DZone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
Refcards Trend Reports Events Over 2 million developers have joined DZone. Join Today! Thanks for visiting DZone today,
Edit Profile Manage Email Subscriptions Moderation Admin Console How to Post to DZone Article Submission Guidelines
View Profile
Sign Out
Refcards
Trend Reports
Events
Zones
Culture and Methodologies Agile Career Development Methodologies Team Management
Data Engineering AI/ML Big Data Data Databases IoT
Software Design and Architecture Cloud Architecture Containers Integration Microservices Performance Security
Coding Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Partner Zones AWS Cloud
by AWS Developer Relations
Culture and Methodologies
Agile Career Development Methodologies Team Management
Data Engineering
AI/ML Big Data Data Databases IoT
Software Design and Architecture
Cloud Architecture Containers Integration Microservices Performance Security
Coding
Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance
Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Partner Zones
AWS Cloud
by AWS Developer Relations

Trending

  • The SPACE Framework for Developer Productivity
  • Effortlessly Streamlining Test-Driven Development and CI Testing for Kafka Developers
  • Apache Kafka vs. Message Queue: Trade-Offs, Integration, Migration
  • A Complete Guide to AWS File Handling and How It Is Revolutionizing Cloud Storage
  1. DZone
  2. Data Engineering
  3. Data
  4. How To Create A Continuous Security Blanket

How To Create A Continuous Security Blanket

Is a continuous security delivery fabric, as well as DevSecOps, the answer to IT security issues? Read on to see what one CTO had to say.

Tom Smith user avatar by
Tom Smith
CORE ·
Jul. 04, 17 · Opinion
Like (3)
Save
Tweet
Share
2.23K Views

Join the DZone community and get the full member experience.

Join For Free

Great talking with Mike Kail, CTO of Cybric about the current state of IT security given a recent report from Cisco found 65 percent of organizations use anywhere from six to more than 50 security products.

What do you see as the most important elements of application and data security?

Move security far left in the SDLC so you catch vulnerabilities sooner rather than later when it’s faster and cheaper to fix them, and so you don’t get behind schedule. We’re big believers in DevSecOps.

What programming languages and frameworks does your firm use?

We provide a continuous security delivery fabric with language coverage based on open-source and commercial tools. It’s a very well-documented and thorough approach to security.

How is the cybersecurity threat landscape changing?

Cloud, mobile, IoT and the ubiquity of bandwidth has led to an infinite number of attack vectors. Internet connectivity is intertwined into everyone’s life from a Wall Street trader to a Midwestern farmer and home-based business trying to provide for their family.

What kind of security techniques and tools do you find most effective?

An automated and orchestrated approach that helps to level the playing field versus hackers by taking the best of breed tools to provide automatic scanning and autonomous remediation. You can have a lot of tools and pockets of domain expertise; however, these will not scale as the amount of data grows.

What are some real-world problems you have helped your clients solve?

We were working with one client who was migrating their data center from on-premises to the cloud. They thought they had 35 instances when they had more than 300. We provided 360-degree visibility into where all their data resided.

For another client, we analyzed their application stack and found 900 vulnerabilities. We identified the five most important, by correlating with threat databases, and remediated them immediately. We then helped the client segment the other 895 by the level of importance and helped them solve the cultural challenge of DevSecOps.

What are the most common issues you see affecting security?

Poor hygiene keeping systems up to date regarding patches. What I like to call “cybersecurity fitness.” Look at the OWASP Top 10. SQL injections and cross-eyed scripting continue to be the leading vulnerabilities for 10-plus years. We strive to provide developers with better remediation advice and reduce the friction in development velocity.

Do you have any concerns regarding the current state of security?

My greatest concern is our country’s infrastructure keeping up with technology. Cloud, mobile, and IoT technologies are building on top of a shaky foundation. We need to be diligent about security and everyone needs to take responsibility for security and assurance.

What’s the future for security from your point of view?

We’re in an application-centric economy focused on the architecture of tools to catch defects earlier. Start at the foundation of the application. Be proactive and take an offensive approach to security. Make sure you have version controls so you can roll back to an earlier version if necessary. Have an all-encompassing security strategy versus many tactics.

What do developers need to keep in mind with regards to security?

We attempt to educate developers with relevant remediation advice. Developers need to understand that security is an important part of the process without adding friction so that they can maintain velocity. Developers should collaborate with CISOs and security team members from the beginning and establish a security strategy that’s consistent with the corporate culture.

What have I failed to ask you that we need to consider with regards to security today?

A lot of people see security with “fear, uncertainty, and doubt.” We espouse the philosophy of confidence, assurance, visibility, resilience. We focus on the positive rather than the negative.

security Data (computing)

Opinions expressed by DZone contributors are their own.

Trending

  • The SPACE Framework for Developer Productivity
  • Effortlessly Streamlining Test-Driven Development and CI Testing for Kafka Developers
  • Apache Kafka vs. Message Queue: Trade-Offs, Integration, Migration
  • A Complete Guide to AWS File Handling and How It Is Revolutionizing Cloud Storage

Comments

Partner Resources

X

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • Become a Contributor
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 600 Park Offices Drive
  • Suite 300
  • Durham, NC 27709
  • support@dzone.com

Let's be friends: