Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

DevOps

Sidecar Containers in Kubernetes: A Personal Journey

I had always wanted to use sidecars with Istio or Splunk forwarder in production, but as a Kubernetes maintainer, I knew there was no reliable way of telling Kubernetes to ensure sidecar containers were kept running before and after the main application. In this post I will share the twists and turns of my adventure in addressing this long-standing Kubernetes challenge.

Taking Power Platform Security and Governance from 0 to 60: Part 3

Welcome back to the final part of my blog series on taking Power Platform security and governance to the next level. In Part 2 (which you can read here), I dove into essential strategies for securing and governing Power Platform environments. Today, I’ll encourage everyone to push the envelope further by exploring advanced techniques to establish good hygiene for citizen development, maintain audit logs, implement automation playbooks, and provide ongoing education for builders and makers.

Top 10 CI/CD Security Tools

On the one hand, your sales department is pushing for new features at an alarming rate, forcing you into faster deployment processes. On the other hand, you have the looming threat of millions of dollars in damages if your security is breached. Software development is all about finding the middle ground – if you can’t compromise on either side, what should you do?

Hands-on guide to Runtime Security for CI/CD Pipelines with StepSecurity

In this webinar, we are joined by Varun Sharma and Ashish Kurmi, founders of StepSecurity. StepSecurity is a pioneer in runtime security for CI/CD pipelines. Given that CI/CD is a high-privileged environment that builds release artifacts and has admin cloud credentials, there has been an increase in attacks on CI/CD pipelines. The importance of CI/CD Security has been underlined by recent guidance from the Cybersecurity & Infrastructure Security Agency (CISA) and the National Security Agency (NSA)

The never-ending story: Microsoft AI team accidentally exposed 38 Terabytes of internal data

The accidental sharing of cloud access is an all-too-familiar story. In one latest incident, Microsoft’s AI research team accidentally exposed to the public 38 Terabytes of private data including internal messages, private keys, and passwords, according to a recent report . And all it took to cause this gigantic exposure was a few errant clicks in a configuration menu.

Mend Renovate Enterprise Edition Demo

Reduce Technical Debt with Scalable Automated Dependency Management Regularly maintaining and updating dependencies is crucial to ensuring application security, but in today’s high-volume development world, companies often struggle to balance security risk with development deadlines. Renovate Enterprise Edition helps teams cut technical debt while still meeting deadlines using a solution built for the needs of enterprise development teams. Now, companies can provision as many resources as they like to cover the size and scale of their entire organization without suffering performance problems due to resource limitations.

Mend.io's Rhys Arkins, VP Product Discussing Mend Renovate Enterprise Edition

Reduce Technical Debt with Scalable Automated Dependency Management Regularly maintaining and updating dependencies is crucial to ensuring application security, but in today’s high-volume development world, companies often struggle to balance security risk with development deadlines. Renovate Enterprise Edition helps teams cut technical debt while still meeting deadlines using a solution built for the needs of enterprise development teams. Now, companies can provision as many resources as they like to cover the size and scale of their entire organization without suffering performance problems due to resource limitations.

Mend Renovate Product Family Demo

Mend Renovate scans your software, discovers dependencies, automatically checks to see if an updated version exists, and submits automated pull requests. Mend.io provides Renovate as an open source solution as part of our support for the developer community. For those customers that need a fully scalable, fully supported, fully automated solution, we offer Renovate Enterprise Edition.

Holistic AppSec and Software Supply Chain Security

AppSec and software supply chain security require more than a loose collection of tools and a vulnerability remediation process. A holistic approach covers risk assessment, a secure software development life cycle, software composition analysis (SCA), SBOMs, static and dynamic application security testing (SAST/DAST), workflow automation, automated remediation, runtime protections, compliance reporting and more. Successful implementation of this holistic approach enables companies to shrink their overall attack surface and reduce technical and security debt.

swampUP 2023: Shielding the Foundation: Security Across Your SSC

Developers are now the target of the attacker, with binaries available publicly. While it's unlikely that the concept of security point solutions will completely disappear, it’s clear that the market is demanding a consolidated, comprehensive approach to pipeline security across the attack surface. With the increasing complexity of software supply chains, security and governance are becoming critical on developer’s machines, at the C-level and in boardrooms.