Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
DevOps & Security: Butting Heads for Years but Integration is Happening
Newest First  |  Oldest First  |  Threaded View
atrisk
atrisk,
 User Rank: Strategist
7/24/2017 | 4:10:53 PM
Re: 2 responses
My initial post was meant to highlight the problem and not use the post to self-promote. I hope that was clear. That said, the author's comment is exactly the line that my team and I follow. While it is the most appropriate course of action, when dealing with large organizations, it's pretty tough to get the attention of a CIO responsible for so much.

Stil, if you are trying to shake the tree, the top down approach is the best path to follow.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
7/22/2017 | 3:05:24 PM
Re: 2 responses
@zkerravala: Moreover, in addition from these initiatives having to come from the top down, they have to have unity from the top down as well -- demonstrating the CIO and other C-suiters/top execs publicly "shaking hands" and agreeing to work together on them. This will help unite goals and methodologies while increasing collaboration.
zkerravala
zkerravala,
 User Rank: Author
7/21/2017 | 10:22:33 AM
Re: 2 responses
Thanks for your feedback.  I agree with the "good luck" statement as I often feel that infrastructure and DevOps do not want to work together.  This is why this needs to be driven top down from the CIO and the goals of the groups need to be aligned
shirleysetiasinger
shirleysetiasinger,
 User Rank: Apprentice
7/21/2017 | 8:07:27 AM
Re: 2 responses
I was able to find good advice from your blog posts. 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
7/20/2017 | 4:02:29 PM
2 responses
Considering the friction and finger-pointing that already exists in organizations among DevOps itself (i.e., between front-end and back-end developers), when you suggest getting security involved from the outset, I say two things:

(1) "Hear, hear!"

and

(2) "Good luck."
Lacework
Lacework,
 User Rank: Apprentice
7/20/2017 | 12:15:00 PM
Re: security adoption
Well said. 
atrisk
atrisk,
 User Rank: Strategist
7/20/2017 | 11:59:08 AM
security adoption
This post accurately portrays the friction that has existed between two critical company teams. Top line stakeholders who are responsible for compliance, brand integrity and sometimes revenue have a clear interest in seeing the two work together. Application security has been a daunting task as it typically requires the diverting of precious resources to integrate solutions that actually work but do not affect user experience. Solid solutions do exist, but only a few deliver on the promise of easy deployment without integration.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file