New ThreadFix Release Provides Application Security at DevOps Speed
April 18, 2017

Denim Group announced the release of the latest version of ThreadFix, the company’s application vulnerability resolution platform for developers and security professionals.

ThreadFix 2.5 automates application security in the DevOps Continuous Integration/Continuous Delivery (CI/CD) pipeline, enabling applications to be delivered more rapidly without sacrificing security. The upgrades in this release make it possible for security teams to centrally enforce pre-defined application security policies, and development teams to automatically orchestrate application testing resulting in seamless incorporation of security testing into the CI/CD pipeline.

Businesses and development teams are driven to embrace DevOps so they can be more agile, deploy code more quickly, and provide more value to their customers. To that end, it is incredibly important for DevOps teams to have up-to-the-minute feedback on the status of their development efforts so they know if a build is ready for production. The feedback cycle should include testing quality, performance, and security. By incorporating application security testing into the DevOps CI/CD pipeline, security vulnerabilities are found quickly and reported to developers in the issue and project tracking tools they’re already using, ultimately removing friction from the remediation process and keeping costs down.

“It’s our goal to take the pressure off DevOps teams,” said Dan Cornell, CTO, Denim Group. “Regardless of the timeline to which they are held, ThreadFix allows them to have a clear path towards securing their new releases. No other platform ingests existing application security testing tools that are prevalent in enterprises and makes them accessible to software development teams to ensure that application security is a part of every build.”

ThreadFix 2.5 provides the ability for development teams to take advantage of application security testing tools in their CI/CD pipelines by orchestrating both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools, automatically making pass/fail decisions for builds based on the results of application security testing and creating software defects in defect tracking systems. This allows for development teams to easily access and control application security testing capabilities through existing tools and platforms to run their CI/CD pipelines resulting in vulnerabilities being found earlier in the application security process.

As executives drive enterprises to adopt DevOps to support innovation and keep pace with customer and stakeholder requirements, the need for security to be included in the DevOps process is at an all-time high. ThreadFix 2.5 provides enhanced integrations based on the ongoing feedback from enterprises deploying and extending their ThreadFix installations. These enhanced integrations include HPE Fortify on Demand and HPE Fortify Software Security Center (SSC).

The Latest

June 23, 2017

Why Agile? DEVOPSdigest asked the experts for their opinions on what are the most important advantages of being Agile. Part 3 covers how Agile enables you to grow and adapt to change ...

June 21, 2017

Why Agile? DEVOPSdigest asked the experts for their opinions on what are the most important advantages of being Agile. Part 2 is all about speed ...

June 19, 2017

Earlier this year, DEVOPSdigest featured a list of expert opinions on the essential steps to become agile. Now that we have an idea on how to achieve agility, however, we have to consider why. What's the payoff? With this question in mind, DEVOPSdigest asked the experts — including analysts, consultants and vendors — for their opinions on what are the most important advantages of being Agile ...

June 15, 2017

In the development community, creating additional efficiency through improved collaboration has been prevalent for some time. But despite the head start on the rest of the corporate world when it comes to collaboration, many organizations function today as they did 15-20 years ago. Since time is money in the tech world, outdated collaboration is a huge missed opportunity ...

June 14, 2017

Given the efforts we put in these days to deconstructing monolithic applications, and using distributed microservices to make us more agile, the potential for app performance to take a nosedive because of unseen (and unanticipated) network congestion and outages is only getting greater. There is help at hand, though, in the form of new ways to program network awareness directly into your code ...

June 12, 2017

What if you discover a fatal error or an exploit in your app? What if your app is down during a crucial time? As a developer, how you react to a crisis can mean the difference between minor blip and an embarrassing or costly company blunder. Here's a crisis management plan to get things right when they go wrong ...

June 08, 2017

Recently, the results from SmartBear Software's annual survey, the State of Code Review 2017: Trends & Insights into Dev Collaboration were released. One point I found interesting is that it suggests only 66 percent of organizations can get releases out on time. Why are the other 34 percent struggling to get releases out the door? ...

June 06, 2017

Today's app development landscape is competitive and expensive. Thousands of apps are released each month, and user acquisition and retention are costing app developers millions. User abandonment is one of the main battles of every app developer — as every lost user means another wasted investment ...

June 05, 2017

Developers love using containers to build, run and ship applications in a flexible and simple way. However, the technology has received backlash for not being as secure as other (traditional) methods, such as Virtual Machines (VMs). Securing containers and securing VMs requires a completely different process. Below are four key differences between securing containers versus securing VMs ...

May 31, 2017

DevOps results in improvements in software delivery performance, according to a new first-of-its-kind study by CA Technologies to quantify the benefits for companies that combine DevOps methodologies with Cloud-based tools and delivery mechanisms ...

Share this