DevSecOps refers to the integration of security controls across the whole software development lifecycle. It is first and foremost an organizational culture, enabled by processes and tools, where development teams share the responsibility for delivering secure software with the security team. This differs from organizations where development and security responsibilities are completely siloed in distinct teams.
As software developers and associated business analysts are shifting more and more towards satisfying customer needs by providing them with a better quality product, they are consequently moving towards an agile mindset. Firms are changing the way they function to allow customer needs to be integrated not only into the final product and stages of sales but also all throughout the process of development of a product.
The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling to avert potential software supply chain security threats, and reports any vulnerabilities or malicious packages discovered to repository maintainers and the wider community. Most recently we disclosed 25 malicious packages in the npm repository that were picked up by our automated scanning tools.
You’re a cloud-based company, your entire business model relies on cloud data and your cloud environment is VERY precious to you, correct? That’s why you invest all of your resources into protecting this environment from the outside world. You want to make sure that the perimeter between your cloud data and the outside world is 100% safe, I get it. But what if I told you that your goal is to protect your crown jewels, a.k.a - the data itself?
You don’t have to look far for proof that cybercrime is soaring to new heights. Early in the pandemic the U.N. reported cybercrime had increased 600% and other experts estimate damages from global cybercrime to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015. Last year alone, we started 2021 in the fog of the SolarWinds attack and finished with the infamous Log4j vulnerabilities, the full impact of which will take years to understand.
As technology continues to evolve rapidly, so do the techniques used by adversaries. This may be considered a given, but it is important to appreciate how attackers may leverage existing and commonly used applications within an environment to attempt to seize control and achieve their objectives.
Many businesses are starting to investigate proactive vs reactive cybersecurity methods. Reactive cybersecurity strategies have been effective in the past when dealing with incidents and remain relatively effective where known threats are concerned. The problem is that cyber criminals are now aware that businesses are already prepared for known threats and are actively improving and evolving their cyber-attack methods to evade detection.
With constant pressure on web application and software development teams to churn out code for new website tools/features, it makes sense to leverage code depositories and JavaScript libraries to expedite the development process. In fact, code depositories, like GitHub, are so important to the web development process, that the vast majority of organizational websites use them. But code depositories and libraries—whether their internal or external—can hide a danger known as shadow code.
Do cloud environments really have to be so foggy? Absolutely not. Yet, many enterprises have come to accept that not having full visibility into their cloud estate is just “how it is.”
