3 security best practices for all DevSecOps teams

It's been over 10 years since Shannon Lietz introduced the term DevSecOps, aiming to get security a seat at the table with IT developers and operators.
More organizations are looking to shift-left security to ensure that security is prominent in their development practices.
Even though nearly 30% of respondents said they deployed to production weekly, only 20% were assessing or testing for security vulnerabilities at a similar velocity.
Technology leaders and DevSecOps teams struggle to determine which security practices to prioritize and mature.
The SANS survey lists over 25 security practices and techniques that at least 50% of respondents said were useful.
Determining which security practices to focus on requires that we account for business goals, risks, development velocity, the technology stack, compliance requirements, and other factors.
The report lists top API security risks, including injections, authentication flaws, cross-site issues, API leaks, and broken access controls.
While many organizations have adopted the best practice of implementing APIs, some haven't fully shifted left and applied security practices during API development.
Today, there are many static code analysis tools, also called static application security testing tools, for DevSecOps teams to consider.
While SAST helps developers identify vulnerabilities before pushing to production, Dan Garcia, CISO at EDB, recommends adding dynamic application security testing capabilities.
If you're investing in software development, cloud-native architecture, and CI/CD pipelines, there's no excuse not to include code scanning capabilities to review code and highlight security vulnerabilities.
One is security observability to cover the full stack, including application, integration, and cloud infrastructure.
DevSecOps should also extend observability practices into the dataops and machine learning model realm, since issues in these domains can also impact reliability, performance, and security.
Building observability into MLops helps track security issues, such as threat actors triggering pipelines or manipulating data.
If every application, data pipeline, and ML model uses different observability naming conventions, practices, and tools, it complicates whether SREs and security operations centers can quickly identify and resolve security issues.
I highlighted three security practices likely to impact many DevSecOps teams and where continuous investment and standards can address many security risks.
The SANs report highlights many other application security practices that should already be commonplace in IT organizations, such as third-party penetration testing, security training, and implementing a web application firewall.
Other practices, such as container security scanning and cloud-native application protection platforms, are relevant when DevSecOps is implemented on modernized architectures.
The choice of which security areas to focus on isn't getting easier, but there are too many risks when IT bolts on security.
Instead, teams should devote priority to continuous DevSecOps security practices.


This Cyber News was published on www.infoworld.com. Publication date: Mon, 04 Dec 2023 10:43:05 +0000


