DevOps 改變資安遊戲規則的三個原因
關於 DevOps 革新如何給網路安全帶來更多挑戰的問題，我們看到很多文章對此進行了探討。其中一個重要的原因是：資安團隊在今日的 DevOps sprint 和 scrum 流程中嚴重缺席。在這個以打破孤立狀況並促進共同合作為傲的技術中，因未納入安全性而造成亟待解決的嚴重 Cyber Exposure 缺口。因此，網路安全甫一發佈就忙不迭地識別和保護資產與應用程式，就像一場永無休止的打地鼠遊戲。不過，難道就沒有更好的方法嗎？
取得 Container Security 最佳做法： 操作方法指南
好在有更好的方法。 確切來說，答案跟 DevOps 很有關係，網路安全團隊應在本身的程序與工作流程中納入 DevOps 原則。 以下是何以結合這兩種做法能改變資安遊戲規則的三個原因。
1) 內建安全性
安全測試需要和開發人員共存，也就是俗稱的 DevOps 管線。讓安全流程適應開發人員至關重要，除此之外別無他法。如此可確保在開發期間事先考量安全性，開發人員也不必為了進行品保測試而拋開持續整合持續部署 (CI/CD) 系統。將安全性建置到 DevOps 對於網路安全有效性的幫助甚巨。
2) 自動化
網路安全必須盡可能採用自動化測試與稽核程序。每個組織每天都會發佈數十個、甚至上百個軟體更新。依靠手動程序無法讓安全性保持在最新狀態。反之，應該在每次組建變更或發現新弱點時，自動觸發安全測試。持續軟體交付需要持續安全控制。
3) 主動預防
若能選擇，網路安全主管應要花時間採用價值更高的安全計劃，以支援合規性並改善風險管理，而不是慌張地打地鼠。在開發期間主動識別與修復弱點，比起坐等到生產期間，可省下大量時間與金錢 (據估計，超過 85%！)。就安全性來說，俗話說的好：一分的預防勝於十分的治療。
如果降低資安成本、消除盲點和推動 DevOps 是您 2018 年的其中一個目標，請參閱這份 IDG 白皮書：DevOps 改變資安遊戲規則的三個原因。您將獲得可以採取的步驟，以便促進形成更具協作性和主動性的方法，來保護您的組織並減少 Cyber Exposure 缺口。現在正是將安全性從業務阻礙重塑為數位業務推手的時候。
相關文章
AWS Access Analyzer Just Got Better, So Did Tenable Cloud Security
November 27, 2023AWS IAM Access Analyzer now has an API allowing you to make custom policy checks. Tenable Cloud Security allows you to easily use this API as part of its code scanning functionality. Find out how and ...
Cybersecurity Snapshot: CISOs Are Happier, but Dev Teams Still Lack Secure Coding Skills
January 20, 2023Learn all about the spike in CISO job satisfaction. Plus, NIST mulls major makeover of its Cybersecurity Framework. Also, the struggle to develop secure apps is real. Then check out how Uncle Sam plans to use AI and ML to boost cybersecurity. And much more!
What Happens When the Metaverse Enters Your Attack Surface?
December 12, 2022Tenable polled 1,500 cybersecurity, IT and DevOps professionals about their top concerns in the nascent virtual reality worlds of the metaverse. Here's what we found out.
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Microsoft’s July 2024 Patch Tuesday Addresses 138 CVEs (CVE-2024-38080, CVE-2024-38112)
July 9, 2024Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
- DevOps