Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

3/23/2017
11:00 AM
Connect Directly
Twitter
RSS
E-Mail

7 Steps to Transforming Yourself into a DevSecOps Rockstar

Security practitioners at one education software firm offer lessons learned from merging DevOps with security.
2 of 8

Aim For Improvement, Not Perfection

So much of the DevOps ethos centers around making gradual improvements to software through small, frequent code deployments. Unfortunately, many longtime security professionals have a hard time getting into this mindset and pile on security requirements for software without prioritizing them based on risk.

'Don't let perfect be the enemy of good!' says Marshall. 'There will always be more that you want to do but you have to determine what your minimal viable product (MVP) is and release it so you can gather feedback. This is an iterative process and you have to keep that in mind.'

Image Source: Adobe Stock

Aim For Improvement, Not Perfection

So much of the DevOps ethos centers around making gradual improvements to software through small, frequent code deployments. Unfortunately, many longtime security professionals have a hard time getting into this mindset and pile on security requirements for software without prioritizing them based on risk.

"Dont let perfect be the enemy of good!" says Marshall. "There will always be more that you want to do but you have to determine what your minimal viable product (MVP) is and release it so you can gather feedback. This is an iterative process and you have to keep that in mind."

Image Source: Adobe Stock

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
sestes
50%
50%
sestes,
User Rank: Apprentice
7/25/2017 | 8:10:02 AM
Fabulous article
This should be required reading for every aspiring DevOps student. The last slide sums it up: use common sense.
Nathan Cane
50%
50%
Nathan Cane,
User Rank: Apprentice
4/3/2017 | 4:51:22 AM
Re: madden mobile hack tool
Very interesting, I want to try that !!!
Nathan Cane
50%
50%
Nathan Cane,
User Rank: Apprentice
4/3/2017 | 4:50:13 AM
Re: madden mobile hack tool
Very intersting !!!
mikemike01
100%
0%
mikemike01,
User Rank: Apprentice
3/30/2017 | 2:44:18 AM
madden mobile hack tool
Thanks for this its getting me on my way to being a star pen tester!!!
mikemike01
100%
0%
mikemike01,
User Rank: Apprentice
3/30/2017 | 2:42:54 AM
madden mobile hack tool
Thanks this is getting me on my way to being a star pen tester!
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16770
PUBLISHED: 2019-12-05
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
CVE-2019-19609
PUBLISHED: 2019-12-05
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
CVE-2019-16768
PUBLISHED: 2019-12-05
Exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation m...
CVE-2012-1105
PUBLISHED: 2019-12-05
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
CVE-2019-16769
PUBLISHED: 2019-12-05
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash...