devopsy.kinsta.cloud

Tag: security

  • DevOps Chats: Shadow Code Security with PerimeterX

    DevOps Chats: Shadow Code Security with PerimeterX

    When the cloud first caught on, there was a problem with Shadow IT—developers spinning up instances in AWS without the IT team knowing they existed. Now with the ease of CI/DC automated deployments, the problem of Shadow Code—code being added to apps that did not go through the entire team process—has arisen.

    In this DevOps Chats we speak with Elad Koren, VP of product at PerimeterX, about the Shadow Code issue and how his company can help.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel, and you’re listening to DevOps Chats. Today’s DevOps Chats features Elad Koren, who is VP of product at PerimeterX, and Elad, welcome to DevOps Chats.

    Elad Koren: Thanks, Alan. It’s an honor being here. Happy to join you.

    Shimel: I appreciate you being here, and it’s our honor to have you. So, Elad, we’ve never—I don’t believe so—we’ve never interviewed or covered PerimeterX before on Security Boulevard or DevOps. And why don’t we start with, why don’t you give our audience a little background—what’s PerimeterX about?

    Koren: Cool. I believe you’re right. PerimeterX has been around for a bit more than five years, and its main goal is to secure businesses, digital businesses across the web. It can be e-commerce, SaaS, and other online businesses, essentially providing solutions to the online digital challenges they have.

    We started with our Bot Defender solution about four years ago, and this targets the bot problem around the web. I’m sure you’re well aware of it, being the security professional you are. About a year ago, we’ve also launched our Code Defender product, which looks at the client-side code and highlights vulnerabilities and issues around that. And we will, of course, develop some more in the future as part of our growth plans to continue in securing digital businesses around the world.

    Shimel: Excellent. So, we’re gonna dive into that in just a second, but Elad, I also always like to ask people about their own personal journey. How did you come to be VP of Products at PerimeterX?

    Koren: Wow. [Laughter] It was a long journey. I’m actually, I’ve actually been in security for more than 15 years. I started with the Israeli Intelligence and the IDF. Then moved to my startup where I took all the security and kind of compliance and fraud areas. From there, I moved on to RSA Security, so you’re probably familiar with RSA Security, now part of Dell. And after a short period in Payoneer as their Head of Compliance and Security, I found myself in PerimeterX, leading the product group and now the VP of Product. I’m very proud of what we do with really, a sense of accomplishment with what we’ve been doing so far.

    Shimel: Excellent. Well, RSA Security was spun out of Dell now, right? Didn’t they do a PE deal a couple months ago, I thought?

    Koren: Yeah, yeah, they had a discussion around that. It was actually interesting because RSA was one of the biggest assets EMC had before Dell acquired them. And once Dell stepped in, I think RSA wasn’t that interesting for them, so it was only a matter of time.

    Shimel: Yeah, no, Dell seems to have a love/hate relationship with the security companies they acquire, but that’s for another podcast. Let’s stick to PerimeterX. [Laughter]

    So, client-side code inspections and security—talk to us a little bit about what you’re doing there and then I wanna jump into this concept of shadow code that we spoke about off-mic.

    Koren: Yeah. So, first of all, very important to understand, you know, the first question that comes to mind is, why are we talking about it on devopsy.kinsta.cloud. So, one of PerimeterX’s top targets is to assist DevOps teams to do their job better. And the fact of the matter is that, after we’ve had our bot mitigation solution for quite a while and DevOps was one of our personas, we went out and asked our customers, what’s their next major problem.

    And one of the things that came up for many, many customers was the fact that they have a challenge around their client side, okay? Developers are adding libraries—well, you know, it’s a common practice. However, some of these libraries, JavaScript or others, they’re not that secure, and they’re not that trustworthy. What we did at that point is kind of think of that problem and what it reminded of. And it kind of reminded us of the problem of the shadow IT that we’ve seen about 10 years ago or so, where employees would just come with their devices or do whatever they want with their bring your own device kind of concept, and companies started fighting that. But at the end of the day, they understood that they have no weight.

    It’s kind of similar with code. Developers will find the best weight to add code, even if it’s a library that they can just take and adjust slightly, and even if it’s a GitHub repository that no one maintains, and these introduce significant risk.

    Shimel: Yeah. Absolutely. You know, it’s interesting, I think no one in DevOps questions anymore when we talk about adding security to the mix. I mean, thank God. You know, a little bit of my own personal journey, right? The reason I got into DevOps is because I thought it was the greatest thing for security. I thought this, the way it came down that this whole DevSecOps movement and shifting left and making developers more aware of security—I envisioned that when I first found out about DevOps. And I was hoping it would give us another chance to do it right, to correct some of the mistakes that were kind of inherent in our whole model.

    And I’m not saying it’s a panacea or it’s perfect now, but certainly, we can acknowledge that developers do care about—no one wants to develop insecure or crappy code. People have pride in what code they develop. Now, when they didn’t know—the more they know about security and the more tools we can give them that allow them to kind of do better, develop more secure code, the better off we are, I think.

    But this issue of, as you’re calling it, shadow code, right, kinda growing ________ with shadow IT when the cloud first came.

    Koren: Yeah.

    Shimel: It’s a problem. And the thing about it is, again, developers don’t raise their hand and say, “I wanna sneak around. I wanna sneak a little code in the back door.”

    Koren: Exactly.

    Shimel: Right? They do it because they have time constraints, they wanna get it done, they want it to work faster, right?

    Koren: They’re exactly the reasons that we’ve understood when we looked into it.

    Shimel: Yeah.

    Koren: And it makes sense. If you think about it, developers should be able to add whatever it is that they think can help them develop faster. I mean, it’s the business goal.

    Shimel: Mm-hmm.

    Koren: The main question that we asked is—well, how can you make it more streamlined, okay? How can you—and now, going one step backwards or sideways, there’s a disconnect, okay? The developers, as you said, they wanna make it a secure code, but the business owner or the person who manages the security posture of the application doesn’t necessarily know that somebody introduced a new vulnerability, because the developer thinks that this repository is safe. I mean, it should be, it’s in GitHub. [Laughter]

    Shimel: Oh, no—agreed.

    Koren: So, the thing is—and this is where we asked around, our customers, what are they doing to mitigate this type of risk and what are they finding out. And what we found out is, interestingly enough, you have a lot of performance monitoring tools, but you have zero security monitoring tools on client side in real time. You have static code analysis, you have a lot of other solutions trying to find the vulnerability before it goes out to production. But once it’s out there, nobody monitors.

