The Guardian

Google, Facebook, Amazon and Apple asked to turn over internal documents

The US government’s investigations into big tech widened on Friday as lawmakers announced they were seeking internal documents from Google, Facebook, Amazon and Apple. Letters went out to the four companies on Friday from the leaders of the House judiciary committee and its subcommittee on
/
NYT

How Each Big Tech Company May Be Targeted by Regulators

Amazon, Apple, Facebook and Google have been the envy of corporate America, admired for their size, influence and remarkable growth. Now that success is attracting a different kind of spotlight. In Washington, Brussels and beyond, regulators and lawmakers are investigating whether the four technology companies
/
Evelyn de Souza Secure Business Agility

The First Steps on a CISOs DevOps Journey

CISOs DevOps

The marriage between DevOps and Security is rapidly gaining traction. Security is shifting from its former mindset of being its own silo to getting on the same agenda as their developer counterparts. For CISOs the opportunity to get security baked in has never been as achievable, but they need to focus on building that synergistic foundation between DevOps and Security. Following are some Golden Rules for CISOs looking to make the most of the agility DevOps brings:

The first step is developing a mutual understanding. To get on the same page as your development team figure out:

  • What their business goals are
  • How they are going to meet their goals with their DevOps pipeline
  • What tools they are using
  • What kind of efficiencies they are looking to achieve

Then align security to support DevOps in each of those areas.

Conversely, ensuring that DevOps understands Security’s goals and is actively looking to ensure compliance to the organization’s security policies. The DevOps paradigm is a key opportunity to get compliance policies built in earlier into the software development cycle through closer collaboration with developers.

  1. Build trust and credibility: Related to the first step, after you understand your developers’ end game, do what you tell them you are going to do, and understand and empathize with their struggles. This makes it much easier to create a climate of mutual understanding and trust.
  2. Embed security into the overall developer chain: It not only speeds up the development process, it makes it more secure. However, DevOps needs a compelling case to put in the required effort and Security has to come to the table as a collaborator versus with a list of demands. For example,
    1. Ensure that access to GitHub repositories is not broader than required and that developers are careful with login credentials per this being a noted breach vector
    2. Automate and where not possible conduct manual system and network security assessments are built into the software development lifecycle
    3. Work with developers to ensure the passwords are compliant, that they are being rotated
    4. Apply encryption at rest, in use and in transit
  1. Get involved in open source. Increasingly developers and companies are relying on open source software. However, there’s no standard way of documenting security in open source projects so it becomes important to build security into the development process and check and re-check applications for vulnerabilities. The upside for CISOs is that through utilizing open source software they get the opportunity for many eyes to look over their software and therefore, bugs and vulnerabilities get discovered faster.
  2. Treat security as an ever-changing practice that one has to stay on top off and alter practices as the landscape changes. Organizations that offer developers and security teams the opportunity to cross-train will find that they develop security-conscious developers and security teams that are business focused. This is an opportunity for security teams to come up to speed with developer tool such as Chef and Puppet while developers get to learn about vulnerability management and other security tools and practices.

By Evelyn De Souza

Evelyn de Souza Contributor
Leading Influencer
Evelyn de Souza focuses on developing industry blueprints that accelerate secure cloud adoption for business as well as everyday living. She currently serves as the Chair of the newly formed Cloud Security Alliance (CSA) data governance and privacy working group. Evelyn was named to CloudNOW’s Top 10 Women in Cloud Computing for 2014 and SVBJ’s 100 Women of Influence for 2015. Evelyn is the co-creator of Cloud Data Protection Cert, the industry’s first blueprint for making data protection “business-consumable” and is currently working on a data protection heatmap that attempts to streamline the data privacy landscape.
follow me
CA Technologies

CLOUD PARTNERS | SPONSOR SERVICES

Daren Glenister

Countdown to GDPR: Preparing for Global Data Privacy Reform

Preparing for Global Data Privacy Reform Multinational businesses who aren’t up to speed on the regulatory requirements of the European Union’s General Data Protection Regulation ...
The Cloud Debate - Private, Public, Hybrid or Multi Clouds?

The Cloud Debate – Private, Public, Hybrid or Multi Clouds?

The Cloud Debate Now that we've gotten over the hump of whether we should adopt the cloud or not, "which cloud" is now the center ...
Sekhar Sarukkai

A Closer Look at Insider Threats and Sensitive Data in the Cloud

Sensitive Data in the Cloud A recent survey report conducted by the Cloud Security Alliance (CSA) revealed that  sensitive data in the cloud had reached ...
Ankur Laroia

Why ‘Data Hoarding’ Increases Cybersecurity Risk

Data Hoarding The proliferation of data and constant growth of content saved on premise, in cloud storage, or a non-integrated solution, poses a challenge to ...
International Data Privacy Laws

51 companies tell Congress it’s time to tackle data privacy

/
Amazon, AT&T and Qualcomm are among those involved The corporate world isn't waiting around for Congress to get started on tougher data privacy laws. A group of 51 CEOs from ...
Intel Technology Propels Olympic Games Tokyo 2020 into the Future

Intel Technology Propels Olympic Games Tokyo 2020 into the Future

/
TOKYO, Sept. 11, 2019 — Today, Intel announced that it is partnering with the International Olympic Committee (IOC), the Tokyo Organizing Committee of the Olympic Games (Tokyo 2020) and a ...
The Guardian

Google, Facebook, Amazon and Apple asked to turn over internal documents

/
The US government’s investigations into big tech widened on Friday as lawmakers announced they were seeking internal documents from Google, Facebook, Amazon and Apple. Letters went out to the four ...

TRENDING | TECH NEWS