LaunchDarkly announced the private preview of Warehouse Native Experimentation, its Snowflake Native App, to offer Data Warehouse Native Experimentation.
A surprising amount of organizations aren't embracing automation when it comes to securing cloud deployments, according to the State of DevSecOps 2024 report from Datadog.
At least 38% of organizations leveraging AWS had deployed workloads or completed sensitive actions manually through the AWS console in a production environment within a 14-day period, meaning they are relying on manual click operations instead of automation.
Adoption of infrastructure as code (IaC) also varied across cloud providers. IaC is considered a critical practice when securing cloud production environments, as it helps ensure that human operations have limited permissions on production environments, all changes are peer reviewed and issues are identified earlier in the process. The report found that in AWS, over 71% of organizations use IaC through at least one popular IaC technology. This number is lower in Google Cloud, at 55%.
"These findings from the State of DevSecOps show that there is still room for improvement when it comes to embracing automation for the sake of improving security," said Andrew Krug, Head of Security Advocacy at Datadog. "Modern DevOps practices go hand-in-hand with strong security measures — and in fact, security helps drive operational excellence across the organization. While security starts with visibility, securing applications is only realistic when practitioners are given enough context and prioritization to understand which security signals matter and which are irrelevant."
Other key findings from the report include:
■ While attacks from automated security scanners represent the largest number of exploitation attempts, the vast majority of these attacks are harmless and only generate noise for defenders. Out of the tens of millions of malicious requests that were identified coming from such scanners, only 0.0065% successfully triggered a vulnerability.
■ A substantial number of organizations continue to rely on long-lived credentials — one of the most common causes of data breaches — in their CI/CD pipelines, even in cases where short-lived ones would be both more practical and more secure. 63% used a form of long-lived credential at least once to authenticate GitHub Actions pipelines.
■ Java applications are the most impacted by third-party vulnerabilities; 90% of Java services are susceptible to one or more critical or high-severity vulnerabilities introduced by a third-party library, versus an average of 47% for other programming languages.
Methodology: For the report, Datadog analyzed tens of thousands of applications and container images, along with thousands of cloud environments to assess the security posture of applications today and evaluate the adoption of best practices that are at the core of DevSecOps.
Industry News
SingleStore announced the launch of SingleStore Flow, a no-code solution designed to greatly simplify data migration and Change Data Capture (CDC).
ActiveState launched its Vulnerability Management as a Service (VMaas) offering to help organizations manage open source and accelerate secure software delivery.
Genkit for Node.js is now at version 1.0 and ready for production use.
JFrog signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS).
mabl launched of two new innovations, mabl Tools for Playwright and mabl GenAI Test Creation, expanding testing capabilities beyond the bounds of traditional QA teams.
Check Point® Software Technologies Ltd.(link is external) announced a strategic partnership with leading cloud security provider Wiz to address the growing challenges enterprises face securing hybrid cloud environments.
Jitterbit announced its latest AI-infused capabilities within the Harmony platform, advancing AI from low-code development to natural language processing (NLP).
Rancher Government Solutions (RGS) and Sequoia Holdings announced a strategic partnership to enhance software supply chain security, classified workload deployments, and Kubernetes management for the Department of Defense (DOD), Intelligence Community (IC), and federal civilian agencies.
Harness and Traceable have entered into a definitive merger agreement, creating an advanced AI-native DevSecOps platform.
Endor Labs announced a partnership with GitHub that makes it easier than ever for application security teams and developers to accurately identify and remediate the most serious security vulnerabilities—all without leaving GitHub.
Are you using OpenTelemetry? Are you planning to use it? Click here to take the OpenTelemetry survey(link is external).
GitHub announced a wave of new features and enhancements to GitHub Copilot to streamline coding tasks based on an organization’s specific ways of working.
Mirantis launched k0rdent, an open-source Distributed Container Management Environment (DCME) that provides a single control point for cloud native applications – on-premises, on public clouds, at the edge – on any infrastructure, anywhere.
Hitachi Vantara announced a new co-engineered solution with Cisco designed for Red Hat OpenShift, a hybrid cloud application platform powered by Kubernetes.