    And you have to keep in mind—I know you are keeping in mind, but our listeners—the fact that, well, when in run time, you can inject dynamic code, that changes. And if somebody else gets control over it, this is a problem.

    Shimel: Yeah, yeah. Well, and there’s a couple, I think, other complicating factors, Elad, that I’d like you to address. And that is, you know, today, where does that client side code live? Is it in the container somewhere with the whole Kubernetes microservices mesh thing goin’ on?

    Koren: Mm-hmm.

    Shimel: Is it in the traditional hypervisor kind of environment, or maybe something like that or is it on bare metal and serverless or—you know, it’s a great time to be a developer, but it’s a very hard time to be a security person who’s trying to keep guardrails there for these people to do it as safely as possible, as securely as possible. How do you do that?

    Koren: This is correct. You’re spot on. You’d expect that when a new code is introduced, the company or the developers would adopt it and manage it or maintain on their servers or on their microservers or their mesh. However, because they want to keep it updated, because they want to keep it as capable as possible, they sometimes take the dynamic library from their repository and, whenever there’s a CI/CD process going on, it pulls the library from there.

    And that is where the shadow code becomes a problem. Because, unless you have the right processes around, how to make sure that this library is safe? How to make sure that this is, you’re not introducing anything malicious—and we have seen it happening in the past—this is where you have to address the problem. And you know, I can share some of the things that we’ve seen when we had the validation of the product before we launched it. We had a design partner, and they asked for something like this because their developers asked for the security team to allow them visibility into what’s happening on the client side. And we’ve actually—and it’s a big customer. I don’t want to name names, naturally, here, but—and you will share my surprise—when we found out, when we run on their client side that a very, very big vendor of there is using a jQuery from a non-trustworthy source.

    Now, you’d expect something like this would never happen for a well-established company, but it does. And it’s surprising, but it does. And they weren’t the only ones.

    Shimel: Hmm. Interesting. So, let’s now talk—so, I think we’ve defined the issue and the problem, right? How is PerimeterX helping this?

    Koren: So, our approach when looking at this issue or this problem, naturally, we are a Dev first company. So, we came and asked the developers that we were working with—the DevOps, DevSecOps, and some of the risk analysts, some of the personas—what would be most beneficial. And what they said, and this is how, you know, I’m the VP of Products. I’m a Product Manager at heart. And customer input is the number one thing that I’m looking into when I’m building the products.

    They said very clearly, if they can see, before moving from staging to dev to prod, what the code itself, when it’s pulled dynamically, is doing and have the visibility of what’s happening there in real-time on users—this is something that they don’t have today. Because that will introduce that level of visibility whenever something bad happens.

    I don’t know if you’ve seen some of the Magecart attacks that have happened from third-party libraries. Again, don’t wanna name names, but if somebody looks online, they can find out. When we come in and we analyze in real-time on the client side, on every user going into the website, what the scripts are doing there, whether they send information to a bad domain, whether they try to take the information and store it in a cookie and then use it later on—we can quickly highlight the main risks and main problems and vulnerabilities, like I mentioned earlier with jQuery, so that the DevOps or DevSecOps can quickly raise a flag and say to the developer, “Listen, this script you’ve added introduces new vulnerability.” You can’t see that in the static code analysis, but you will see that on run time on the client side. And that is something revolutionary. We don’t have that today in anyone else’s solution out there.

    Shimel: Hmm. Interesting. What—so, I always ask, and you’re the perfect person, VP of Product—now you’ve got a conundrum. You’ve got a really great security product here that’s gonna help developers with secure code. How do you—how do you sell it? How do you bring it into the organization? Do you talk to the security guy and say, “Hey, go talk to your developer team and tell them to use this?” Do you talk to your developers and say, “Tell your security team you wanna do this?” Do you gotta talk to the security team and the developer team? Whose budget does this come out of? Who ultimately is responsible for setting the policies and processes?

    Koren: And this is—

    Shimel: Is the solution hard to sell, maybe, though?

    Koren: You’re correct. So, theoretically, it’s hard to sell. However, the main key here or the key differentiator is the fact that when we went in to look how we wanna sell this solution, before we even built it, we established the fact that it should fit into their processes. If it’s not fitting into their processes, if they have to start defining things like content security policy, if they have to start maintaining this on a day to day basis, it’s not going to work.

    Solutions for DevOps or DevSecOps today are one, two, three. You have to have it in and you have to do it quickly and you have to have minimum manual effort, unless you definitely prove why it’s needed. And so, this is why we’ve added the fact that nobody needs to do the baselining on their own, we are doing that automatically with machine learning capabilities, what every script does, whether it’s ________ or not, and the fact that they can just have a small snippet on their client side and we’ll analyze whatever and flag in our portal or alerting system that they have, it actually fits into their CI/CD process, it fits into their day-to-day process. They can even have it as part of their regular security processes and have it fit into their SIM.

    And this is where it really makes the difference, because you don’t have to do anything manually and you solve a problem and you fit into their processes, and security people are very happy about it. I can tell you that one of the customers that actually already bought this product was very happy with the fact that they have visibility to this area and they don’t have to maintain it on their own, because we are doing that, the product does that out of the box. So, this was a key component in our product.

    Shimel: Huh. Excellent. Excellent, excellent. So—I told you, the time goes very fast. [Laughter]

    Koren: [Laughter]

    Shimel: We’re coming up on time, here. For people who are interested—let’s use our time wisely—how could they find out more information? What path do you suggest for them?

    Koren: So, first of all, they can go out to our website and check out our solutions, both for bot mitigation as well as the Code Defender and other solutions that we have. I think reaching out to our team if you have any questions, if you have any concerns around the client side, I can tell you that even companies that thought everything’s fine were completely oblivious to threats and concerns around the client side that are out there and many people are not aware of. You can also reach out to me directly via LinkedIn or what have you and we can discuss.

    I think in general, for DevOps and DevSecOps to be more aware of the dynamic nature of the code that is added to the client side and what to do. We actually have a blog post listing the things that are best to do if you want to make sure that it’s secure and you’re on top of things. So, it’s a good read as well. And that’s about it. So, we are here. We’re ready to help.

    Shimel: Cool. Last question, just because you have to ask it because it’s out there—with everything going on in the world with the COVID and everything else, how is it affecting you guys and what are you seeing?

    Koren: It’s actually amazing. We’ve seen some trends around the e-commerce landscape that we’ve actually had some blog posts on. And I think, you know, one of the things that kind of symbolizes these times, a few of the e-commerce sites that we are working with said that the traffic they experienced outgrows the Black Friday/Cyber Monday level of traffic.

    I think it symbolizes kind of the boom of online life that we have. I’m sure you’re experiencing it as well. And I think the shift there is not going to go back to the previous levels. It’s definitely going to go down, but we are seeing so many trends, very interesting trends, and we are naturally adjusting what we are doing, but luckily and happily, we’re doing great these times and it’s—we’re very happy with what we have now.

    Shimel: Well, I will tell you, for whatever reason, you know, and it may not all be good, because there is this whole, with the virus pandemic there’s a cyber pandemic of people trying to exploit. I mean, so, for instance, even here MediaOps where DevOps and Security Boulevard, our security site, used to be pretty even in terms of how many visitors—they both get 350 to 400,000 visitors, unique visitors.

    Koren: Mm-hmm.

    Shimel: All of a sudden, you know, Security Boulevard now this month is gonna be at 600,000.

    Koren: Wow.

    Shimel: Last month was 530,000. So, in the last two months since this COVID thing, you know, we’ve seen traffic on the Boulevard site—DevOps has stayed relatively steady. It hasn’t gone up, necessarily, it hasn’t gone down.

    Koren: You know, one thing we’ve noticed, and I think it can also explain, I think it’s wider than that—attacks and in general fraud and security challenges became much more complicated, because the adversaries are out there and they are targeting a whole lot of other new sites that previously didn’t experience. We are seeing much higher levels of complexity in the attacks that we’ve previously seen on giants, now on even medium small—small- to medium-sized sites.

    Shimel: Agreed. Crazy. Just crazy, right?

    Koren: Yeah, indeed.

    Shimel: You know, because that’s what you need when you have a virus pandemic, we need to have more cybercrime and that stuff to worry about.

    Koren: Yeah. [Laughter]

    Shimel: So, Elad, I want to thank you for joining us today on DevOps Chats. It’s been a pleasure.

    Koren: Thanks, Alan.

    Shimel: Be back on soon. Elad Koren from PerimeterX here on DevOps Chats, this is Alan Shimel and you’ve just listened to another DevOps Chats.

  • Survey Surfaces Root Causes of DevSecOps Tension

    Survey Surfaces Root Causes of DevSecOps Tension

    Results of a survey published by SaltStack, a provider of IT automation tools, suggests tensions between cybersecurity and IT professionals on the one side and DevOps teams on the other are running high. According to the survey of 130 cybersecurity and IT leaders, 70% of respondents said their organization is sacrificing data security for faster innovation, with most cybersecurity and IT managers making a case for prioritizing data protection over innovation, speed to market and cost.

    Alex Peay, senior vice president for product at SaltStack, said that while it’s unlikely cybersecurity and IT leaders will be able to slow down the pace of innovation within their organizations, the survey results make it clear IT organizations are struggling to keep pace.

    On the plus side, the results also show that cybersecurity and IT operations teams are working more closely together. More than half—54%—of cybersecurity leaders said they communicate effectively with IT professionals, while 45% of IT professionals concurred.

    Best DevSecOps processes are, of course, meant to bridge the divide between DevOps teams and the rest of the IT organization. The expectation is that by pushing more responsibility for cybersecurity to the left, the pressure on cybersecurity and IT teams would be reduced. However, DevSecOps adoption remains nascent at best—many DevOps teams still don’t have the tools required to implement security controls programmatically within their applications.

    Even when they do have the tools needed to add security controls, organizations need to set up workflows that will enable cybersecurity teams to verify that those controls have been properly implemented. Given the chronic shortage of cybersecurity expertise, the rate at which applications are being deployed and updated easily overwhelms the amount of time cybersecurity teams have available to analyze modules of code that are now often updated several times a week. Most cybersecurity teams are already struggling to keep pace with patches for existing applications, let alone any new application modules.

    Of course, there’s not a lot of love lost between developers and cybersecurity teams. DevOps teams generally blame cybersecurity teams for slowing down the rate at which applications are deployed. In fact, one of the primary reasons DevSecOps is gaining traction among developers is that it represents a way to remove cybersecurity professionals from the application development process.

    Cybersecurity professionals, conversely, often view application developers as the root cause of the cybersecurity problem. Too many developers are reusing modules of code without first making sure those modules have been updated to address a known vulnerability. To add insult to injury, whenever a new vulnerability is discovered days, weeks or even months may go by before developers address it. To be fair, however, cybersecurity professionals are not especially adept at prioritizing vulnerabilities; as far as developers are concerned, the list of vulnerabilities presented is just one in a series of bugs that need to be addressed. Unless otherwise directed, developers will focus on bugs that impact features and performance before a potential security issue that has yet to manifest itself as an issue impacting end users.

    In general, advances in DevSecOps are being made that should provide some much-needed relief to IT and cybersecurity professionals. It’s just slowing down the rate at which applications are deployed and updated might not be one of them.

  • WordPress Hacks: Best Ways to Protect WordPress from Hacking

    WordPress Hacks: Best Ways to Protect WordPress from Hacking

    When it comes to website security, even an iota of prevention is really worth a large pool of measures to restore a website from its affected state. WordPress websites are most vulnerable to security attacks from sophisticated hackers as well as the bots that are capable of exploiting security vulnerabilities. These security vulnerabilities range from weak passwords, outdated themes and plugins, and poor-quality web hosting.

    But, there are several time-tested measures that can prevent such security compromises and risks and keep a website performing and secure. 

    Make Use of Strong Passwords

    Weak passwords often cause security risks for websites. You can prevent such risks by using strong passwords and for this, you can use tracking tools such as 1Password that can track all the passwords and prevent you from using the same password on all your internet accounts. The tool also prevents you from using easy and easily rememberable passwords. Thanks to the tool you can only use unmemorable, long, difficult passwords.

    Using this tool you can easily test the strength of the existing passwords and can create passwords that are long, complex and not easy to guess. The tool helps you maintain all your web accounts with strong passwords. 

