Best match

Most recent

Russia

The SEC is suing SolarWinds and its chief information security officer for "defrauding investors." The Pentagon prepares to launch an artificial intelligence pilot program.

SEC suing SolarWinds and its CISO over Russian hack

https://www.bing.com/th?id=ODF.amZrHYsTPTll77pfOTgQuA&pid=news

federalnewsnetwork.com

Full extent of attacks unknown but telecoms thought to be especially exposed Vulnerabilities in F5's BIG-IP suite are already being exploited after proof of concept (PoC) code began circulating online.

Critical vulnerability in F5 BIG-IP under active exploitation

The Register on MSN.com

Agency

Enforcement

U.S. Securities and Exchange Commission

Earlier this week, the Securities and Exchange Commission (SEC) filed an enforcement action against SolarWinds (NYSE:SWI) for fraud and failures in regard to

https://www.bing.com/th?id=OVFT.tjv7i7ZtWQydEisOWMDfVC&pid=News

SolarWinds Comments on SEC Enforcement Action: Another Example of Agency Overreach

https://www.bing.com/th?id=ODF.oSZPaedojiaxzQf3-kdw4Q&pid=news

Crowdfund Insider

Exploit

CISA (Cybersecurity & Infrastructure Security Agency) has added the two vulnerabilities to its KEV (Known Exploited Vulnerabilities) catalog, urging federal government agencies to apply the available updates until November 21, 2023. Impacted and fixed ...

Hackers exploit recent F5 BIG-IP flaws in stealthy attacks

Bleeping Computer

Software

Major

The fact that a modern iPhone exploit sells for millions versus hundreds for an Adobe Acrobat exploit is an extraordinary achievement for Apple, worth celebrating and trying to replicate elsewhere. It reflects that big tech companies have quietly spent enormous resources to raise the cost to exploit software over the past 20 years.

https://www.bing.com/th?id=OVFT.wXVnjF5Rgy0-kcafz1HFgi&pid=News

It's Cheap to Exploit Software — and That's a Major Security Problem

https://www.bing.com/th?id=ODF.FCf_IAXJT5EE0_vkZm13Qg&pid=news

Dark Reading

Respond

The SEC charges against SolarWinds and its CISO will have significant ramifications to cybersecurity — and beyond.

Cybersecurity industry responds to SEC charges against SolarWinds and former CISO

https://www.bing.com/th?id=ODF.qPCJA3Or4GGU4hhi1ZEpfg&pid=news

VentureBeat

U.S. regulators have sued SolarWinds and its top security executive forfraud for allegedly concealing poor cybersecurity practices ahead of theTexas-based technology company's stunning hack by Russian spies.

https://www.bing.com/th?id=OVFT.ExD9NYLI5ROmXOTvWLzW_C&pid=News

US regulators sue SolarWinds and its security chief for alleged cyber neglect ahead of Russian hack

https://www.bing.com/th?id=ODF.PxKQHVsCyPoy0sdpidkRxw&pid=news

KERA News

Birmingham

Essential

Conduct Regular Security Audits The first step toward enhancing cyber security is to conduct regular security audits. These audits help identify vulnerabilities in your business’s network infrastructure, software applications, and data storage systems.

https://www.bing.com/th?id=OVFT.98S6ssAA0csPI-B9Xowlbi&pid=News

10 Essential Cyber Security Measures Every Business Should Implement in Birmingham

Impacts

Opinion

China

Chinese law requires companies located there provide security access to source code and other sensitive data if demanded.

https://www.bing.com/th?id=OVFT.AN0cSi4-PvskISpc8iS4Dy&pid=News

Opinion: U.S. tech firms must rethink their relationships with China

https://www.bing.com/th?id=ODF.yRagcIOnj3Ol7S-04g0T5w&pid=news

East Bay Times

Disclosure

Some cybersecurity experts expect that Clorox’s response ... unpatched system can be just as dangerous as having a vulnerability listed on the common vulnerabilities and exposures (CVEs) list hiding inside a network. It’s not enough to inventory ...

https://www.bing.com/th?id=OVFT.FeoKqZoDNgKjJOIkv89pEy&pid=News

Why The SEC Cybersecurity Disclosure Rules Will Improve Cybersecurity

Forbes

Get the most recent info and news about Tenable on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Tenable Holdings, Inc. provides cyber exposure solutions for in the Americas, Europe, the Middle East, Africa, the Asia Pacific, and Japan. Its platforms include Tenable.io, a cloud-delivered software as a service that provides organizations with a risk-based view of traditional and modern attack surfaces; Tenable.cs, a cloud-native application platform that enables organizations to programmatically detect and fix cloud infrastructure misconfigurations; Tenable.io WAS, which provides scanning for modern web applications; and Tenable.ep, an unified platform that helps organizations identify, assess, and accurately prioritize cyber risks across the entire attack surface. The company also offers Tenable.ad, a solution to secure Active Directory environments; Tenable.ot, an on-premises solution that provides threat detection and mitigation, asset tracking, vulnerability management, and configuration control capabilities to protect OT environments, including industrial networks; Tenable.sc, an on-premises solution that provides a risk-based view of an organization's IT, security and compliance posture. In addition, it provides Nessus Professional, a vulnerability assessment solution for identifying security vulnerabilities, configuration issues, and malware; and Nessus Essentials, which includes vulnerability and configuration assessment for a limited number of assets. The company was founded in 2002 and is headquartered in Columbia, Maryland.

