Progress announced the completion of the acquisition of ShareFile, a business unit of Cloud Software Group, providing a SaaS-native, AI-powered, document-centric collaboration platform, focusing on industry segments including business and professional services, financial services, industrial and healthcare.
Nearly half of organizations regularly and knowingly ship vulnerable code despite using application security tools, according to new research from Veracode and Enterprise Strategy Group (ESG).
In the report, entitled Modern Application Development Security, among the top reasons cited for pushing vulnerable code were pressure to meet release deadlines (54%) and finding vulnerabilities too late in the software development lifecycle (45%).
Respondents said that the lack of developer knowledge to mitigate issues and lack of integration between AppSec tools were two of the top challenges they face with implementing DevSecOps. However, nearly nine of ten companies said they would invest further in AppSec this year.
"The software development landscape today is evolving at light speed. Microservices-driven architecture, containers, and cloud-native applications are shifting the dynamics of how developers build, test, and deploy code. Without better testing, integration, and regular developer training, organizations will put themselves at jeopardy for a significant breach," said Chris Wysopal, CTO at Veracode.
Among the key findings of the report:
■ Developers' lack of knowledge on how to mitigate issues is the biggest AppSec challenge – 53% of organizations only provide security training for developers once a year or less. Veracode data shows that the top 1% of applications with the highest scan frequency carry about five times less security debt, or unresolved flaws, than the least frequently scanned applications, which means frequent scanning helps developers find and fix flaws to significantly lower their organization’s risk.
■ 43% cited DevOps integration as the most important aspect to improving their AppSec program.
■ 84% report challenges due to too many AppSec tools, making DevOps integration difficult. 43% of companies report that they have between 11-20 AppSec tools in use, while 22% said they use between 21-50.
According to ESG, the most effective AppSec programs report the following as some of the critical components of their program:
■ Application security is highly integrated into the CI/CD toolchain
■ Ongoing, customized AppSec training for developers
■ Tracking continuous improvement metrics within individual development teams
■ AppSec best practices are being shared by development managers
■ Using analytics to track progress of AppSec programs and to provide data to management
Industry News
Incredibuild announced the acquisition of Garden, a provider of DevOps pipeline acceleration solutions.
The Open Source Security Foundation (OpenSSF) announced an expansion of its free course “Developing Secure Software” (LFD121).
Redgate announced that its core solutions are listed in Amazon Web Services (AWS) Marketplace.
LambdaTest introduced a suite of new features to its AI-powered Test Manager, designed to simplify and enhance the test management experience for software development and QA teams.
StackHawk launched Oversight to provide security teams with a birds-eye view of their API security program.
DataStax announced the enhancement of its GitHub Copilot extension with its AI Platform-as-a-Service (AI PaaS) solution.
Opsera partnered with Databricks to empower software and DevOps engineers to deliver software faster, safer and smarter through AI/ML model deployments and schema rollback capabilities.
GitHub announced the next evolution of its Copilot-powered developer platform.
Crowdbotics released an extension for GitHub Copilot, available now through the GitHub and Azure Marketplaces.
Copado has integrated Copado AI into its Community to streamline support and accelerate issues resolution.
Mend.io and HeroDevs have forged a new partnership allowing Mend.io to offer HeroDevs support for deprecated packages.
Synechron has acquired Cloobees, a Salesforce implementation partner.
Check Point® Software Technologies Ltd. has been named as one of the World’s Best Employers by Forbes for the fifth year in a row.
Opsera announced its AI Code Assistant Insights.