    Updating WordPress Core, Themes and Plugins

    Most updates of the WordPress core, or the themes and plugins, come to mitigate the security loopholes and risks. This is why making updates once a month is far from enough. Whenever a vulnerability will surface, your non-updated website can be the first victim of the security risk. This is why one must update as soon as there is an available update. For all the plugins that don’t come with important features and functions, one can use a Shield WordPress Security plugin to auto-update. 

    Insist on WordPress Hardening 

    There are several WordPress hardening methods that can easily prevent hacking from taking place. Let’s have a quick look at these hardening methods.

    • Add extra allow/deny rules through your .htaccess file.
    • Keep login URLs restricted to specific IP range(s).
    • Safeguard your wp-config file.
    • Prevent image hotlinking and mobile directory browsing.
    • Do not use public WiFi or VPN to log in to the website.
    • Remove unused WordPress plugins and files.
    • Keep the server clean.

    Prevent a WordPress Hack with a Website Firewall

    A vast majority of WordPress websites are frequently hacked as they are more vulnerable to security risks than other CMS platforms. A common issue that security experts stumble upon often is that WordPress version update is often not possible, thanks to the incapabilities of plugins or themes. This is when a WordPress website can easily become vulnerable to hacks.

    For such cases, enabling a WordPress firewall is strongly recommended to provide security patches for your website. A Web Application Firewall (WAF), when enabled, can take on such security risks. A WAF basically works like a pass for your website visitor traffic, and effectively filters out bad requests comprising hack attempts, exploits, DoS attacks and many more.

    A WordPress firewall does the following things to strengthen WordPress security:

    • Prevents all future hacking attempts by detecting and thwarting all hacking methods and behaviors, thus keeping your WordPress website protected against malicious attacks. 
    • The firewall provides a virtual security update for your WordPress website software, even when the website doesn’t have any new security updates.
    • A WordPress firewall also blocks brute force attacks or any unwanted visitors from accessing the wp-admin or wp-login page and makes use of brute force automation to detect your password.
    • It deals with Distributed Denial of Service (DDoS) attacks that basically try to overload a web server or the resources of an application with too many requests. By blocking DDoS attacks, a WAF ensures constant accessibility and performance of a WordPress website in all circumstances. 
    • A WordPress firewall helps boost WordPress performance by storing website caches and keeping bounce rate lower. This also ensures optimum website engagement, business conversions and steady search engine ranking. 
    • The cloud-based WordPress firewall solutions, besides preventing attacks, also boost WordPress website speed by using a Content Delivery Network (CDN). 

    Make Sure You Have an SSL Certificate Installed

    This is a basic and very important security measure for most websites. It safeguards data by encrypting the data you and users use and transfer via a website. For example, when one submits a contact form or uses login in web pages, the data that is transferred remains encrypted. With SSL installed on a website, secure login can be ensured even while traveling. While some hosts and hosting plans provide this for free, with some you need to use a separate SSL plugin for the purpose. 

    Avail Better Web Hosting

    Choosing good hosting companies can also be crucial for your WordPress security. Some hosting service providers such as WP Engine, Kinsta, Site Ground and a few others are great for WordPress security. These service providers take care of routine security scans and provide cleaning of hacked websites for free. Apart from performance, one should also consider security aspects for website hosting. 

    Taking Backup of Your Site

    Though taking regular backups may not always be effective for preventing a WordPress hack, they can sometimes play a great role in disaster recovery. It is particularly useful in preventing a website database from damages due to malicious attacks. 

    Continuous Website Monitoring

    Finally, continuous monitoring of websites can help greatly in tracking and mitigating security risks of all types. Setting Google Search Console alert is important concerning all issues on your website. Apart from that, you should monitor the error logs on your website through the cPanel File Manager or FTP (SFTP). You should also see the Raw Access Logs on the server to keep track of the users accessing website files on the site. You should also use a plugin called Shield WordPress Security plugin and use its Audit Trail feature to keep track of all the file changes and website accessibility issues. 

    Conclusion

    All the above-mentioned ways are time tested as successful to prevent security attacks and keep security vulnerabilities at check. These measures, besides a meticulous choice of plugins and themes, can help a WordPress website perform well and remain secure.

  • Despite Downturn, Enterprise IT Budgets Remain Intact

    Despite Downturn, Enterprise IT Budgets Remain Intact

    A survey of 137 IT operations leaders at companies in the U.S with at least 500 employees and an annual IT budget in excess of $5 million finds a surprising amount of resiliency at the beginning of the COVID-19 pandemic.

    Conducted April 1 by OpsRamp, a provider of IT operations tools, the survey finds more than half of the survey respondents (58%) said they expect to either significantly or moderately increase their annual technology budgets, while 38% plan to either significantly or moderately reduce their technology spending.

    The survey also finds 73% of respondents expect to either accelerate or maintain digital transformation initiatives and projects.

    Bhanu Singh, senior vice president of engineering and DevOps for OpsRamp, said that at least for now among larger enterprises, digital business initiatives are being accelerated as organizations recraft their business continuity plans. With most customers and employees working from home, the need for applications that digitize business processes has become more critical, especially since no one knows for sure when the COVID-19 pandemic might subside or whether there will be another one, he said.

    Many of those projects will rely on cloud-native technologies that make it easier for organizations to scale IT resources up and down, added Singh, noting organizations are quickly discovering that monolithic applications even when they are deployed on a public cloud are not as flexible as they now require.

    Specifically, the survey finds IT leaders are investing heavily in AIOps (69%), information security and compliance (62%), self-service platforms (60%), cloud-native observability (51%), network performance monitoring and diagnostics (51%), big data analytics (46%) and cloud infrastructure (45%).

    IT leaders are also planning to drive technology vendor consolidation (59%) to reduce costs and rely more on third-party managed service providers (58%).

    In terms of hiring, IT financial analysts (68%), cloud architects (53%), DevOps engineers (50%) and data scientists (47%) top the list of priorities.

    Of course, as the impact of the COVID-19 pandemic on the global economy becomes more apparent it is too early to say what the impact on IT budgets will be. Industry analysts Gartner and International Data Corp. (IDC) are forecasting a relatively small decline in IT spending of about 5% for the year once the economy begins to recover in the second half. However, it’s clear that certain vertical industry segments, such as travel and hospitality, might have a much longer way to go than, say, healthcare companies.