Tenable

What Is CloudMapper? CloudMapper serves as an indispensable tool for anyone navigating the complexities of Amazon Web Services (AWS). This open-source utility provides a detailed analysis of an AWS account's architecture and security posture, making it ideal for security analysts, developers, and system architects seeking to gain insights into their cloud resources. Originally developed to graphically represent network architecture within AWS, CloudMapper has grown in functionality, now offering resources inventory, security assessment of IAM policies, visualization of public and private resources, and much more. The genesis of CloudMapper was rooted in the need to simplify security audits and risk assessments within expanding cloud infrastructures. As a comprehensive response to these challenges, it evolved to assess security configurations and identify potential vulnerabilities across AWS regions. Its ability to map out AWS landscapes with precision has made it a favorite among organizations for maintaining robust security measures and ensuring the integrity of its cloud infrastructure. In an ecosystem where comprehensive cloud-native application protection platforms (CNAPP), cloud security posture management (CSPM), and cloud workload protection platforms (CWPP) are increasingly common, CloudMapper offers a no-cost alternative that might be just enough to bridge the gap for many users. While these full-featured platforms provide extensive capabilities, they often come with a hefty price tag and complexity that not all organizations require. For teams that need a straightforward, focused approach to cloud environment analysis and security, CloudMapper stands as a capable and cost-effective tool, delivering essential features that are more than sufficient for maintaining a strong security posture and optimized resource use in AWS. Why CloudMapper (You Get What You Pay For, Or Do You?) CloudMapper enters the cloud management arena as a compelling alternative to paid tools with its robust set of features that offer detailed visibility into AWS environments. For organizations wary of the substantial investment required for premium cloud analysis services, CloudMapper presents an opportunity to perform in-depth reviews of account status, resource inventories, and security configurations without the associated costs. This open-source tool is particularly valuable for small to medium-sized enterprises or startups that require comprehensive cloud oversight but must adhere to strict budgetary constraints. It might be possible to augment, or in some limited situations, replace paid solutions like those from Ermetic (now ), , , , and others. Tenable Aqua Lacework Palo Alto Networks The utility of CloudMapper extends beyond cost-saving; it's an essential instrument for a variety of use cases. It can be instrumental for security engineers conducting audits or companies looking to optimize their cloud resource utilization. For instance, during migration phases, CloudMapper can identify over-provisioned resources, helping to trim excess and avoid unnecessary expenses. Security teams can utilize CloudMapper's detailed IAM and security group analysis to enhance their security posture, ensuring that only necessary permissions are granted and that potential vulnerabilities are addressed. Whether it’s for strategic planning, compliance adherence, or security hardening, CloudMapper provides the insights needed to navigate AWS's cloud complexities with precision and confidence. Key Features of CloudMapper CloudMapper is equipped with a suite of functionalities tailored to the diverse needs of cloud infrastructure management. Its primary use cases include generating detailed resource inventories across multiple AWS regions, enabling a granular view of service usage and deployments. This feature is particularly helpful for cost management and identifying redundant resources. CloudMapper also specializes in visualizing complex network topologies, giving users the ability to see interconnections between services and assess their security exposure. For security audits, the tool meticulously examines IAM configurations, highlighting both active and inactive resources, and it scrutinizes public assets like EC2 instances and RDS databases to pinpoint potential security gaps. A lesser-known but highly valuable feature of CloudMapper is its ability to simulate network traffic to test the impact of route table and security group changes before they are implemented. This predictive capability allows engineers to proactively assess the potential consequences of network updates, thereby preventing disruptions and security breaches. This preemptive analysis tool can serve as a safeguard against inadvertent misconfigurations that could lead to costly downtime or security incidents, proving CloudMapper’s utility not just in analysis and visualization, but also in proactive infrastructure management. Wrap It Up CloudMapper stands out as an essential toolkit for any team working with AWS, offering a powerful yet cost-effective solution for cloud environment analysis. Its ability to provide deep insights and visualizations empowers users to manage and secure their AWS resources with unprecedented clarity. As we've explored its various use cases and the unique features it brings to the table, it's clear that CloudMapper is more than just a tool—it's a strategic asset for cloud management. But is it to provide all the insight and depth required to confidently secure a cloud environment? enough Stay tuned for Part 2 of our exploration into CloudMapper, where we'll dive into a hands-on, step-by-step setup guide. Whether you're new to AWS or looking to enhance your current infrastructure, our upcoming guide will equip you with the knowledge to deploy CloudMapper efficiently, unlocking its full potential to streamline your cloud operations. Don't miss this practical walkthrough to elevate your AWS experience with CloudMapper's dynamic capabilities.

