting edge IT processes: federal IT. As she explained, one of the biggest success criteria for a successful DevSecOps transformation is the ability to build fully engaged cross-functional teams. Individuals working within the DevOps are not meant to know everything. Rather, different specialists need to be paired up so the complete team has that full body of knowledge at its fingertips.

“It’s the fidelity of your collaboration within the cross-functional team that makes this successful,” explained Thrasher, who is director of digital services for General Dynamics, a large federal IT integrator.

For example, she pointed to one particular team she has seen in her work that is the epitome of a solid cross-functional team.

“My teams all have mascots, and so one of our teams is the Tigers. The best quote I’ve heard from a team about this topic came from a new employee who said, ‘If one Tiger knows it, they all know it,’” she said. “This is a team that has a crazy diverse background—there’s developers, there’s ops people, there’s a former networker on there—and it doesn’t require everyone on that team to know everything. They collaborate so well that if there’s a network vulnerability, the network guy knows it and tells everybody.”

This is the why Thrasher sees cross-functional teams that include security people as a big success criteria for DevSecOps.

“I usually say the first thing should be if your teams aren’t cross-functional, start with that. You don’t have to change anyone’s boss, you don’t have to change anything else about who you report to, but make sure your teams represent all of the skills you need to deliver,” she said.

Not only will the teams be able to deliver on all of the necessary skills when they’re working as a unit, there’s also an ancillary benefit: In the process, they’ll be training each other, and each team member will end up gaining a more diverse set of skills—and perhaps become renaissance men and women in the process.

“They might have been a graduate of a cyberprogram and they’re next to a graduate of a CIS-type program and they’re next to a math major and they’re next to a hardware engineer, and they’re all kind of new because they’re recent graduates, but they’re learning with each other and we’re going to train them with some more senior engineers that we self-select to be good mentors,” she said. “This is how you are giving people the skills to work with this next-generation of automation and technology, both in the security realm and the Ops realm and the Dev realm.”

— Ericka Chickowski

April 27, 2018
DevOps Connect: DevSecOps Days @ RSAC Call For Speakers Is Open
For the 4th year devopsy.kinsta.cloud is proud to be producing DevOps Connect: DevSecOps Days @ RSA Conference. The event will be on Monday, April 16th, 2018. RSAC is the world’s largest security conference and so the perfect place to hold what we think of as the best day of DevSecOps. You can get full details at the DevOpsConnect.com site. The call for speakers is open now through December 15th.

Why Speak at DevOps Connect: DevSecOps Days @ RSAC

If you have a great DevSecOps story to tell, this is the conference to do it at. Last year we had almost 1000 people stop in during the full day of sessions to catch some of the top speakers in the space, as well as many up and coming thought leaders giving us a fresh look at the latest trends in DevOps and security. This year we expect over 1200 people or more to attend the sessions. Sessions are also video taped and then put up on DevOpsTV for later viewing.

It is a large stage that gives our speakers a great pulpit to share their expertise and experiences. The fact that it takes place on the backdrop of the largest security show in the world means the spotlight is even brighter.

More importantly, this is your chance to lead. Your chance to give back to the community as we forge a road ahead towards better, faster more secure applications. Unlike some other conferences, there is a strong preference here for speakers to be practitioners in the space rather than vendors selling to it (though not all vendors are bad, they speak with more practitioners than anyone and do add to the body of knowledge). So there is a strict, no vendor pitches policy.

What Are We Looking For?

In fact here are some of the guidelines we are looking for:

We are looking for practitioners to discuss the unique challenges of adopting security into the DevOps pipeline, the obstacles to security being a contributing and valued partner in DevOps and the ways to overcome them. Specific topics we are looking for include, but are not restricted to:
- How did you get senior management buy-in? What did you do? How did you quantify the business value?
- Examples of security teams being integrated into the CI/CD or DevOps process
- How did you overcome objections inside the organization?
- How did you design and implement effective controls to mitigate security risks?
- Which business area (and application) did you start with, why, and what did you do?
- What were the top challenges, and how did you overcome them?
- What were your top mistakes, and what advice would you give as a result?
- In-progress stories (and even nightmares) are welcome!
Also, beyond the practitioner preference, we are looking for a diverse set of speakers that closely matches the real world. There will be something approaching 50,000 people attending RSA Conference this year. We want DevSecOps Days to reflect that diversity.