    In addition, it’s likely that much smaller companies than those surveyed by OpsRamp may find it more challenging to restart operations after being forced to lay most of their employees in some cases.

    Whatever the timing, the one probable thing is many of the IT trends that were just beginning to gain traction are likely to see accelerated adoption once the economy recovers. There will be a natural tendency to limit the adoption of new platforms and processes in the short term. However, now that it’s clear existing platforms and processes are not especially flexible it’s only a matter of time now before most of them one way or will be replaced or at the very least completely modernized.

  • Keys to the Kingdom: Protect Your Server from Hackers

    Keys to the Kingdom: Protect Your Server from Hackers

    Automation and DevOps undeniably improve the agility and responsiveness of IT. Most of us have taken up at least a bit of the wave of automation that DevOps and Agile have brought to our door, and many are far along on their DevOps journey.

    But every once in a while, we need to look back and lend a hand to those still coming. The fact of the matter is that sometimes we forget to warn those who are new to massive automation about some serious issues.

    It is intuitively obvious, if you think about security at all, that putting together a command and control server—we’ll use Ansible in this blog, but any tool that can roll out applications to a collection of servers—creates a big screaming target for any hacker that gets into your infrastructure. You cannot assume that will never happen, so organizations need to think about protective systems/architectures early, or spend more time patching things up. Remember, the more you build, the more weight there is to making major changes.

    For starters, severely limit access to the command and control machine. It belongs on a management subnet/VLAN with only a few access points. The servers it is managing absolutely should not have access back to the command and control server. If they do, any one of them getting controlled will provide a pathway to all of them getting controlled.

    Next up, early on there were quite a few debates/discussions about which user accounts should be able to run command and control scripts (Playbooks in Ansible). Eventually, the bulk of the community settled on each individual running them, not a single generic user with a name like “ansibledeploy.” Some still use a central user, but the majority wants the ability to track down the leak that individuals running commands allow—searching for strange/uncommon command execution in logs will cough up which account got compromised and allow for rapid response—which outweighs centralization.

    Third, learn and use the security features available in your application. Ansible offers Ansible Vault to allow encryption of playbooks. Since many playbooks require root access, encryption allows those playbooks to hide root access. Use of Ansible Vault has grown over time, and there are excellent tutorials out there to help use it to lock down command and control. Your product will have a similar tool, because putting root passwords in plain text, all over the disk, is just not acceptable.

    In the Ansible Galaxy/Github repositories, you can find excellent roles to help in your quest to lock things down. Geerlingguy is one of the most popular, and his Ansible Role – Security is excellent if you follow the caveats he provides in the readme.

    This is simply an advisory, not a step-by-step solution set. Overall, just remember that putting together a command and control server makes a tempting target. And like Geerlingguy points out in his readme, your security is your concern.

    Look at where the server can be accessed from, who can access it, where sensitive data bits such as passwords are stored—hint: plain text passwords in files went out of fashion when mainframes were hooked up to LANs—and how to protect all of the above. It’s been done, there are plenty of resources to help in your given environment. Take the time to look them up and implement relevant suggestions.

    After all, I won’t get a call in the dead of night if your servers are all taken over, you will. Do everything you can to avoid getting that call. And keep rocking. Everyone remote working has made many organizations more susceptible to all forms of attack, don’t let your guard down.

  • ClickShare Vulnerabilities May Have Been Patched, But They Mask a Much Bigger Problem

    ClickShare Vulnerabilities May Have Been Patched, But They Mask a Much Bigger Problem

    I think we can all recall a time in recent memory where, in a meeting or at a conference, someone has had issues with presentation technology. It happens so often that there is almost an expectation of a clunky experience, at least initially. It stands as no surprise, then, that ClickShare’s seamless app was immediately popular with end-users. For them, there is nothing easier than using a ClickShare application to push a presentation from their laptop, tablet or smartphone over to a big screen or conference room projector.

    Belgian-based digital projection and imaging technology supplier Barco designed their automation platform to work that way, and big business embraced the concept. FutureSource Consulting puts Barco’s market share in conference technology at 29%, with integration into 40% of all Fortune 1,000 companies.

    When researchers from F-Secure revealed in December that the seemingly innocuous automation platform was riddled with security vulnerabilities, it sent shockwaves through the business community. The uncovered security flaws are critical in nature, and could potentially enable any number of malicious activities. 

    Researchers demonstrated how the vulnerabilities could allow remote users to snoop active presentations, create backdoors into secure networks or even configure a spyware distribution server that would infect every user connecting to a Barco device. Suddenly, companies were faced with the prospect of having serious security problems installed directly inside conference rooms and offices throughout their organization. And because of the nature of the vulnerabilities, a single compromised device could support a network-wide breach.

    “An attacker who successfully compromised one unit gains the ability to decrypt as well as produce valid encrypted images for any unit, whether within one family or across families,” wrote F-Secure officials in their report. “Further, such an attacker may gain access to sensitive data at rest such as the configured WiFi PSK and certificates.”

    To its credit, Barco has been extremely proactive in issuing patches and fixes to the vulnerabilities found within its products. Security vendor Tenable recently released a report showing 15 vulnerabilities across eight presentation tools, including Barco. As of February, only Barco has been active in deploying fixes.

    Although some of the Barco vulnerabilities require hardware changes (and these will be a nightmare to deploy, if a firm acts to this degree to secure them at all), many of them can be corrected with software patches. This gives most enterprise users a seemingly good plan to fix their immediate problems, but they are hardly in the clear now. The problems with Barco are just the tip of the iceberg when it comes to dealing with vulnerabilities in well-known hardware and software products.

    The Root of the Problem

    Now that the immediate issues have been resolved, we need to ask how devices with serious security flaws ended up sitting in thousands of conference rooms worldwide, or why they were so poorly designed and programmed in the first place. It’s not like the F-Secure team was uncovering zero-day or previously unknown vulnerabilities. Ten of the flaws discovered in the Barco products were associated with well-known, common vulnerabilities such as code injection attacks. Most already had Common Vulnerabilities and Exposures (CVE) identifications.

    So how did decades-old CVEs get coded, or even hardwired, into modern presentation tools? The only possible answer is that developers either didn’t know about them, or that security was not made a priority as the Barco devices were being designed. Sadly, this is a common situation, and certainly not exclusive to the Barco teams.