Navigating AWS Landscapes: A Deep Dive Into CloudMapper Capabilities

The next day, the 8th day of January

THE CONCEPTION AND THE GENETIC THEORY OF LIBIDO

Hi, HackerNoon! My name is Sofia, and I am a DevOps/Cloud engineer. I decided to participate in the contest by HackerNoon and Aptible. In this article, I will talk about the features of the DevSecOps pipeline and the concept of Shift Left. You will learn about the main stages of the DevSecOps pipeline, automated security checks in software development, and free and open-source tools. You'll also find tips to help you detect vulnerabilities earlier and improve application security. This article will help you assess the maturity of your DevSecOps pipeline, develop a roadmap for its development, choose the right tools for each task, and better understand how to manage projects following the DevSecOps philosophy. Shift Left Concept The main goal of the DevSecOps methodology is to introduce automated security checks into the DevOps pipelines, i.e., into the software development process itself. Not so long ago, information security specialists conducted tests after completing the development process. This approach is inefficient - if errors are discovered during security testing, the entire development cycle has to be restarted. This is time-consuming and expensive. Take a look at the image below. You can see that the cost of error correction increases with each step. It costs almost nothing to fix security issues discovered during development and functional testing. All necessary changes can be made to the source code immediately and sent for rechecking. Fixing problems at the artifact build stage is at least twice as expensive. You will have to make changes to the build process, for example, edit the Dockerfile, which means you will need the help of DevOps engineers. If an error is detected during integration testing, it will be 10 times more expensive to fix it. In this case, you must restart the development cycle and involve developers, DevOps engineers, and testers. Security problems detected at the deployment stage can lead to user data leaks. The company can receive millions of dollars in fines and damage to its reputation, which means the cost of a mistake increases hundreds of times. Hence, the main conclusion is that safety checks should be performed as early as possible. If you visualize it, move them to the left side of the Pipeline. This is the concept of Shift Left, which security experts love to talk about so much. DevSecOps Pipeline Structure DevSecOps pipelines are an automated chain of processes and tools that build, test, and deliver applications in a production environment and secure them at every stage. The image above shows the DevSecOps Pipeline structure with all the main phases of security checks. Here are a few words about each of them: Pre-commit. It implies checking the security of source code before the developer commits the code to the version control system. This check allows you to detect unencrypted confidential information such as passwords or API keys. Pre-build. It implies checking the security of source code after it has entered the version control system. The tools perform static analysis of source code and its dependencies to detect common vulnerabilities, such as many of the list. OWASP Top Ten Post-build. It is the security check of an artifact built from source code, such as a Docker file, RPM package, or JAR archive. The tools analyze the application environment and dependencies, finding outdated versions of packages and libraries that already have patches in newer versions. Test-time. It implies testing the security of an application running from a collected artifact. Tools in this phase try to "break" the application by simulating the attackers' actions. Post-deployment. It implies checking the security of an application after it has been deployed in a production environment. The tools monitor open registries of known vulnerabilities in real time and notify when a threat to the application is detected. Next, let's take a closer look at what these checks are and what tools are used to perform them. Pre-commit Checks Pre-commit checks allow you to analyze the source code on the developer's machine before committing changes to the local copy of the repository. If any of the statements returns an error, the commit is not performed. In this case, the developer must fix the mistake and commit again. This check avoids the situation when unchecked code, for example, with unencrypted secrets, gets into the repository. For performing pre-commit source code checks, it is necessary to install tools on developers' local machines. This approach has not only advantages but also disadvantages. For example, environmental differences: different versions of the instruments, various operating systems, and even processor architectures. If developers use different versions of pre-commit tools, the results of checking will differ, and this may make it challenging to work together. Consider this when implementing pre-commit checks within a team or across the company. Tools for Pre-Commit Checks Many open-source tools can be used to set up pre-commit checks: Gitleaks git-secrets Trivy Secret Scanning Whispers git-all-secrets detect-secrets gitty leaks These are great tools for pre-commit checks. Pre-Build Checks In the pre-build phase, White Box Testing is performed. These checks are used to analyze the source code, like in the previous step. In this case, the application is a "white box" because we know and understand its architecture and internal structure. There are several types of pre-build checks: Secret Detection Static Application Security Testing (SAST) Software Composition Analysis (SCA) Now, let’s discuss them in detail. Pre-build Secret Detection Check Secret Detection is an automated check that detects unencrypted sensitive information: unencrypted secrets in source code that have entered a version control system. Pre-build checks are performed after the source code has entered the repository of the version control system. Therefore, all unencrypted sensitive data in the storage can potentially be accessed by attackers, for example, if the repository's contents are leaked. In addition, the process of implementing secret-detection checks may occur not from scratch but in an evolving project. In this case, unencrypted secrets may be found in old commits and different repository branches. To solve these problems, we need to do many different things. For example, we must clean repositories of unencrypted secrets or implement various secret management tools like . Hashicorp Vault Tools for Secret Detection Secret Detection can be configured using , , or . However, it is best to use services provided by well-known CI/CD platforms, for example, . Gitleaks git-secrets detect-secrets GitLab Secret Detection Pre-Build SAST Check Static Application Security Testing (SAST) is a test when analyzers do not just check syntactic correctness but also measure code quality with the help of unique metrics. The main task of SAST scanners is security testing. In particular, SAST-analysers contain source code for common vulnerabilities, for example, some of the lists. It is essential to say that SAST scanners find not only the vulnerability itself but also the code fragment that caused it. OWASP Top Ten SAST analysis is called White Box Testing because the analyzer can access the application's internal structure. It is important to note that analyzers check the source code without running it, so they may generate false positives and fail to detect some vulnerabilities. For this reason, you should not limit yourself to SAST analysis only. It is better to approach the issue comprehensively and use different types of analysis: SCA, DAST, IAST, and OAST. SAST Tools Proprietary solutions: e SonarQub Checkmarx SAST Solar appScreener The free solution is GitLab SAST. Pre-Build Source SCA Check Software Composition Analysis (SCA) is a methodology that secures applications by analyzing their open-source components. SCA scanners look for outdated dependencies that contain known vulnerabilities and exploits. In addition, some SCA tools can determine the license compatibility of components and the risks of license infringement. Source SCA analyses the source code and, more specifically, the application dependencies defined in the source code. This analysis is often referred to as Dependency Scanning. SCA allows you to detect an issue where a vulnerability in one component can lead to security problems in all applications. A good example is . This vulnerability was discovered in late 2021 in Log4j, a popular Java logging framework. It became one of the most feared vulnerabilities because it allowed attackers to execute arbitrary Java code on hundreds of millions of devices. Log4Shell SCA tools is an open-source solution. Trivy Commercial solution with free pricing plans: FOSSA Mend SCA As part of GitLab (available in Ultimate-version only), you can use . GitLab Dependency Scanning Post-Build Checks: Binary SCA The post-build phase comes after artifacts have been built from source code in the CI Pipeline: a Docker image, an RPM package, or a JAR archive. With post-build checks, you can analyze the dependencies in these binary artifacts. Binary SCA analysis involves inspecting binary artifacts such as Docker images, RPM packages, and JAR/WAR/EAR archives. It is also often referred to as Container Scanning. It makes sense to run it when the binary artifacts are built, i.e., not before the post-build stage. There are some exciting features when working with Docker images. Binary SCA analyzers check layers of Docker images and look for them as hash sums in public vulnerability databases such as or . National Vulnerability Database (NVD) Snyk Vulnerability DB Some of the analyzers can not only find vulnerable components but also suggest a fix, for example, by specifying the minimum required version of a component with an already fixed vulnerability. Examples of Popular Binary SCA Analyzers The free solution is . GitLab Container Scanning Open Source solutions: Trivia Clair Grape Quay JFrog Xray Docker Hub Docker Registry with built-in analyzers - . Harbour Test-Time Checks: DAST, IAST, and OAST At this stage, dynamic Gray Box Testing and Black Box Testing are performed. When the application's internal structure is partially or wholly unknown, these security checks are performed by emulating the actions of an attacker who finds vulnerabilities and tries to "break" the application by exploiting them. Let`s briefly discuss each of them: DAST, IAST, and OAST. Test-Time DAST Check DAST scanners automatically test applications by simulating external attacks through various vulnerabilities. The application is a black box for the analyzer; nothing is known about it. For DAST checks, it is necessary to have a running instance of the application available for the scanner. Moreover, the closer the parameters of the test instance of the application are to the production installation, the fewer false positives there will be. For example, suppose you have deployed a test application instance accessible only via HTTP protocol, but in production, the application is accessible only via HTTP protocol. In that case, the DAST scanner will generate some errors related to the lack of traffic encryption between the client (analyzer) and the server (application instance). Examples of DAST Tools Tools that are worth your attention: — only available in the Ultimate version GitLab DAST — an open-source solution, which is also used in GitLab DAST OWASP Zed Attack Proxy (ZAP) Acunetix Fortify WebInspect HCL Security AppScan Synopsys Managed DAST (Web App Scanning) Tenable.io Veracode Dynamic Analysis Great, move on. Test-Time IAST Check IAST (Interactive Application Security Testing) is a Gray Box Testing that combines the advantages and strengths of White Box Testing SAST and Black Box Testing DAST. To collect all the advantages and eliminate the disadvantages of SAST and DAST methods, developers invented IAST - a hybrid mechanism combining these methods. It increases the accuracy of dynamic testing because it gives more information about the application operation through code analysis. It is worth remembering that besides its advantages, IAST has limitations. The most basic one is the dependence on the language in which the application under test is written. IAST solutions work at the application level and require access to the executable code to analyze its behavior. This means that IAST solutions must be able to understand the programming language in which the application is written. It should be noted that support for a particular IAST solution may be better implemented for some languages than others. IAST analysis also takes a long time. It depends on many factors, such as the size and complexity of the application, the number of external dependencies, and the performance of the IAST tool used. Besides, the analysis process does not scan the code itself but checks only those fragments that are directly executed. Therefore, IAST analysis is best combined with functional testing when you can test as many application scenarios as possible. Examples of IAST Tools Here are great tools for you: Synopsys Seeker Veracode Interactive Analysis Microfocus Fortify WebInspect Checkmarx CxIAST Contrast Assess Hdiv Detection (IAST) Great, move on. Test-Time OAST Check OAST (Out-of-band Application Security Testing) is a technique developed by and is an extension of DAST that finds vulnerabilities that DAST does not see, such as log4shell. PortSwigger Examples of OAST tools I recommend you: Burp Suite OWASP ZAP with OAST plugin OAST services , , and BOAST TukTuk interact Move on. Post-Deploy Checks This is an essential stage in ensuring application security and operability. Unlike pre-commit checks, which are performed at the development stage, post-deploy checks allow you to identify possible problems already during application operation in the natural environment. Monitoring the Safety of Artifacts For detecting new vulnerabilities in time, it is necessary to perform regular artifact checks, including after an application has been deployed. This can be done using special repositories or tools, such as , Trivy, GitLab Container Scanning, or developing your integration module. Snyk Container Application Security Monitoring Another way to ensure security is to monitor the application itself. There are several technologies available for this purpose: Web Application Firewall (WAF) is a traffic filtering tool. It works at the application layer and protects web applications by analyzing HTTP/HTTPS traffic. RASP (Runtime Application Self-Protection) is a technology that detects and blocks attacks on an application in real time. It adds a defense function to the runtime environment, allowing the application to self-protect automatically. The main advantage of RASP over WAF is that it understands how the application works and detects attacks and illegitimate traffic. RASP can see not only typical attacks using signature matching but also attempts to exploit zero-day vulnerabilities by reacting to anomalies. Unlike WAF, RASP works within and with the application. WAF can be fooled. If an attacker changes the application code, WAF cannot detect it because it does not understand the execution context. RASP has access to diagnostic information about the application, can analyze it, detect anomalies, and block attacks. RASP technology has a specialty of focusing on preventing attacks by default. The system does not require access to the source code. RASP Fools I recommend you: Fortify Sqreen is an open-source solution developed by Baidu OpenRASP Signal Sciences Jscrambler Hdiv Imperva Great, move on. Visualization of DevSecOps P ipelines Results and Vulnerability Management At different stages of the Pipeline, I use many Application Security Testing/DevSecOps analyzers. Each of them generates a report in its own format, and some of them generate so-called False Positives. Because of this, it isn't easy to analyze the security of an application as a whole. To effectively analyze vulnerabilities and manage the remediation process, specialized Vulnerability Management tools, often referred to simply as , are used. Security Dashboards Security Dashboards solve the problem by delivering the results of DevSecOps analyses in a unified and easy-to-analyse form. In this way, security engineers can see what issues exist, which ones are most critical, and which ones need to be addressed first. DevSecOps Tools A wide range of tools are usually used as Security Dashboards: for example, classic SOAR/SIEM systems and the specialized DevSecOps orchestrator AppSec.Hub from Swordfish Security or the open-source vulnerability management toolkit DefectDojo. DefectDojo is a widespread tool. It is widely used even in enterprise companies. However, despite its popularity and solid age, this tool occasionally has some initial-level defects when contributors break the basic functionality in the commit. However, what is nice is that DefectDojo developers and maintainers help to sort out the complexities. DefectDojo developers are very responsive people - we recommend contacting them directly via Issues on GitHub. Shift Left Concept: Let's Summarize Once again, here is a quick recap of what was in the article. I explained what the Shift Left concept is and how it helps reduce the cost of bug fixes and development time: the earlier in the development process you start security checks, the better. Then, I deconstructed the DevSecOps Pipeline structure and looked at what security checks are performed at each stage of the Pipeline: Pre-commit. It implies checking the safety of source code before it enters the version control system. Pre-build. It is a check of source code security in the version control system (Secret Detection, SAST, SCA). Post-build. It is a security check of an artifact built from source code (Source SCA, Binary SCA). Test-time. It implies testing the security of the application that is running from the collected artifact (DAST, IAST, and OAST). Post-deploy. It implies checking application security after deployment in the production environment (WAF, RASP). Now, you understand how the DevSecOps Pipeline works. Now, you can assess the maturity of your DevSecOps pipelines, develop a roadmap for its development, and choose the right tools for each task.

