devopsy.kinsta.cloud

Tag: security Compass

  • Security Compass Makes Visualizing AppSec Threats Simpler

    Security Compass Makes Visualizing AppSec Threats Simpler

    Security Compass this week updated its threat modeling platform for developers to make it easier to surface application security issues.

    The latest version of SD Elements 2022 adds support for developer-centric threat modeling diagrams, reusable components, more advanced reporting capabilities and 114 more just-in-time training (JITT) modules. In addition, Security Compass has now integrated its platform with the Black Duck software composition analysis (SCA) tool.

    Drew Koelemay, director of product management for Security Compass, said the goal is to make it easier for application development and cybersecurity teams to collaborate using a platform that visualizes cybersecurity threats within a DevOps workflow.

    That approach to application security is critical because it becomes easier for developers to understand how changes to applications improve the overall cybersecurity posture of complex app environments where there are lots of dependencies, he said.

    Once that visualization is achieved it then becomes possible to create reports highlighting the most prevalent threats and weaknesses across that portfolio, Koelemay noted.

    In the wake of a series of high-profile application breaches, organizations of all sizes are looking to better secure their software supply chains by implementing DevSecOps best practices. The issue that immediately arises is the cultural divide between application development teams and cybersecurity professionals. The Security Compass platform surfaces developer-centric visualizations of security issues to help bridge the historic divide that exists between those teams, said Koelemay.

    For the most part, cybersecurity professionals view development teams’ lack of cybersecurity expertise to be the root cause of many of the issues they encounter. It’s not that a developer deliberately sets out to build and deploy vulnerable applications. By the time the application is reviewed—often just a few days before it’s supposed to be deployed—it’s often too late to do much about most of the vulnerabilities that are discovered. Cybersecurity professionals and application development teams need to meaningfully engage each other much earlier in the application development life cycle.

    The simple truth is developers are not likely to reach out first simply because they don’t know what cybersecurity issues to look for in an application environment. Most of the time they are rushing to meet an application delivery deadline, which makes them perceive cybersecurity as a hurdle to overcome rather than an automated process integrated within their workflow. Cybersecurity professionals, therefore, need to find a way to more constructively engage developers. The onus is on cybersecurity teams to insert themselves at the front end of the application development process rather than waiting at the backend for an inevitable issue to arise.

    One way or another, application security is going to improve. The only thing yet to be determined is how painful the process will be. Tools that enable DevOps teams to see for themselves what issues are being encountered should go a long way toward reducing both the level of pain being experienced and the amount of time required to resolve the cybersecurity issue at hand.

  • Survey Shows DevSecOps Progress in Larger Organizations

    Survey Shows DevSecOps Progress in Larger Organizations

    A survey of 250 U.S. and UK large enterprises with more $1 billion in revenue conducted by Security Compass, a provider of a platform for automating security tasks as application are developed, finds three-quarters (75%) have implemented DevSecOps processes on current application development projects.

    Rohit Sethi, CEO, Security Compass, said the State of DevSecOps Report published today makes it clear more organizations are starting to embrace security by design as they develop their applications. Nearly three-quarters of respondents (73%) said their organizations follow a “by design” approach that enables them to proactively address cybersecurity and regulatory compliance.

    The primary reasons respondents cited for embracing DevSecOps best practices were to improve security, quality and/or resilience (54%), followed by the ability to bring applications to market faster (30%). One of the misconceptions about DevSecOps is that it slows down application development and deployment. However, Sethi said, in practice, DevSecOps enables organizations to address security and compliance issues that would otherwise result in an application not being promoted into a production environment. Almost three-quarters of respondents (73%) noted that manual security and compliance processes slow down code releases. A full 96% said their organization would benefit from the automation of security and compliance processes.

    The biggest DevSecOps obstacles cited by survey respondents included technical challenges (60%), followed by cost (40%), insufficient time (39%), lack of education (38%), lack of skills (36%) and organizational inertia (35%).

    In terms of deploying applications, the biggest reasons cited by the 51 C-suite executives that participated in the survey were insufficient automation and lack of tooling, at 51% each. Organizational barriers came in a close third (50%).