    The best time to fix a vulnerability is while an application is being developed, long before it gets sent out to users. The worst (and most expensive) time is after a product has been deployed, or after it’s been exploited by hackers. This can be a hard lesson, and one that Barco will surely learn as its once-impenetrable market share takes a hit following this security fiasco.

    Shifting security fixes back toward the development process isn’t easy, but is necessary in today’s world where even seemingly simple devices like presentation tools are both surprisingly complex, and also networked into everything else. In this environment, security must become an organizational best practice. It doesn’t matter if a company is programming apps for social media or manufacturing smart toasters, security must be considered in every facet of an organization.

    Prioritizing security best practice and making it a shared responsibility is the goal of the DevSecOps movement, where development, security and operations teams work together to code and deploy secure software and products. It requires as much of a change in culture as anything else. The new mindset needs to be that deploying a working product with security vulnerabilities is just as much a failure as creating one that can’t perform its primary function.

    In a healthy DevSecOps environment, anyone touching software should be security-aware, with developers receiving relevant and frequent training to avoid introducing disastrous bugs into their work. If the teams working for Barco had looked at security as a shared responsibility, there is no way that such a large collection of vulnerabilities, including decades-old CVEs, would have made it into their presentation tools.

    The Safe Path Forward

    Nobody wants to be the next Barco, having to explain why well-known security flaws were deployed through their devices to thousands of enterprise networks around the world. To avoid that fate, companies developing software or smart hardware should immediately prioritize security as both a shared responsibility and an organizational best practice. Creating a healthy DevSecOps program will take time and likely also require a shift in culture, but the results will be more than worth the effort. Robust DevSecOps can crush vulnerabilities long before they cause trouble.

    For companies buying products and software, it’s in their best interest to support firms that have embraced DevSecOps. Doing so will go a long way to making sure that the devices and software obtained from them aren’t ticking time bombs waiting to be exploited by increasingly skilled attackers.

  • DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    The current situation with so many working from home has shined a spotlight on potential security issues with many of our collaboration solutions. Adeya, says they have the answer, offering Swiss, simple collaboration on a military grade scale.

    I sat down with Francois Rodriguez of Adeya’s executive team to discuss what makes Adeya both simple and secure, as well as what the offering is all about. This is more than video conferencing by the way. This is a well developed and tested collaboration suite that has been in use by the Swiss military and others for years. Have a listen and check out Adeya.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud. You’re listening to another DevOps Chat. We’ve got a new company to introduce you to on today’s DevOps Chat, and the name of the company is Adeya. I hope I didn’t mispronounce that, but my guest will give us the proper pronunciation. I’d like to introduce you to Francois Rodriguez, he’s the chief growth officer at Adeya. Francois, welcome.

    Francois Rodriguez: Thank you for hosting us.

    Shimel: Thank you. So, Francois, did I get the name right?

    Rodriguez: Yeah, correct. The pronunciation is correct. Americans tend to say Adeya, but yes, Adeya is correct. [Laughter]

    Shimel: Okay. Well, you know, I always thought I had a little bit of a French accent. [Laughter] But I’m glad I got it right, then. So, let’s start with the obvious, Francois. Our audience may not be familiar with Adeya. Why don’t you, if you don’t mind, give us a little background?

    Rodriguez: Yeah, the background of the company is the following. So, it is a spinoff from EPFL. EPFL is one of the top five universities in technology in the world, based in Lausanne, so next door. So, for those that don’t know where Lausanne is, it’s next door to Geneva. And from that spinoff, the ask was for encrypting voice communication for the Swiss Army at that time, using a Symbian Operating System. At that time, Nokia was the leading mobile phone operating system, and that was the foundation of the company.

    With the advent of the smartphones, the application has been enriched with messaging and then the mobile application becomes, as well, a desktop application, a tablet application, enabling as well file sharing, instant messaging and we’re introducing as well video conference calling, end to end encrypted. So, that’s the most important element of the suite is the encryption layer, initially deployed and developed for the Swiss Army, so we are using the highest grade of encryption, so called military grade. And we are bringing that technology to companies and small organizations as well.

    Shimel: Excellent. So, the Swiss Army is already a customer, is that correct?

    Rodriguez: It’s the historical customer.

    Shimel: Okay. And then, at this point, has the company raised venture capital? Is it self-funded? What is the situation?

    Rodriguez: Yeah, it’s a venture capital, which is important in this type of business. You certainly have heard the news of cryptogate that was having some links with governments. So, these days, it’s very important when you provide this type of technology that you don’t have strings with any organization state owned or having any back door.

    Shimel: Sure. Sure, I mean, everyone’s worried about that. And, you know, as—well, before we jump more into that, Francois, what about your personal background, your journey? How did you come to be chief revenue officer—excuse me, chief growth officer at Adeya?

    Rodriguez: So, I started my career in telecom. At that time, I was in charge of developing the multimedia content for the youth and student populations. Before the advent of the smartphones, multimedia was games, ring tones. I don’t know if you remember these days.

    Shimel: Sure, I do.

    Rodriguez: And then we developed the music content, the early days of .mp3s. And moving forward, I professionalized my expertise in multimedia, transforming application into more professional applications. With the arrival of the tablets, we develop more and more professional application for enterprise, and then I joined a brand new spinoff from Airbus Enceda to bring connectivity on airplanes. The company used to be called OnAir.

    Shimel: Mm-hmm.

    Rodriguez: You’ve got Gogo in the U.S., so it’s a similar company, providing connectivity to passengers, multimedia and content to passengers, but as well, professional application for the cabin crew, electronic flag backs for the pilots, and more recently, IUTs connecting landing gear, engines, and any data that the airplane was generating.

    Shimel: Sure. Fantastic.

    Rodriguez: I joined Adeya in 2016.

    Shimel: Also, how long has Adeya been around for? I didn’t realize. When was Adeya founded?

    Rodriguez: 2007.

    Shimel: Oh, really? So, it’s been—so, this is not some fly by night, started yesterday company. You guys have been at this a while.

    Rodriguez: Yeah, exactly. Yeah, the brand awareness is really recent, because the typical client of Adeya used to be governments that are quite shy to do any marketing around, and it’s really when I joined the company that we started the blocking and enterprise product.

