 unnecessary friction and to-and-fro between development and operations teams.
For DevOps teams, automated security helps accelerate lifecycles while alleviating the burden of manually testing the application for vulnerabilities or threats. It’s thus unsurprising that 59% of surveyed organizations are automating security into their DevOps processes.
Automation can be as simple as applying draft detection when specific controls change, or automatically detecting misconfiguration and fixing it.
Additionally, process automation can also help to reduce human error while security that is adaptive, contextual, and software-based should be prioritized. Once security functionality is established as services via APIs, it is easier to embed into DevOps workflows in an automated manner. It can enable crucial capabilities such as continuous scanning of container images for bugs and malware, along with run-time protection.
In the early stages of a project at least, it may be a good idea to prioritize visibility and monitoring rather than enforcement and blocking, so that security is not seen as a drag on innovation.
What are the opportunity and business costs in not adopting it?
Hidalgo: Based on a recent global DevOps survey we conducted, almost 9 in 10 (89%) of IT leaders admitted they were facing issues implementing a true DevOps culture in their organization. The top three challenges are: increased security complexity (40%), complexity of the IT infrastructure (39%), and lack of staff training or awareness of DevOps within the wider organization. The close next is a lack of communication between the developer, security, and operations teams (34%).
New technologies are quickly evolving and in order to secure new cloud applications, organizations have to understand these technologies – not just how they work, but also how customers use them, how developers write software for them, how they’re deployed, and how the infrastructure team uses them. The simplistic approach of looking for “security for X” technology would almost certainly result in a lot of chaos.
Make the case for the use of containers in DevSecOps automation – what kind of opportunities does this bring? Additionally, how is this integrated into the CI/CD pipeline?
Hidalgo: Trend Micro has been providing technologies to help companies secure dynamic environments. Virtual patching has been the first foray into security automation with the ability to learn what is inside your servers so you can secure them properly, helping companies mitigate risk and buy time to patch, not just for VMs but also for the container environments.
What’s driving the adoption of cloud containers is the need for speed. Google has been running all its software in containers since 2014. Numbers have it that it fires up two billion of containers in a week.
But containers are not devoid of security pitfalls. Kenna Security’s 2019 project reveals that many of the top 1,000 most popular containers from Docker Hub contain some type of vulnerabilities. Over 20% of the containers have at least one vulnerability considered high risk. The oldest container on the list – abh1nav/Cassandra – had 1.5 million pulls, and is home to over 431 open vulnerabilities. The container Keyvanfatehi/sinopia, while pulled 1.7 million times, has the highest number of vulnerabilities – an alarming 2,004.
Now we are moving ability to detect issues in the pipeline with Smart Check, a tool that you use in the DevOps pipeline to look at malware, vulnerabilities, and content such as credit card numbers. It also helps with compliance such as PCI-DSS. This can be integrated in the CI/CD pipeline so that developers can get feedback into if the containers are laden with malware or vulnerabilities.
In the future, we are even moving security to the left with App Protect, a runtime application security platform. Unlike static code analysis, App Protect allows you to spot code behaviour that may lead to breaches and vulnerabilities. Being integrated in code, developers can find issues while writing applications and running them.
With teams having the benefit of working across the lifecycle, and as a result developing a set of skillsets that are not limited to a single function – is there still a need to have a central security operations team? What are the differences in the skills/mindset/training needed for DevSecOps?
Hidalgo: Yes, absolutely, but the tasks will change. Evolving security teams will have a more similar skillset to developers: writing code to detect, give insights, and possibly remediate attacks.
Applying a DevSecOps mentality is all about automating mundane tasks. This will free up time to do cool stuff – being the hunter instead of the hunted.
In terms of adoption, what do you think will trigger companies to embrace DevSecOps in droves?
Hidalgo: As companies move into the hybrid cloud environment, DevSecOps should become the underpinning of their security operations. It’s projected that by 2019, 70% of enterprise DevOps initiatives will integrate automated security as well as vulnerability and configuration scanning for application packages.
While the goal is the same through the years, the pace of innovation is just going to get faster. I believe that DevSecOps thinking is not just about the ability to configure security tools quickly or to detect threats in the pipeline, but rather how fast we can integrate securing data as we innovate and deliver value.
PreviousAre APAC businesses ready for their transformation?
Write the last sentence in this story.

(CNN) -- "The first thing he asked was 'Are you the one who said that you are the best drummer in this country?' I laughed and told him, 'I never said so.' He asked me if I could play jazz and I said yes. He asked me if I could take solos and I said yes again." That's how Tony Allen details his first ever encounter with Fela Kuti back in the mid-1960s, a meeting that was destined to trigger an explosive sonic collaboration that a few years later gave birth to the blistering Afrobeat sound -- arguably the most exciting period in the history of popular West African music.

In the end, Allen says it was not the ongoing pay disputes but the increasingly volatile situation around Fela's political activism that led to

OPTIONS:
- Afrobeat leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- Allen leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- CNN leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- Fela Kuti leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- Nigerian leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- Paris leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- Tony Allen leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
- West African leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.
Allen leaving the group in 1978 -- events like the army attack on Fela's compound in 1977.This dissertation project had its genesis during E.D.C.'s undergraduate research in the 1998 Biology and Geomorphology of Tropical Islands course, taught at the UC Berkeley Gump Station in French Polynesia. We gratefully acknowledge the people and governments of American Samoa, Fiji, French Polynesia, Samoa and Vanuatu for permitting our sample collections and for assistance in collections. In particular, we thank E. Bardi, S. Crandall, N. Davies, K. Feussner, S. Ravuna, S. Siolo, R. Utzurrum, D. Vargo, L. Wade and the Turner Family for their assistance with field collections and permits. M. Frey graciously loaned additional samples from the Cook Islands, New Caledonia, Fiji and American Samoa and J. Taffel assisted with molecular data collection. Grants to E. D. C. from the Lerner-Grey Fund (American Museum of Natural History) and the Walter Sage Memorial Fund (Conchologists of America), and the NSF Doctoral Dissertation Improvement Grant-DEB-0508788- to E. D. C. funded sample collections. NSF grants DEB-0338566 and OCE-0349177 to P. H. B funded sequencing and part of E.D.C.'s graduate stipend. E.A.T.'s modelling work was funded in part by the Australian Research Council (DP0878306), the Kathryn Fuller Post-Doctoral Fellowship (World Wildlife Fund), the NSF Coral Triangle Partnerships for International Research and Education, OISE-0730256 to P. H. B., K. Carpenter and P. Halpin. E. Anderson, T. Eichhorst, D. Drown, J. Finnerty, L. Kaufman, L. Mullineaux, J. Philibotte, C. Riginos, E. Sbrocco, C. Schneider, L. Smith, S. Thorrold, R. Toonen and two anonymous reviewers provided very useful comments and discussion. The Crandall Family provided computational resources for Migrate analyses as well as moral support. E. D. C. thanks S. Crandall for her continued patience and support.Habit : Large deciduous trees, up to 25 m tall; young shoots densely tomentose.
Leaves : alternate, ovate, ovate-lanceolate or oblong, up to 25 x 12 cm, truncate or subcordate at base, acuminate at apex; grey-pubescent beneath; stipules small, grey-pubescent.
Flowers : mono