How to Turn A DevOps Pipeline Into a DevSecOps Pipeline: A Shift Left Concept Overview

কীভাবে একটি DevOps পাইপলাইনকে একটি DevSecOps পাইপলাইনে পরিণত করবেন: একটি শিফট বাম ধারণা ওভারভিউ

So verwandeln Sie eine DevOps-Pipeline in eine DevSecOps-Pipeline: Eine Übersicht über das Shift-Left-Konzept

Cómo convertir una canalización de DevOps en una canalización de DevSecOps: una descripción general del concepto de cambio a la izquierda

Comment transformer un pipeline DevOps en pipeline DevSecOps : un aperçu du concept Shift Left

एक DevOps पाइपलाइन को DevSecOps पाइपलाइन में कैसे बदलें: एक शिफ्ट लेफ्ट कॉन्सेप्ट अवलोकन

DevOps パイプラインを DevSecOps パイプラインに変える方法: シフトレフトの概念の概要

DevOps 파이프라인을 DevSecOps 파이프라인으로 전환하는 방법: Shift Left 개념 개요

Como transformar um pipeline DevOps em um pipeline DevSecOps: uma visão geral do conceito Shift Left

Как превратить конвейер DevOps в конвейер DevSecOps: обзор концепции сдвига влево

DevOps Boru Hattını DevSecOps Boru Hattına Dönüştürme: Sola Kaydırma Konseptine Genel Bakış

Cách biến quy trình DevOps thành quy trình DevSecOps: Tổng quan về khái niệm chuyển hướng sang trái

