DevOps 成为安全领域重大创变力量的三个原因
关于 DevOps 变革如何让网络安全面临更大挑战的问题，我们看到诸多文章对此进行了探讨。其中一个重要原因是：如今的 DevOps sprint 和 scrum 流程大都缺少安全团队的参与。在这个以打破孤岛和促进协作为特点的技术中，由于上述安全方面的缺失，导致亟待解决的重大 Cyber Exposure 缺口。因此，网络安全一经发布就忙不迭地确定和保护资产与应用程序，就像一场永无休止的打地鼠游戏。当然有更好的方法。
获取容器安全最佳实践：操作方法指南
幸运的是，我们找到了。实际上答案就是更广泛地运用 DevOps，特别是鼓励网络安全团队在其自身的流程和工作流中接纳 DevOps 原则。以下是集成以上两种实践能够形成安全重大创变力量的三个原因。
1) 内置安全
安全测试需要与开发人员一起共存，也就是 DevOps 管道。使安全流程适应开发人员至关重要，除此以外别无他法。如此可确保在开发过程中事先考虑安全性，开发人员也无需因质保测试而抛下持续集成/持续部署 (CI/CD) 系统。将安全性构建至 DevOps，对于实现网络安全有效性具有莫大的帮助。
2) 自动化
网络安全必须尽可能采用自动化测试和审计程序。各组织每天都发布数十个乃至数百个软件更新。依赖于手动流程无法让安全性保持最新状态。相反，应该在每次构建变更或发现新漏洞时，应自动触发安全测试。持续软件交付需要持续安全控制。
3) 主动防御
如果可以选择，网络安全负责人宁愿花时间实施价值更高的安全程序，以支持合规并改善风险管理，而不是慌慌张张地打地鼠。在开发过程中主动确定并修复漏洞，比起延后到生产流程，可节省大量时间和金钱（据估计，超过 85%！）。安全性议题其实应验了一句老话：预防为主，治疗为辅。
如果降低安全成本、消除盲点和加快 DevOps 发展是您 2018 年的目标之一，请查看 IDG 白皮书，3 个原因：DevOps 成为安全领域重大创变力量的原因。您将找到可以采取的措施，以促进形成更具合作性和主动性的方法，来保障贵组织的安全并减少 Cyber Exposure 缺口。是时候将安全性从业务阻碍因素重塑为数字业务推手了。
相关文章
AWS Access Analyzer Just Got Better, So Did Tenable Cloud Security
November 27, 2023AWS IAM Access Analyzer now has an API allowing you to make custom policy checks. Tenable Cloud Security allows you to easily use this API as part of its code scanning functionality. Find out how and ...
Cybersecurity Snapshot: CISOs Are Happier, but Dev Teams Still Lack Secure Coding Skills
January 20, 2023Learn all about the spike in CISO job satisfaction. Plus, NIST mulls major makeover of its Cybersecurity Framework. Also, the struggle to develop secure apps is real. Then check out how Uncle Sam plans to use AI and ML to boost cybersecurity. And much more!
What Happens When the Metaverse Enters Your Attack Surface?
December 12, 2022Tenable polled 1,500 cybersecurity, IT and DevOps professionals about their top concerns in the nascent virtual reality worlds of the metaverse. Here's what we found out.
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Enhancing Transportation Cybersecurity and Fleet Management for the DoD
March 25, 2024Few things can halt operations across the Department of Defense like a critical failure of logistics and transportation. From automated asset inventory to malicious-activity detections through baselining, learn how Tenable OT Security can protect these critical functions within the DoD and work towards the federal government’s zero trust mandate in OT environments.
Cybersecurity Snapshot: NSA Picks Top Cloud Security Practices, while CNCF Looks at How Cloud Native Can Facilitate AI Adoption
March 22, 2024Check out the NSA’s 10 key best practices for securing cloud environments. Plus, learn how cloud native computing could help streamline your AI deployments. Meanwhile, don’t miss the latest about cyberthreats against water treatment plants and critical infrastructure in general. And much more!
- DevOps