    Shimel: You know, in some ways this reminds me of—so, I’m a little older than you. [Laughter] But, you know, back when we had the AOL message rooms or chatrooms, whatever—they called them meeting rooms, maybe, before then. It was a rather innocent time on the internet where people didn’t realize you can’t let your children go online and just go into some chatroom with people you don’t know and what can go on there. And of course, we saw horror stories of what people were writing in chatrooms being made public or used the wrong way or predators, you know, preying on women and children and stuff. And because—well, it’s the reason why we can’t have nice things, right? There’s always bad people trying to take advantage of things.

    And then, as a result of that, you know, we saw a locking down, if you will, somewhat, of a lot of that kind of technology. But then, I guess it’s just human nature, people want to communicate, right? People want to communicate—even, God knows now, when we’re all locked in our houses, right, people want to still communicate. Being alone and isolated is just kinda foreign to the human condition.

    Rodriguez: Yeah, you’re right. So, I used to put an application on my daughter’s phone to lock the phone after an hour. These days, we’re up to three hours, because, you know, they need to communicate. They don’t go to school any more, so they need to be connected to friends, they need to chat, they need to send pictures, to send videos, to do video calling. These days, video calling is very important for the youngsters. I’m usually not a very big fan of video calling, but they are, so those are—

    Shimel: No, they’re native. They’re native to this, right? To us, we look at it and—actually, I was having this conversation with my COO this morning, talking about, we both  have children who are in high school, college now and in university.

    Rodriguez: Yes.

    Shimel: And, you know, they’re net native people who, the idea of doing video calling, the idea of listening to podcasts and so forth, this is how they’re used to consuming, right? And [Cross talk].

    Rodriguez: They’re used to the technology, they’re used to the technology and they’re also very tech savvy in terms of what features and functions those tools can bring, and they are very, very, I would say, picky on which tools they’re gonna use. And we’ve seen that in certain companies that there is a kind of step back when they propose traditional tools that are quite clunky, quite difficult to use, very slow that you need to put the VPN around and all these old fashioned or traditional tools have been rejected by the young population of workers.

    Shimel: Yeah.

    Rodriguez: And more so now with these days of remote workers where you have, you know, a layer of Bring Your Own Device on top of it where people are installing their own favorite applications, too. It’s very difficult to control. It’s very difficult to put security around when you don’t have a clear policy on what is allowed, what is not allowed, and more so when you don’t bring options. People are starting to download their favorite tools online. Obviously, security is not their top priority, it’s to make their work easy and fast and provide agility to the organization. So, that’s a real issue.

    Shimel: I agree. And you know, I mean, but this is a classic security conundrum, which is, if we just think we’re gonna lay down on the tracks and say, “Stop!” the train runs us over, right? We can’t stop that, so what we need to do is, instead of being the people who say no, we need to be the people to say, “Yes, you can, but here’s a secure way of doing it that maybe isn’t too cumbersome, too expensive, and still allows them to do what they need and want to do from a communications perspective.”

    And I guess, really, that’s what the whole Adeya thing is about, right, is—hey, you wanna video or do voice calls or, you know, messaging, you can still do that, and we understand it’s important. But here’s a way of doing it in a more secure fashion.

    Rodriguez: Yes, security is important, but what we’ve been putting at the heart of the development is the user experience. Because there is a lot of tools in the security space in the market, but very few of them are really providing a seamless experience for the users, and more so when they’re not IT people. Because IT people will always tell you, “That’s very easy, you go in Settings, you configure that, and you put the VPN around and it’s working,” when in fact, nobody knows how to do it.

    So, what we’ve been doing is to bring in one unique application, I’m calling the Adeya like a Swiss Army knife. In one tool, you have got different features. You don’t need to have, you know, upswinging. You don’t need to have configuration. The security layers are ___, you instill it in your device, and you start triggering the feature that you want to use.

    Shimel: Absolutely. Francois, if you could share with our audience, you know, how easy and how much does it cost if you wanted to use the Adeya solution? Let’s say—look, I’m a little worried about our use of Slack and/or Zoom for corporate communications; you wanna use what you wanna use with your kids or whatever, that’s one thing. What does it take to stand Adeya up?

    Rodriguez: So, we’ve got four packages, depending on the security layer that you want to activate. So, the starting price point is $4, the $4 is already, you know, the starter package that provides you one to one video calls, security voice over IP, instant messaging, and as well, you know, all the Dropbox and Lockbox where you can store some documents.

    If you want to have the video conferencing with multiple users, you have an extra option, and if you want to install everything on premise on your own data center, and this is what we do for governments, there is an extra cost to deploy the system, but it’s your entire system, okay? You have no backdoors, no cloud act to open up your data center to foreigners, and you have everything in your house. So, that’s the model that we do.

    So, we’re starting with a very easy to set up cloud solution based in Switzerland and we use the strength of the cloud infrastructure in Switzerland with the data sovereignty, and we go up to deploy your own system on prem.

    Shimel: Really, okay. So, there’s sort of a cloud-based system, if you will, SaaS or cloud-based, and then you have a choice of on-prem. Because I know in many government situations, as you mentioned, they don’t want to share public infrastructure, right?

    Rodriguez: Yeah.

    Shimel: And so, that’s a real requirement. So, Francois, I’ve got to ask you, I mean, it seems like the Adeya system would find a very fertile ground in today’s environment with what’s going on with COVID, with people working from home and everything else—how has this affected, or how has Adeya responding? What are you seeing in the market recently now, just in the last couple weeks, as a result of the pandemic?

    Rodriguez: So, what we see is a variety of demands coming from the historical clients which are government administrations that are really expanding the fleet. It’s not, you know, just to secure a certain special project, but it’s really to provide everyone the tool to work from home, and in the most important security layers. Because, as soon as you leave the government institutions, you need to be connected from whom, with high level security, because then you bring the formation outside the typical firewalls, and this is what the governments are fearing.

    Now, the diversity that we’re seeing is that we start having—hello?

    Shimel: No, no, it’s okay. People are blogging, I have a meeting coming on.

    Rodriguez: Okay, understandable. What we see is, enterprises now coming to equipping their entire organization and not just the top executives that used to travel a lot or go to countries where they need to shield their communication, but as well to protect their messaging, to protect their messaging, to protect the documents that they’re sending, avoiding sending them over e-mail because even though e-mail has been encrypted for several years, it’s very difficult to have the IPs working because the systems are not interworking together, depending on the operator that you use. If one side is using Gmail, the other side is using Microsoft, you don’t have interworking with encryption, for instance.