如何将 DevOps 管道转变为 DevSecOps 管道：左移概念概述

Off on a Comet! a Journey through Planetary Space by Jules Verne, is part of the HackerNoon Books Series. You can jump to any chapter in this book . A BOLD PROPOSITION here CHAPTER XVI. A BOLD PROPOSITION On his return Servadac communicated to the count the result of his expedition, and, though perfectly silent on the subject of his personal project, did not conceal the fact that the Spaniards, without the smallest right, had sold Ceuta to the English. Having refused to quit their post, the Englishmen had virtually excluded themselves from any further consideration; they had had their warning, and must now take the consequences of their own incredulity. Although it had proved that not a single creature either at Gourbi Island, Gibraltar, Ceuta, Madalena, or Formentera had received any injury whatever at the time of the first concussion, there was nothing in the least to make it certain that a like immunity from harm would attend the second. The previous escape was doubtless owing to some slight, though unaccountable, modification in the rate of motion; but whether the inhabitants of the earth had fared so fortunately, was a question that had still to be determined. The day following Servadac’s return, he and the count and Lieutenant Procope met by agreement in the cave, formally to discuss what would be the most advisable method of proceeding under their present prospects. Ben Zoof was, as a matter of course, allowed to be present, and Professor Rosette had been asked to attend; but he declined on the plea of taking no interest in the matter. Indeed, the disappearance of his moon had utterly disconcerted him, and the probability that he should soon lose his comet also, plunged him into an excess of grief which he preferred to bear in solitude. Although the barrier of cool reserve was secretly increasing between the captain and the count, they scrupulously concealed any outward token of their inner feelings, and without any personal bias applied their best energies to the discussion of the question which was of such mutual, nay, of such universal interest. Servadac was the first to speak. “In fifty-one days, if Professor Rosette has made no error in his calculations, there is to be a recurrence of collision between this comet and the earth. The inquiry that we have now to make is whether we are prepared for the coming shock. I ask myself, and I ask you, whether it is in our power, by any means, to avert the evil consequences that are only too likely to follow?” Count Timascheff, in a voice that seemed to thrill with solemnity, said: “In such events we are at the disposal of an over-ruling Providence; human precautions cannot sway the Divine will.” “But with the most profound reverence for the will of Providence,” replied the captain, “I beg to submit that it is our duty to devise whatever means we can to escape the threatening mischief. Heaven helps them that help themselves.” “And what means have you to suggest, may I ask?” said the count, with a faint accent of satire. Servadac was forced to acknowledge that nothing tangible had hitherto presented itself to his mind. “I don’t want to intrude,” observed Ben Zoof, “but I don’t understand why such learned gentlemen as you cannot make the comet go where you want it to go.” “You are mistaken, Ben Zoof, about our learning,” said the captain; “even Professor Rosette, with all his learning, has not a shadow of power to prevent the comet and the earth from knocking against each other.” “Then I cannot see what is the use of all this learning,” the orderly replied. “One great use of learning,” said Count Timascheff with a smile, “is to make us know our own ignorance.” While this conversation had been going on, Lieutenant Procope had been sitting in thoughtful silence. Looking up, he now said, “Incident to this expected shock, there may be a variety of dangers. If, gentlemen, you will allow me, I will enumerate them; and we shall, perhaps, by taking them , be in a better position to judge whether we can successfully grapple with them, or in any way mitigate their consequences.” seriatim There was a general attitude of attention. It was surprising how calmly they proceeded to discuss the circumstances that looked so threatening and ominous. “First of all,” resumed the lieutenant, “we will specify the different ways in which the shock may happen.” “And the prime fact to be remembered,” interposed Servadac, “is that the combined velocity of the two bodies will be about 21,000 miles an hour.” “Express speed, and no mistake!” muttered Ben Zoof. “Just so,” assented Procope. “Now, the two bodies may impinge either directly or obliquely. If the impact is sufficiently oblique, Gallia may do precisely what she did before: she may graze the earth; she may, or she may not, carry off a portion of the earth’s atmosphere and substance, and so she may float away again into space; but her orbit would undoubtedly be deranged, and if we survive the shock, we shall have small chance of ever returning to the world of our fellow-creatures.” “Professor Rosette, I suppose,” Ben Zoof remarked, “would pretty soon find out all about that.” “But we will leave this hypothesis,” said the lieutenant; “our own experience has sufficiently shown us its advantages and its disadvantages. We will proceed to consider the infinitely more serious alternative of direct impact; of a shock that would hurl the comet straight on to the earth, to which it would become attached.” “A great wart upon her face!” said Ben Zoof, laughing. The captain held up his finger to his orderly, making him understand that he should hold his tongue. “It is, I presume, to be taken for granted,” continued Lieutenant Procope, “that the mass of the earth is comparatively so large that, in the event of a direct collision, her own motion would not be sensibly retarded, and that she would carry the comet along with her, as part of herself.” “Very little question of that, I should think,” said Servadac. “Well, then,” the lieutenant went on, “what part of this comet of ours will be the part to come into collision with the earth? It may be the equator, where we are; it may be at the exactly opposite point, at our antipodes; or it may be at either pole. In any case, it seems hard to foresee whence there is to come the faintest chance of deliverance.” “Is the case so desperate?” asked Servadac. “I will tell you why it seems so. If the side of the comet on which we are resident impinges on the earth, it stands to reason that we must be crushed to atoms by the violence of the concussion.” “Regular mincemeat!” said Ben Zoof, whom no admonitions could quite reduce to silence. “And if,” said the lieutenant, after a moment’s pause, and the slightest possible frown at the interruption—“and if the collision should occur at our antipodes, the sudden check to the velocity of the comet would be quite equivalent to a shock ; and, another thing, we should run the risk of being suffocated, for all our comet’s atmosphere would be assimilated with the terrestrial atmosphere, and we, supposing we were not dashed to atoms, should be left as it were upon the summit of an enormous mountain (for such to all intents and purposes Gallia would be), 450 miles above the level of the surface of the globe, without a particle of air to breathe.” in situ “But would not our chances of escape be considerably better,” asked Count Timascheff, “in the event of either of the comet’s poles being the point of contact?” “Taking the combined velocity into account,” answered the lieutenant, “I confess that I fear the violence of the shock will be too great to permit our destruction to be averted.” A general silence ensued, which was broken by the lieutenant himself. “Even if none of these contingencies occur in the way we have contemplated, I am driven to the suspicion that we shall be burnt alive.” “Burnt alive!” they all exclaimed in a chorus of horror. “Yes. If the deductions of modern science be true, the speed of the comet, when suddenly checked, will be transmuted into heat, and that heat will be so intense that the temperature of the comet will be raised to some millions of degrees.” No one having anything definite to allege in reply to Lieutenant Procope’s forebodings, they all relapsed into silence. Presently Ben Zoof asked whether it was not possible for the comet to fall into the middle of the Atlantic. Procope shook his head. “Even so, we should only be adding the fate of drowning to the list of our other perils.” “Then, as I understand,” said Captain Servadac, “in whatever way or in whatever place the concussion occurs, we must be either crushed, suffocated, roasted, or drowned. Is that your conclusion, lieutenant?” “I confess I see no other alternative,” answered Procope, calmly. “But isn’t there another thing to be done?” said Ben Zoof. “What do you mean?” his master asked. “Why, to get off the comet before the shock comes.” “How could you get off Gallia?” “That I can’t say,” replied the orderly. “I am not sure that that could not be accomplished,” said the lieutenant. All eyes in a moment were riveted upon him, as, with his head resting on his hands, he was manifestly cogitating a new idea. “Yes, I think it could be accomplished,” he repeated. “The project may appear extravagant, but I do