    In the longer term, Sethi said it’s clear most organizations are shifting toward zero-trust architectures to make their application environments more secure. However, achieving that goal across a broad application portfolio will require more investment in both automation and, eventually, various forms of artificial intelligence (AI), said Sethi.

    It’s not clear to what degree smaller organizations will have the tools and resources required to fund adoption of the automation platforms needed to advance DevSecOps more broadly. There’s more awareness of DevSecOps than ever. The challenge is the tools and processes required to achieve it are not uniformly being pushed into the hands of the individual developer. In some cases, organizational leaders are encouraging developers to embrace DevSecOps without any practical guidance.

    Eventually, of course, every organization will embrace DevSecOps best practices, but the real question is, at what rate? The number of applications organizations are rolling out continues to accelerate, but reliance on DevSecOps best practices to ensure security and compliance remains uneven, at best. Larger organizations that have the resources required to fund these initiatives tend to be further along in their adoption journey. However, there is no correlation between organizational size and the ability to build and deploy secure applications. After all, a smaller organization may make up for what they lack in resources with a greater commitment to DevSecOps best practices.

  • Security Compass Announces Jenkins Plugin for its Policy-to-Procedure Platform Bringing Application Risk Policy and Compliance to DevOps

    Agile Development Teams Empowered to Continuously Deliver Applications without Risk from the Start

    TORONTO, Oct. 03, 2018 (GLOBE NEWSWIRE) — Security Compass, a software security company that provides organizations with the knowledge, training, and technology to make software secure, announced today that its leading policy-to-procedure platform, SD Elements, now features a Jenkins plugin which empowers agile development teams to build application risk management and compliance into the DevOps process. The new plugin informs the continuous integration/continuous delivery (CI/CD) pipeline with essential security and compliance guard rails in an automated environment, ensuring applications built using SD Elements fail to deploy if they don’t comply with risk policies.

    As application development teams are moving faster than ever to build applications and to embrace agile methodologies in DevOps environments, important security and compliance measures are being skipped. SD Elements is the only solution on the market that translates complex compliance requirements into something engineers and developers can actually use. It helps organizations go from policy to procedure in a highly automated fashion, without slowing down the development process or the continuous delivery of critical applications.

    Security Compass introduced risk dashboards and risk policy management functionality to the SD Elements platform in April 2018. The risk dashboards provide a quick and easy way for managers to view each application’s compliance with the assigned risk policy and to generate a report that clearly identifies any gaps. The risk compliance status feeds into Jenkins by way of the plugin to inform the CI/CD scripts. Fast-moving DevOps teams can then easily identify and address compliance problems in applications early on, and across business units, saving considerable time and resources.

    “To date, large organizations have relied on automated scanning to address risk in a DevOps environment which often results in the accidental deployment of applications with unmitigated risk and only captures 40 percent of an application’s potential risk,” said Ehsan Foroughi, VP of Product at Security Compass. “The SD Elements’ Jenkins plugin enables DevOps teams to move from highly manual security and risk-phase gates, to a more automated and accurate approach that doesn’t slow down development.”

    To learn more about the new Jenkins plug-in and risk dashboards, visit Security Compass at booth (#P8) at the AppSec USA Conference, Oct. 8-12 in San Jose, Calif.  More information can be found on the Jenkins community plugin page here. Beta versions of similar plugins are available for XebiaLabs XL Release and Microsoft Azure Pipelines (contact Security Compass).

    About Security Compass
    Security Compass is a leader in helping organizations proactively manage cybersecurity risk in their mission-critical software without slowing down business. Through its tailored DevSecOps solutions, its award-winning policy-to-procedure platform, SD Elements, and its verification services, which include penetration testing, threat modeling and red teaming, Security Compass helps organizations efficiently deliver software that’s secure by design. The company serves some of the world’s largest enterprises, including 16 of the largest financial institutions in North America, South America, and Asia, as well as four of the largest tech companies in the world. Security Compass is privately held and headquartered in Toronto, Canada with global offices in the United States and India. Follow Security Compass on Twitter @securitycompass or visit https://www.securitycompass.com/

    Media Contact:
    April H. Burghardt
    PR Consultant for Security Compass
    april@gabdata.com
    646-246-0484