Earlier today, Bashyam Amant, our Sr Director of PLM, and Vaidehi Rao, our Director of Engineering, hosted a webinar entitled ‘Full-Stack Container Security,’ borrowing for the container space a (sometimes confusing) term familiar to many of you. One of the best definitions, and a good jumping-off point, is at codeup:
‘A full-stack developer is simply someone who is familiar with all layers in computer software development. These developers aren’t experts at everything; they simply have a functional knowledge and ability to take a concept and turn it into a finished product. Such gurus make building software much easier as they understand how everything works from top to bottom and can anticipate problems accordingly. In our opinion, this is the most realistic definition of a full-stack developer.’ For those looking for even more history on the topic, the turtles end at FB.
Extending this paradigm to containers and Docker, in our view, and in order to have a complete awareness as to how your container deployments impact your overall security posture, you must have tools that look at each ‘layer’ of the ‘stack’ while at the same time offering a unified vs a disjointed view.
- Details
- Written by David Ginsburg
- Category: DevOps
Devops Security Automation plays a key role in DevSecOps
Check out the executive viewpoint, “It’s Time to Stir Security into the DevOps Mix”, posted on the Security Current Web site earlier this month. The article highlights the fact that creating secure software and systems has never been more challenging as the number of devices that hook into company data, coupled with increased mobility and a shift to cloud services and storage, has dramatically increased the potential attack surface of most organizations. These organization changes require the adoption of a new approach–chiefly breaking down barriers, boosting collaboration, and increasing automation works—often referred to as cloud DevSecOps. In the article, we emphasize three key ingredients necessary to pursue cloud DevSecOps.
- Details
- Written by Rosella Fernandez
- Category: DevOps
Too start off the year, at least two publications have reported on surveys that detail the criticality of the cybersecurity skills gap. For those old enough, it harkens back to the Cold War missile gap of the 1950s. But unlike the missile gap, which was mostly fictional, this gap is very real, and much more relevant to the typical enterprise.
CSO drew on a Nov, 2017 ESG study that looked at gaps and potential solutions. The most alarming observation is that, despite increased spending and visibility, the percentage of respondents that reported a shortage of skills rose from 23% in 2014 to 51% in 2018. This doubling implies that the majority of organizations are threatened. As solutions, two areas that stand out include:
- Moving toward technologies with advanced analytics.Think of artificial intelligence and machine learning as a helper application that can accelerate security processes and make the staff more productive.
- Automating and orchestrating processes.Cybersecurity grew up with a reliance on manual processes, but these processes can no longer scale to meet growing demands. As a result, security automation/orchestration has become a top priority for many organizations.
- Details
- Written by David Ginsburg
- Category: Trending in Security
At Cavirin, 2017 was no less than re-thinking securing the hybrid enterprise and pioneering massive scalable solutions. This blog is a summary of all our announcements and key features related to Content and Policy frameworks that we brought to our customers and the community last year.
Read on!
- Defining Industry Accepted Security Standards – Cavirin is in the leadership position when defining security standards for container ecosystem. Working with CIS and the container communities, we published several versions of the security benchmarks.
Cavirin also released CIS Android Security Benchmark and launched CIS communities for Kubernetes and Azure benchmark development.
- Details
- Category: Continuous Security Assessment & Remediation
Now and then you come across a truly valuable presentation or piece of collateral. In this case, USTelecom, the organization that represents telecommunications businesses in the US, has put together a bit of both as a gift to the community at-large.
It was developed to help individuals and organizations better understand cybersecurity challenges and responses. The 50 slide PowerPoint show includes over 350 links to almost every security guideline imaginable – government, corporate, academic, analyst – and includes definitions, reports, best practices, and strategies.
- Details
- Written by David Ginsburg
- Category: Security Programs and ISMS
In November 2017, Fortune, leveraging data from Recorded Future, ran this sobering graphic on the price of various hacker tools, spanning personal records, attacks, and even services.
In the article, they quoted a statistic from Cybersecurity Ventures stating the global cost of hacking at $3 Trillion (with a T!) in 2015 will increase to $6 Trillion in 2021.Welcome to the era of Hacking-as-a-Service (HaaS).
How does the advent of HaaS impact the average consumer or employee? Why should they be concerned? I personally maintain a credit card virtual ‘go bag’ listing the 10-15 calls or emails I need to make when I receive the semi-annual notification that my primary credit card has been compromised.
- Details
- Written by David Ginsburg
- Category: Continuous Security Assessment & Remediation
Subscribe
Tag Cloud
Categories
-
Continuous Security Assessment & Remediation (19)
-
Amazon Web Services (AWS) (4)
-
Cloud Migration (6)
-
CyberPosture (9)
-
DevOps (11)
-
Docker Container Security (8)
-
Google Cloud Platform (GCP) (2)
-
Regulatory Compliance (9)
-
Risk Management & Analytics (3)
-
Security Compliance Platform (10)
-
Security Programs and ISMS (4)
-
Trending in Security (28)