not know why it should be impossible. Ben Zoof has hit the right nail on the head; we must try and leave Gallia before the shock.” “Leave Gallia! How?” said Count Timascheff. The lieutenant did not at once reply. He continued pondering for a time, and at last said, slowly and distinctly, “By making a balloon!” Servadac’s heart sank. “A balloon!” he exclaimed. “Out of the question! Balloons are exploded things. You hardly find them in novels. Balloon, indeed!” “Listen to me,” replied Procope. “Perhaps I can convince you that my idea is not so chimerical as you imagine.” And, knitting his brow, he proceeded to establish the feasibility of his plan. “If we can ascertain the precise moment when the shock is to happen, and can succeed in launching ourselves a sufficient time beforehand into Gallia’s atmosphere, I believe it will transpire that this atmosphere will amalgamate with that of the earth, and that a balloon whirled along by the combined velocity would glide into the mingled atmosphere and remain suspended in mid-air until the shock of the collision is overpast.” Count Timascheff reflected for a minute, and said, “I think, lieutenant, I understand your project. The scheme seems tenable; and I shall be ready to co-operate with you, to the best of my power, in putting it into execution.” “Only, remember,” continued Procope, “there are many chances to one against our success. One instant’s obstruction and stoppage in our passage, and our balloon is burnt to ashes. Still, reluctant as I am to acknowledge it, I confess that I feel our sole hope of safety rests in our getting free from this comet.” “If the chances were ten thousand to one against us,” said Servadac, “I think the attempt ought to be made.” “But have we hydrogen enough to inflate a balloon?” asked the count. “Hot air will be all that we shall require,” the lieutenant answered; “we are only contemplating about an hour’s journey.” “Ah, a fire-balloon! A montgolfier!” cried Servadac. “But what are you going to do for a casing?” “I have thought of that. We must cut it out of the sails of the ; they are both light and strong,” rejoined the lieutenant. Count Timascheff complimented the lieutenant upon his ingenuity, and Ben Zoof could not resist bringing the meeting to a conclusion by a ringing cheer. Dobryna Truly daring was the plan of which Lieutenant Procope had thus become the originator; but the very existence of them all was at stake, and the design must be executed resolutely. For the success of the enterprise it was absolutely necessary to know, almost to a minute, the precise time at which the collision would occur, and Captain Servadac undertook the task, by gentle means or by stern, of extracting the secret from the professor. To Lieutenant Procope himself was entrusted the superintendence of the construction of the montgolfier, and the work was begun at once. It was to be large enough to carry the whole of the twenty-three residents in the volcano, and, in order to provide the means of floating aloft long enough to give time for selecting a proper place for descent, the lieutenant was anxious to make it carry enough hay or straw to maintain combustion for a while, and keep up the necessary supply of heated air. The sails of the , which had all been carefully stowed away in the Hive, were of a texture unusually close, and quite capable of being made airtight by means of a varnish, the ingredients of which were rummaged out of the promiscuous stores of the tartan. The lieutenant himself traced out the pattern and cut out the strips, and all hands were employed in seaming them together. It was hardly the work for little fingers, but Nina persisted in accomplishing her own share of it. The Russians were quite at home at occupation of this sort, and having initiated the Spaniards into its mysteries, the task of joining together the casing was soon complete. Isaac Hakkabut and the professor were the only two members of the community who took no part in this somewhat tedious proceeding. Dobryna A month passed away, but Servadac found no opportunity of getting at the information he had pledged himself to gain. On the sole occasion when he had ventured to broach the subject with the astronomer, he had received for answer that as there was no hurry to get back to the earth, there need be no concern about any dangers of transit. Indeed, as time passed on, the professor seemed to become more and more inaccessible. A pleasant temperature enabled him to live entirely in his observatory, from which intruders were rigidly shut out. But Servadac bided his time. He grew more and more impressed with the importance of finding out the exact moment at which the impact would take place, but was content to wait for a promising opportunity to put any fresh questions on the subject to the too reticent astronomer. Meanwhile, the earth’s disc was daily increasing in magnitude; the comet traveled 50,000,000 leagues during the month, at the close of which it was not more than 78,000,000 leagues from the sun. A thaw had now fairly set in. The breaking up of the frozen ocean was a magnificent spectacle, and “the great voice of the sea,” as the whalers graphically describe it, was heard in all its solemnity. Little streams of water began to trickle down the declivities of the mountain and along the shelving shore, only to be transformed, as the melting of the snow continued, into torrents or cascades. Light vapors gathered on the horizon, and clouds were formed and carried rapidly along by breezes to which the Gallian atmosphere had long been unaccustomed. All these were doubtless but the prelude to atmospheric disturbances of a more startling character; but as indications of returning spring, they were greeted with a welcome which no apprehensions for the future could prevent being glad and hearty. A double disaster was the inevitable consequence of the thaw. Both the schooner and the tartan were entirely destroyed. The basement of the icy pedestal on which the ships had been upheaved was gradually undermined, like the icebergs of the Arctic Ocean, by warm currents of water, and on the night of the 12th the huge block collapsed , so that on the following morning nothing remained of the and the except the fragments scattered on the shore. en masse Dobryna Hansa Although certainly expected, the catastrophe could not fail to cause a sense of general depression. Well-nigh one of their last ties to Mother Earth had been broken; the ships were gone, and they had only a balloon to replace them! To describe Isaac Hakkabut’s rage at the destruction of the tartan would be impossible. His oaths were simply dreadful; his imprecations on the accursed race were full of wrath. He swore that Servadac and his people were responsible for his loss; he vowed that they should be sued and made to pay him damages; he asserted that he had been brought from Gourbi Island only to be plundered; in fact, he became so intolerably abusive, that Servadac threatened to put him into irons unless he conducted himself properly; whereupon the Jew, finding that the captain was in earnest, and would not hesitate to carry the threat into effect, was fain to hold his tongue, and slunk back into his dim hole. By the 14th the balloon was finished, and, carefully sewn and well varnished as it had been, it was really a very substantial structure. It was covered with a network that had been made from the light rigging of the yacht, and the car, composed of wicker-work that had formed partitions in the hold of the , was quite commodious enough to hold the twenty-three passengers it was intended to convey. No thought had been bestowed upon comfort or convenience, as the ascent was to last for so short a time, merely long enough for making the transit from atmosphere to atmosphere. Hansa The necessity was becoming more and more urgent to get at the true hour of the approaching contact, but the professor seemed to grow more obstinate than ever in his resolution to keep his secret. On the 15th the comet crossed the orbit of Mars, at the safe distance of 56,000,000 leagues; but during that night the community thought that their last hour had taken them unawares. The volcano rocked and trembled with the convulsions of internal disturbance, and Servadac and his companions, convinced that the mountain was doomed to some sudden disruption, rushed into the open air. The first object that caught their attention as they emerged upon the open rocks was the unfortunate professor, who was scrambling down the mountain-side, piteously displaying a fragment of his shattered telescope. It was no time for condolence. A new marvel arrested every eye. A fresh satellite, in the gloom of night, was shining conspicuously before them. That satellite was a part of Gallia itself! By the expansive action of the inner heat, Gallia, like Gambart’s comet, had been severed in twain; an enormous fragment had been detached and launched into space! The fragment included Ceuta and Gibraltar, with the two English garrisons! About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Jules Verne (1998). Off on a Comet! a Journey through Planetary Space. Urbana, Illinois: Project Gutenberg. Retrieved October 2022 https://www.gutenberg.org/cache/epub/1353/pg1353-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