    Shimel: Sure.

    Rodriguez: This is the—we try to ease the experience with this type of situation. What we see now is the remote workers as well, the employees themselves are contacting us to, “Hey, I heard about your solution. Give me some documentation that I can bring to my IT people.”

    Shimel: Well, that’s the way it always comes in. You know, it’s almost that open source mentality, but very good.

    Rodriguez: Exactly. So, that’s the number—

    Shimel: Francois, as I mentioned to you when we started, the time goes really quick, here. I apologize, but we’re way past 15 minutes.

    Rodriguez: Okay.

    Shimel: I wanna thank you for introducing Adeya to our audience. I wish you will in these uncertain times, both personally and with the company. And as I mentioned to you, maybe we could do a video interview for our TechStrong TV—

    Rodriguez: Yeah, sure.

    Shimel: And have you join us. Maybe we even could use a day or we could record the video through there or something, show people it in action.

    Rodriguez: Yeah. Okay.

    Shimel: Sounds good?

    Rodriguez: Yeah, perfect. Looking forward.

    Shimel: We’ll work on that. Alright.

    Rodriguez: Thank you, Alan.

    Shimel: Thank you.

    Rodriguez: Pleased to meet you. [Cross talk]

    Shimel: Chief growth officer for Adeya, Francois Rodriguez, here on DevOps Chat, this is Alan Shimel, and you just listened to another DevOps Chat.

    — Alan Shimel

  • Free Remote Endpoint Protection Solution From Qualys

    Free Remote Endpoint Protection Solution From Qualys

    Qualys today announced it is offering a completely free, 60-day version of its cloud-based remote endpoint protection solution. The product is fully featured, with nothing turned off in the free version. It’s also cloud-based, so there are no worries about hosting the solution. This comes at a perfect time, with so many workers working remotely.

    You can download the free solution at:

    www.qualys.com/forms/remote-endpoint

    According to the Qualys release:

    “The Qualys remote endpoint security solution allows security teams to leverage the lightweight Qualys Cloud Agent to:

    • Complete an up-to-date inventory of all their remote endpoint hardware and the applications they are running
    • Gain a real-time view of all critical vulnerabilities impacting the operating system and applications posing a risk to these devices
    • Remotely patch these systems within hours from the cloud with one click of a mouse without using the limited bandwidth available on VPN gateways
    • Realize visibility in device hygiene by tracking common misconfigurations that leave the endpoints exposed to exploits.”

    devopsy.kinsta.cloud spoke with Qualys President Sumedh Thakar for more information on this new free solution. That conversation can be heard below:

    Here’s a screenshot of the web-based interface of the solution:

    Qualys endpoint screen shot

    What happens after the 60 days you ask?  Qualys did not say definitively what the plan is for that, but I suspect that will depend on what happens with our economy and the work-from-home trends. In the meantime, if you are looking for a remote endpoint solution for the enterprise, this is a great chance to try one free for 60 days.

    — Alan Shimel

  • A Professional Dilemma

    A Professional Dilemma

    — ROELBOB

    — ROELBOB

    — ROELBOB

  • The DevOps Sweet Spot: Inserting Security at Pull Requests (Part 2)

    The DevOps Sweet Spot: Inserting Security at Pull Requests (Part 2)

    In part one of this two-part series, I explored how organizations can more effectively automate security quality decisions and discard doing automation for automation’s sake. I shared why security scans need to be faster, more reliable and comprehensive. Only then can security be meaningfully automated into developer workflows without slowing them down.

    But, the other part of this is understanding where these security scans should take place throughout the SDLC. Why? Because inserting security too early or too late in development and pre-production can have drastic impacts on remediation efficiency, developer productivity and more. 

    Shifting Security as Far Left as Pull Requests

    Identifying vulnerabilities once they’re in production is the riskiest, as well as the most time-consuming and expensive remediation. Working in pre-production test environments or builds reduces the risk, but not much of the time or efficiency in remediation. Conversely, inserting code analysis into developer IDE’s is too early. While in theory the IDE could be a good place for security feedback, in practice, it slows down the developer’s machine and comes at a huge cost of productivity.

    Instead, commits and pull requests are the ideal place to insert security because it delivers the right vulnerability information to the right developer at the right time. Combine this with integrations into ticketing and other systems and the full developer workflow can be meaningfully automated.

    Simply by getting the right developer, the right vulnerabilities information breaks down one of the biggest challenges in AppSec. Developers typically outnumber AppSec team members by 50-1 or more—hence a security scan that generates 100 vulnerabilities creates a tremendous amount of work for a single AppSec professional. However, assigned to the right developers, at an average of two per person, the challenge immediately becomes more manageable. Still accuracy matters because, while the burden may be spread out, developers triaging false positives is an expensive resource focusing on a low value task.

    Getting developers security feedback at the right time is also vitally important. When developers get immediate security feedback, vulnerabilities become easier to fix because the code is still fresh in their mind. Furthermore, fixing vulnerabilities early has compounding benefits. Since insecure code never goes into production, not only is the attack surface reduced, but additional code that is dependent on the vulnerability never gets written. This minimizes the most expensive and time-consuming security fixes, which require not only fixing the underlying vulnerability, but also rewriting dependent code. Best of all, with immediate, regular, comprehensive and accurate security feedback, developers will ultimately learn and adopt more secure coding practices overtime.

    Lastly, by inserting security at the commit or pull request, security and developers can establish a shared responsibility model on more realistic terms. When security can commit to accuracy and timely KPIs, developers can commit to triaging and fixing vulnerabilities faster. This reduces MTTR, puts a downward trend on defect density and reduces the application’s overall attack surface. It also reflects the realities that AppSec professionals have a limited ability to triage vulnerabilities, because they don’t know the code intimately and that only developers can fix the underlying vulnerabilities.

    By solving the fundamental challenges of speed, accuracy and comprehensiveness to deliver the right vulnerability to the right developer at the right time, security earns the ability to ask more from developers, and CISOs and CTOs can jointly accept responsibility for protecting applications and data.

    The rate at which software is being created and shipped isn’t slowing down, but many organizations have struggled to find where security most effectively fits into this process. By inserting security at the pull request, not only can developers identify and remediate vulnerabilities faster and more accurately, they can better automate security quality decisions. By taking this approach, organizations are fundamentally changing how engineering and security collaborate within enterprises.

    — Chetan Conikee