All speakers receive passes to DevSecOps and an expo pass to RSAC itself.

How You Can Attend DevOps Connect: DevSecOps Days @RSAC

If you aren’t ready to share your DevSecOps story with the world quite yet, you can still participate and attend DevSecOps Days @RSAC. All you need is any kind of pass for RSAC. If you are not speaking and have not purchased a ticket yet, or would like a complimentary Expo Hall pass on us, please use these codes.
- $100 Discount off of Full Conference passes – 18UDEVOPSFD
- Complimentary Expo passes – 18UDEVOPSXP
The free expo pass is enough to get you into DevSecOps Days and expo show floors all week, as well as the keynotes. The $100 discount is off a full conference pass good for all sessions.You can register using the codes above at: https://www.rsaconference.com/events/us18/register

Wait, there’s more

Following the day sessions, the 5th annual No Wine-ing DevSecOps Cocktail party will take place @ Jillians, San Francisco, 4:30pm till 6pm, down the block from the Marquis. Registration for the No Wine-ing event is required and attendance is free. Register here.

The Security @ the Speed of DevOps panel and luncheon, featuring an all star lineup of DevSecOps experts will take place on Tuesday, April 17th, 11:45am, again @ Jillians. The panel will be based on the 2nd annual Security @ the Speed of DevOps reports by George Hulme. Once again admission and lunch are free, but registration is required. Printed copies of the report will be available to attendees.

So if you would like to tell your DevSecOps story to the world, please apply to speak at DevOps Connect: DevSecOps Days @ RSAC. But whether you do or do not, if you are going to be in San Francisco on April 16th, please join us for what should be another great day of DevSecOps learning, networking and growing at RSA Conference.

Also many thanks to our sponsors, Sonatype, White Hat Security, Aqua Security, CA Veracode, Checkmarx. If you are interested in sponsoring, write sponsor@devops.com

— Alan Shimel
November 10, 2017
John Willis, Jez Humble & Josh Corman Headline DevOps Connect: Rugged DevOps at RSA

A week from today, February 29th, we gather in San Fransisco for DevOps Connect: Rugged DevOps @ RSA Conference at the Moscone Center. This is the 2nd year we are holding this conference and the line up is I think even stronger than last year! I am really happy and proud of the group that Mark Miller and Josh Corman have put together.

Best of all, if you are in San Fransisco we have free RSA passes that will allow you to join us all day at the conference and can also get you into the Expo all week if you like. Check out the website for full details. If you don’t want to get all the details just register for a free ticket, go here and use code 1U6DEVXPO for a free expo pass which will get you into our event on Monday.

In the meantime, here are some of my very best picks for the day:

Josh Corman & John Willis kicking things off with, Guns , Germs and Steel of the Software Age

Jez Humble & Nicole Forsgren presenting, What We Learned from Three Years Sciencing the Crap Out of Devops

Rich Mogull of Securosis on, Architectures, Design Patterns, and Coding for Rugged DevOps at Scale

Dan Glass presents The R.O.A.D. to Rugged DevOps for a Major Airline

Amy DeMartine of Forrester on Seven Habits of Rugged DevOps

Shannon Lietz presents The Journey to DevSecOps

Justin Arbuckle of Chef will be speaking on Transformation by Compliance

and rounding out my top picks, two of the leaders of the Austin DevOps community:

Ernest Mueller and James Wickett presenting Lean Security: Add Business Value without Bringing Waste

Of course these are just some of my picks. I can honestly say that there isn’t a bad session in the whole day. I think looking back people will review this lineup and be amazed at the blending of the DevOps tribe and security tribe into one great day of learning and sharing.

Also did I mention the DevOps (no) Wining cocktail party afterwards?

So what are you waiting for? Click on over, register for your free RSA Expo pass and be sure to click off that you will be joining us on Monday. Seating is first come, first serve and people come and go through they day. If you are in San Fran, hope to see you Monday!

February 22, 2016
Live Blogging DevOps Connect @RSAC

We will be live blogging the DevOps Connect: SecDevOps event from RSA Conference on Monday, April 20th. Stay tuned for updates

April 18, 2015