A BOLD PROPOSITION

The night passed without incident

It's time to start thinking about the future – and the future is now when it comes to artificial intelligence (AI) in manufacturing. We've seen huge advances in recent years, and I'm here to tell you that the possibilities for the future are almost limitless. AI is allowing manufacturers to increase automation, optimize production, and create more efficient factories. And that's just the beginning. In fact, a recent report by Market and Markets predicts the AI in manufacturing market size to reach $USD 16.3 billion by 2027. In this article, I’ll dig into the main aspects of AI in manufacturing. We'll take a close look at what AI is already doing in the industry and how it could be improved in the future. We'll explore how manufacturing processes can be adapted to fit AI technology and what companies are doing to capitalize on it. Finally, I'll discuss the potential implications this technology could have on society. So, get ready to jump into the exciting world of AI! 1. Automated Quality Assurance When it comes to the future of artificial intelligence in manufacturing, automated quality assurance is a major topic of discussion. Traditionally, manufacturers have used manual quality assurance techniques to “catch” issues before they leave the factory. and oftentimes difficult to keep up with. But as manufacturing processes become increasingly complex, these manual techniques can be laborious and time-consuming, That’s why automated quality assurance is being touted as the future of manufacturing. Through the , automated quality assurance provides a more reliable way to detect minor issues before products leave the factory. use of AI-driven technologies to monitor products continuously throughout the production process and identify any potential problems early on. These automated systems use techniques such as real-time analytics and predictive analytics Automated systems can also be used to detect potential defects in the raw materials used in the manufacturing process. In addition to the speed and efficiency of automated quality assurance, one of its greatest benefits is that it detects issues that would be otherwise to manual inspection. invisible By streamlining processes and proactively optimizing production, AI-driven systems provide a more cost-effective and reliable way to guarantee that customers get the best products. 2. Automated Process Monitoring Process monitoring involves monitoring the manufacturing to ensure integrity, accuracy, and efficiency of the operations. For many years, the manufacturing process has primarily relied on manual monitoring to observe and document quality and performance. But this is no longer tenable with the explosion of big data. Deloitte estimates that manufacturers alone generate about 1,800 petabytes of data every year. Automated process monitoring is replacing the labor-intensive manual procedures with machines that are programmed to accurately monitor production data, automatically recording the data into the system. This technology helps catch any discrepancies in the process quickly and affords manufacturers the tools to track and analyze their operations in real-time. Epirus Systems, wanted to improve manufacturing throughput and material visibility at their factory in Hawthorne, CA. By leveraging the , they were able to improve their factory workflows through automated real-time data collection and visualization, thereby saving 12 hours per month per engineer. ION’s analytics engine by First Resonance Apart from the increased accuracy and efficiency of their manufacturing process, the implementation of automated process monitoring also brought other benefits, such as improved process speed and reduced costs. Overall, automated process monitoring is set to revolutionize the manufacturing industry over the coming years. With its ability to accurately , as well as optimize factory workflows with data visualization, manufacturers can look forward to a more efficient and cost-effective approach to their business operations. document and record data 3. Predictive Maintenance The industrial landscape is ripe for change. With advancements in cutting-edge technologies, many manufacturers are turning to predictive maintenance methods to streamline operations. Predictive maintenance is an attractive alternative to traditional maintenance procedures. Whereas traditional methods require machines to be physically inspected on a regular basis to identify problems, predictive maintenance relies on data and analytics to provide manufacturers with information on when maintenance is needed. This is made possible by the use of monitored sensors, machine learning programs, and real-time data collection tools. By capturing data related to the performance of machines, predictive maintenance systems can and forecast when preventive maintenance needs to be carried out. detect anomalies It helps to reduce downtime, which in turn lowers overall costs. Automation tools also eliminate human error, making maintenance procedures more reliable. While the advantages of predictive maintenance are clear from a business standpoint, there may be wider implications. As predictive maintenance methods become more widespread, it could bring about changes not only in manufacturing but also in terms of employment opportunities. In an era where automation is a regular occurrence, predictive maintenance could eventually lead to job displacement. That said, this also could open up opportunities in different sectors such as data analysis and software engineering. 4. Automated Scheduling Manual scheduling used to be a laborious task for factories. However, automated scheduling systems allow manufacturing managers to save time and energy while still ensuring their production lines are running efficiently. and with the right resources – all while ensuring a cohesive workflow. Manual scheduling involves creating a task list, assigning resources, and ensuring tasks are completed on time Automating this process with a computer program streamlines the task and eliminates any possibility of human error. Automatic scheduling systems use algorithms to , assign tasks to machines and personnel, and rearrange tasks if there are any snags in the production process. predict completion times This ensures that things run on schedule more quickly and efficiently. The result is a production line that is more dynamic and agile, and can better meet any fluctuations in demand. Say YES to increased productivity, improved safety, and reduced costs. This is the foundation of — efficient production that not only saves time and energy, but also provides a secure, reliable machine that is capable of augmenting human labor. the future of manufacturing Automated scheduling systems transform manual processes into a streamlined operation, and this is key to survival in the competitive global market. 5. Improved Supply Chain Optimization It's no secret that many factories suffer from supply chain problems due to non-optimized routes or delays or supply quality issues. At its core, supply chain automation works by data collection and analysis. Data is collected from machines and by analyzing this data, AI can provide insights into the overall efficiency and performance of the supply chain. The most obvious benefit to AI-driven supply chain optimization is a reduction in costs. It can make processes faster and more efficient, thus eliminating the need for human labor. Additionally, AI-driven supply chains can reduce the risk of errors that can otherwise lead to costly delays. For an example of this in action, one need look no further than Hitachi. where they use sensors and data analysis to identify production delays and areas for improvement. The company has implemented an AI-driven supply chain solution in their factories, The result is a noticeably more efficient process, which translates into reduced costs and higher profits. Not only does automation reduce costs and improve efficiency, but it also helps companies stay ahead in an market. Those companies that do not invest in AI and automation will be knocked out, steam-rolled, and kicked into oblivion. ever-changing Conclusion We've seen the tremendous potential of Artificial Intelligence and automation when it comes to manufacturing. From improved to greater accuracy and precision in manufacturing processes, AI has already had a powerful impact. efficiency and cost savings However, the journey is far from over. Deloitte conducted a survey and established that look to AI as the pivotal technology for driving growth and innovation in factories. 93% of manufacturers AI-powered automation will continue to revolutionize the manufacturing industry, but there are still three major problems that need to be solved. From recognizing and preventing worker displacement, to ensuring safe and secure digital systems, we need to devise ways to make sure that AI and automation are used ethically and responsibly. As we move towards a future where AI and automation play an increasingly larger role in the manufacturing industry, we need to ensure that these solutions are created and implemented with the wellbeing of workers and our planet in mind. Let's take the initiative and continue to work towards achieving a sustainable and ethical future in manufacturing. What do you think is the future of AI & Automation in manufacturing? Please share your thoughts in the comments below.

AI, Automation & the Future of Manufacturing: 3 Problems to Solve?