Cyber News related to 3 security best practices for all DevSecOps teams

DevSecOps: Definition, Benefits and Best Practices - DevSecOps is an approach that focuses on the alignment of the three core pillars of DevOps — Development, Operations, and Security. It’s a combination of processes, tools and practices designed to enable organizations to adopt innovative and ...
1 year ago Heimdalsecurity.com
3 security best practices for all DevSecOps teams - It's been over 10 years since Shannon Lietz introduced the term DevSecOps, aiming to get security a seat at the table with IT developers and operators. More organizations are looking to shift-left security to ensure that security is prominent in ...
10 months ago Infoworld.com
Modern DevSecOps - DevSecOps - a fusion of development, security, and operations - emerged as a response to the challenges of traditional software development methodologies, particularly the siloed nature of development and security teams. DevSecOps aims to break down ...
9 months ago Feeds.dzone.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
10 months ago Esecurityplanet.com
3 ways to reduce stress on the DevSecOps team - My session focused on the stresses and burnout experienced by security teams, including recent data showing that 94% of chief information security officers suffer from work-related stress, and 65% admit their stress levels compromise their ability to ...
9 months ago Infoworld.com
Mastering SDLC Security: Best Practices, DevSecOps, and Threat Modeling - In the ever-evolving landscape of software development, it's become absolutely paramount to ensure robust security measures throughout the Software Development Lifecycle. Each of these have illuminated different vulnerabilities that can be exploited ...
9 months ago Securityboulevard.com
Embracing Security as Code - Everything is smooth until it isn't because we traditionally tend to handle the security stuff at the end of the development lifecycle, which adds cost and time to fix those discovered security issues and causes delays. Over the years, software ...
9 months ago Feeds.dzone.com
CVE-2021-42016 - A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8), RUGGEDCOM i803 (All versions < V4.3.8), RUGGEDCOM M2100 (All versions < ...
1 year ago
CVE-2021-42017 - A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8), RUGGEDCOM i803 (All versions < V4.3.8), RUGGEDCOM M2100 (All versions < ...
1 year ago
IaaS Security: Top 8 Issues & Prevention Best Practices - Understanding the risks, advantages, and best practices connected with IaaS security is becoming increasingly important as enterprises shift their infrastructure to the cloud. By exploring the top eight issues and preventative measures, as well as ...
9 months ago Esecurityplanet.com
6 insights from Microsoft's 2024 state of multicloud risk report to evolve your security strategy - This is the first time Microsoft has released a report sharing key insights across aspects of cloud security, including identity and data. These threats and more are the driving forces behind Microsoft's work to advance cybersecurity protections by ...
4 months ago Microsoft.com
Cybersecurity Awareness Month: Cybersecurity awareness for developers - Siri Varma, tech lead and software development engineer with Microsoft Security, works with both developers and cybersecurity teams every day. Next, there’s the knowledge gap; coders may lack the necessary understanding of security practices, ...
1 week ago Securityintelligence.com
Infosec products of the month: May 2024 - The Third-Party Intelligence module combines vendor-specific cyber threat intelligence with cybersecurity posture data from suppliers' tech environments, exposing a critical blind spot for security teams. Synopsys Polaris Assist automates repetitive, ...
4 months ago Helpnetsecurity.com
The Elusive Quest for DevSecOps Collaboration - Despite years of discussing DevSecOps, achieving security and development collaboration remains an uphill battle in most organizations. The Slow March of DevSecOps Evolution While the concept of DevSecOps has been discussed for years as a best ...
9 months ago Feeds.dzone.com
CVE-2021-37209 - A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8), RUGGEDCOM i803 (All versions < V4.3.8), RUGGEDCOM M2100 (All versions < ...
1 year ago
CVE-2024-38867 - A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V9.64), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) ...
3 months ago
4 key devsecops skills for the generative AI era - Experts believe that generative AI capabilities, copilots, and large language models are ushering in a new era of how developers, data scientists, and engineers will work and innovate. They expect AI to improve productivity, quality, and innovation, ...
9 months ago Infoworld.com
CVE-2021-31895 - A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V4.3.7), RUGGEDCOM ROS M2200 (All versions < V4.3.7), RUGGEDCOM ROS M969 (All versions < V4.3.7), RUGGEDCOM ROS RMC (All versions < V4.3.7), RUGGEDCOM ROS RMC20 ...
3 years ago
CVE-2022-45044 - A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V9.50), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) ...
6 months ago
5 Tips for Strengthening the Developer-Security Team Relationship - COMMENTARY. In the ever-evolving realm of software development, the interaction between developers and security teams is critically important, with security analysts typically depending on developers to address vulnerabilities in previously written ...
9 months ago Darkreading.com
Strong Encryption Explained: 6 Encryption Best Practices - Strong encryption protects data securely from unauthorized access, but the specific algorithms that qualify as strong encryption change over time as computing power increases and researchers develop new ways to break encryption. Even the strongest ...
9 months ago Esecurityplanet.com
Microsoft Security Copilot improves speed and efficiency for security and IT teams - First announced in March 2023, Microsoft Security Copilot-Microsoft's first generative AI security product-has sparked major interest. With the rapid innovations of Security Copilot, we have taken this solution beyond security operations use cases ...
10 months ago Microsoft.com
Survey Surfaces Wasted Efforts Collecting Cybersecurity Data - A survey of 500 full-time security decision-makers and practitioners published today found that security teams are wasting time and resources normalizing data to store and analyze it in a separate platform instead of relying on the same data IT teams ...
10 months ago Securityboulevard.com
Five business use cases for evaluating Azure Virtual WAN security solutions - To help organizations who are evaluating security solutions to protect their Virtual WAN deployments, this article considers five business use cases and explains how Check Point enhances and complements Azure security with its best-of-breed, ...
5 months ago Blog.checkpoint.com
CVE-2019-19300 - A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All versions), KTK ATE530S (All versions), SIDOOR ATD430W (All versions), ...
1 year ago

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)