Many DevSecOps Tools are Just DevOps Lipstick on an Old Pig

September 30, 2018

Slides: https://www.slideshare.net/Pivotal/devsecops-is-not-just-devops-lipstick-on-a-traditional-security-pig/Pivotal/devsecops-is-not-just-devops-lipstick-on-a-traditional-security-pig There are a lot of DevSecOps tools that are just DevOps lipstick on a slow security tool pig. Tools that don't give results for hours or sometimes days or lack the ability to integrate well with the development team's other tools and practices are a non-starter. What's needed to add security to DevOps are tools that must be able to do their job within a rapid-cycle CI/CD pipeline. This is disruptive to the entire security tool landscape. This talk lays out the security tool categories that have traditionally been used by development teams and describes the characteristics of ones that fit as ones that don't fit in a DevOps world. Further, the talk presents a novel approach to evaluating DevSecOps tools and the results of using this evaluation approach on a subset of the most popular tools currently in the market. Speakers: Larry Maccherone DevSecOps Transformation Lead, Comcast Filmed at SpringOne Platform 2018

Moving Toward DevSecOps: A Case of a Framework Standardization Team

Learn from the work on the standardization of software frameworks in the R&D department of a large Japanese...

Next Video

DevSecOps: Security at the Speed of DevOps

There are a lot of DevSecOps tools that are just DevOps lipstick on a slow security tool pig. Tools that do...

Many DevSecOps Tools are Just DevOps Lipstick on an Old Pig

Previous

Next Video

Related content in this Stream

Enhance software supply chain security with VEX, SBoM & CVE scan reports. Tanzu Application Catalog optimizes risk assessment for DevSecOps.

Discover the power of a modern software factory: Agile development, DevSecOps, and platform engineering. Deliver better apps faster and forever with this comprehensive white paper.

What is VMware Tanzu? I get asked this question a lot and, you know, I try to explain it. If you want a really good explanation, you should check out a new book on the topic, DevSecOps in Practice...

With VMware Tanzu Application Platform 1.4, available now, teams can cut down on developer toil and enhance operations and security, improving their overall DevSecOps experiences and outcomes.

VMware announces new capabilities in Tanzu Application Platform that enhance developer and application operator experiences for any Kubernetes environment, increase supply chain security, and more!

VMware is innovatively leveraging Bitnami's capabilities to address the security and tooling challenges faced by enterprises in their multi-cloud and app modernization initiatives.

Learn how enterprises and ISVs can use VMware Image Builder to securely automate the processes of packaging, verifying, and publishing applications and save their DevSecOps team’s valuable time.

Tanzu Application Platform version 1.2 focuses on readiness of more environments, from cloud-first to highly regulated with an enhanced DevSecOps experience.

The main difference between DevOps and DevSecOps is security automation, but the nuances and benefits are just as important. Learn more with VMware Tanzu.

Whether you’re new to or experienced with Cartographer—an open source project designed to build and manage modern, secure software supply chains—discover how it helps boost DevSecOps productivity.

Kpack, a Kubernetes-native container build platform and a powerful tool for DevSecOps teams, is now included in VMware Tanzu Community Edition.

Recently, security has emerged as one of the most important issues in DevOps for modern applications with open source tools being heavily in use. With this, we will look into DevSecOps featuring incre

This video demonstrates how you can use the VMware Tanzu Application Platform to help accelerate your organization's DevSecOps culture. We demonstrate how Tanzu Application Platform can use an outer l

This video demonstrates how you can use the VMware Tanzu Application Platform to help accelerate your DevSecOps culture. In it, we show how the Tanzu Application Platform can use an outer loop supply

This library of validated, production-ready container images will soon support virtual machine images, making it even easier for teams to implement DevSecOps practices.

Security as Code (SaC) is the methodology of codifying security tests, scans, and policies. Security is implemented directly into the CI/CD pipeline to automatically and continuously detect security v