Organizations now recognize the significant role of integrating security in the software development lifecycle. DevSecOps is a powerful approach that has emerged to achieve this goal. By incorporating security practices at the earliest stages of development, DevSecOps helps organizations identify and reduce vulnerabilities more effectively, minimize the risk of security breaches, and build more secure applications. This article will discuss the fundamental principles of DevSecOps and provide key steps for securing your organization’s CI/CD Pipeline. DevSecOps Principles : Organizational principles It is important to involve Security teams right from the beginning of a project to make sure that security requirements are given serious thought and attention early on. This step can prevent the discovery of security problems later in the development phase, which could be more expensive and time-consuming to fix. Involve Security Teams Early: In DevSecOps, it is important for Development, Security, and Operations teams to work together. By promoting a culture of shared responsibility for security, organizations can ensure that all team members play a part in creating secure applications and in identifying and solving security issues faster. Collaboration and Transparency: DevSecOps incorporates security practices early in the development process, also known as "shifting left." It helps organizations to detect vulnerabilities in the codebase before they escalate into expensive and time-consuming issues. Shift-Left: DevSecOps advocates for the inclusion of security procedures throughout the entire software development process, ensuring continuous security. This involves implementing automated security testing, constant monitoring, and regular security evaluations. Continuous Security: The concept of security chaos engineering involves deliberately introducing security-related problems and disruptions into a system to verify its ability to withstand them and reveal weaknesses. Security Chaos Engineering: By replicating actual security incidents, organizations can obtain significant insights into their system's performance during challenging conditions. This enables them to take proactive measures to address vulnerabilities and enhance their overall security position. Security Awareness/Training principles: To make security a top priority of your organization, provide your team members with security training and resources, encourage collaboration, and recognize that everyone is responsible for security. By doing this, you can cultivate a culture that prioritizes and integrates security throughout your organization. Foster a Security Culture: Developers should be encouraged to adopt secure coding practices like input validation, output encoding, and proper error handling. These practices will help mitigate security vulnerabilities in the code and reduce the risk of potential attacks. Adopt Secure Coding Practices: Gamification techniques can be adopted by organizations to encourage a security-focused culture and educate team members on security best practices. Gamification of Security Training: By transforming security training into an enjoyable and competitive experience, engagement and knowledge retention can be enhanced, ultimately promoting better security practices throughout the organization. Technical principles: Automating security processes can bring various benefits to organizations. These include increased efficiency, reduced human error, and the consistent application of security best practices. Automation: To maintain security during the development process, it is important to regularly run security checks and tests within the continuous integration and continuous deployment pipeline. This will ensure that security concerns are constantly evaluated and addressed. Integrate Security into the CI/CD Pipeline: Use tools like static application security testing (SAST) and dynamic application security testing (DAST) to check for weaknesses and potential security threats in your codebase. These automated security testing tools should be added to your organization's CI/CD pipeline to provide real-time security feedback. Implement Automated Security Testing: Securing the CI/CD Pipeline: Key Steps and Solutions To secure your CI/CD pipeline, protecting the Build environment is the first essential step. Only authorized personnel should access Build servers and infrastructure. To prevent unauthorized access, implement robust authentication methods, such as multi-factor authentication (MFA) with hardware keys. Additionally, keep the Build environment up to date with the latest security patches, and configure it according to the best industry practices. Secure the Build Environment: To safeguard your code repository, implement robust access controls that permit only the necessary access to authorized personnel, and monitor it frequently to identify any suspicious activities. Also, keep reviewing and updating user permissions and use encryption to protect sensitive data stored in the repository. Secure Code Repository: Hardcoded credentials, such as passwords or secret keys within the code, is a serious security risk as they can provide unauthorized access if the code is exposed. Hardcoded Credentials Scanner Solutions: Open-source solutions: TruffleHog - https://github.com/trufflesecurity/trufflehog - GitLeaks https://github.com/gitleaks/gitleaks - GitSecrets https://github.com/awslabs/git-secrets Enterprise solutions: GitGuardian - https://www.gitguardian.com/ SpectralOps - https://spectralops.io/ Bridgecrew - https://bridgecrew.io/secrets-scanning/ To automatically detect any potential security weaknesses in your code during the build process, integrate SAST tools into the CI pipeline. These tools can help you find problems such as insecure coding practices, input validation errors, and potential code injection vulnerabilities. Static Application Security Testing (SAST): Open-source solutions: SonarQube - https://www.sonarsource.com/products/sonarqube/ Semgrep CLI - https://github.com/returntocorp/semgrep Enterprise solutions: Veracode - https://www.veracode.com/products/binary-static-analysis-sast Checkmarx - https://checkmarx.com/cxsast-source-code-scanning/ - Coverity https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html To ensure the security of your application, you can use SCA tools to track third-party libraries and open-source components that you use. SCA tools can check for potential security risks such as outdated components, known vulnerabilities, and licensing issues. Software Composition Analysis (SCA): Open-source solutions: OWASP Dependency-Check - https://owasp.org/www-project-dependency-check/ - Nancy (GoLang) https://gonancy.dev/ - RetireJS (JavaScript) https://retirejs.github.io/retire.js/ - Safety (Python) https://github.com/pyupio/safety Enterprise solutions: - Black Duck Hub https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html Mend - https://www.mend.io/sca/ Snyk - https://snyk.io/ In case your software uses containers, make sure to follow container security best practices, which include implementing minimal base images, scanning for vulnerabilities, and enforcing strict access controls. Additionally, it would be best if you used specialized container security tools, like container vulnerability scanners and runtime security monitoring solutions. Container Security: Open-source solutions: Trivy - https://github.com/aquasecurity/trivy - Grype https://github.com/anchore/grype - Clair https://github.com/quay/clair Enterprise solutions: Aqua Security - https://www.aquasec.com/products/software-supply-chain-security/ Sysdig Secure - https://sysdig.com/products/secure/ Snyk - https://snyk.io/product/container-vulnerability-management/ Incorporate security checks into your use of IAC tools like Terraform, CloudFormation, or Ansible. This is to ensure that the configuration of your infrastructure is indeed secure and free from potential security misconfiguration. Infrastructure as Code (IaC) Security: Open-source solutions: Checkov - https://github.com/bridgecrewio/checkov Tfsec - https://github.com/aquasecurity/tfsec KICS - https://kics.io/ Enterprise solutions: Bridgecrew - https://bridgecrew.io/infrastructure-as-code-security/ Prisma Cloud - https://www.paloaltonetworks.com/prisma/cloud/infrastructure-as-code-security - Snyk https://snyk.io/product/infrastructure-as-code-security/ To test your application in a real-time environment, add DAST tools to your CI/CD pipeline. These tools can uncover vulnerabilities that may only become visible when the application is executing, such as configuration issues, authentication problems, and access control concerns. Automated DAST tools should be used for thorough security testing. Dynamic Application Security Testing (DAST): Open-source solutions: OWASP Zed Attack Proxy (ZAP) - https://www.zaproxy.org/ - Nikto https://github.com/sullo/nikto - GoLismero https://github.com/golismero/golismero Enterprise solutions: Fortify WebInspect - https://www.microfocus.com/en-us/cyberres/application-security/webinspect Rapid7 InsightAppSec - https://www.rapid7.com/products/insightappsec/ - Checkmarx https://checkmarx.com/checkmarx-dast/ To enhance the security of your application and infrastructure, it is essential to continuously track and analyze their behavior. This can be achieved by implementing solutions for constant monitoring and logging. By doing so, you can quickly identify and respond to any potential security incidents that might occur. Continuous Monitoring and Logging: To facilitate this process, tools like SIEM (Security Information and Event Management) systems, intrusion detection systems, and log analyzers can be used to detect and alert you on security events. Open-source solution: ELK Stack (Elasticsearch, Logstash, and Kibana) - https://www.elastic.co/ Enterprise solutions: Splunk - https://www.splunk.com/en_us/products/enterprise-security.html Datadog - https://www.datadoghq.com/ To maintain the security and adherence of your CI/CD pipeline to industry standards and regulations, it is essential to conduct regular security audits and assessments. This includes examining the code, testing for potential vulnerabilities, and assessing the infrastructure. By implementing these measures, you can ensure that your pipeline is secure and compliant. Regular Security Audits and Assessments: Open-source solutions: OpenVAS - https://github.com/greenbone/ - BurpSuite Community https://portswigger.net/burp/communitydownload Enterprise solutions: Tenable Nessus - https://www.tenable.com/products/nessus QualysGuard - https://www.qualys.com/cloud-platform/ - BurpSuite Professional https://portswigger.net/burp/pro To be well-prepared for any security breach or incident, it is essential to create a clear incident response plan that lists the necessary steps to take. To ensure the safety of your application, your CI/CD pipeline must have the ability to roll back any deployments, patch any vulnerabilities, and immediately redeploy secure versions of your application. Incident Response Planning: Open-source solution: TheHive Project - https://thehive-project.org/ Enterprise solutions: IBM Resilient - https://www.ibm.com/products/qradar-soar Cortex XSOAR - https://www.paloaltonetworks.com/cortex/cortex-xsoar - D3Security SOAR https://d3security.com/enterprise-soar/ is a beneficial tool for DevSecOps teams. It's an open-source vulnerability management tool created by the OWASP community. Vulnerability Management and Reporting: DefectDojo This tool helps manage security vulnerabilities in the development process. One central space for all the information regarding defects is provided by DefectDojo. It makes it easier for teams to generate detailed reports and keep track of their progress over time. DefectDojo promotes clear communication about vulnerabilities, which ensures that security issues are resolved efficiently and promptly. As you can see, it is crucial to secure the CI/CD pipeline to implement a successful DevSecOps process. To achieve this, organizations need to incorporate security checks and tools throughout the pipeline. By doing so, they can identify vulnerabilities in advance and address them before they can cause security breaches. This helps to ensure that their applications are secure and comply with regulations. With the steps and practices outlined in this article, you can establish a robust and secure CI/CD pipeline for delivering software quickly and safely.

Tenable

tenable.com

1617 employees

Since 2002

COMPANY RANKING

Tenable

EVERGREEN INDEX #2572

See more notable links about Tenable

Apply to get your Tech Company News Page live on HackerNoon.com today!

Read More Tech Stories Related to #Tenable

Tenable

Tenable

tenable.com

1617 employees

Since 2002

COMPANY RANKING

Tenable

EVERGREEN INDEX #2572

Related CompaniesRank

Tenable Story MentionsComplete List

See more notable links about Tenable

Apply to get your Tech Company News Page live on HackerNoon.com today!

Read More Tech Stories Related to #Tenable

Tenable