Speed with a Safety Net - DLT's Secure Software Factory
Many subject matter experts will tell you that DevSecOps is primarily a cultural transformation issue as opposed to a technology problem. While a true statement, the right technologies can help expedite that transformation given a vision of what your agency wants to achieve through automation. For example, can you optimally perform your mission without adopting innovation as a factor when trying to predict the best tools to use in your DevSecOps shop? Nothing hinders an agencies’ morale more negatively than selecting a clunky antiquated tool or inserting an error-prone manual process to do mundane, repetitive tasks.
Furthermore, we often see lists of DevSecOps technology choices that leave teams in a state of analysis paralysis, due based upon the myriad choices and the unknown integration hurdles. Today’s software development practices rely on streamlined integration of modern technologies and techniques to quickly deliver high quality, portable, resilient, and secure applications and services to their stakeholders.
DLT’s Secure Software Factory (SSF) provides a framework of innovative, best of breed, platforms and tools that allow an agency to plan, build, test, deploy, release, and monitor deployed services in a continuous manner that injects security controls early and often in the life cycle and monitors its health once in production. The DLT SSF also provides the right trace-ability in order to measure effectiveness and conformance to requirements. In addition, the DLT SSF detects any defects or vulnerabilities in any stage of its life cycle so that it can be remedied quickly. Activity artifacts are also captured continuously so that appropriate stakeholders can review past, existing, or future release enhancements - which can be assessed to ensure mission goals are on target or can be adjusted in an agile manner.
From idea to production, DLT’s SSF allows software development, IT Operations, and security teams to utilize a single platform to collaborate, communicate, develop, and deliver their workloads quickly at the speed their stakeholders desire, and perhaps expect; but with guard rails that assist them with rectifying issues early in the development process before they become tragedies in production. Utilizing technologies that employ Artificial Intelligence and Machine Learning, DLT’s SSF can shorten cycle times by focusing on the most important quality controls without trying to gain speed by skipping important testing or scanning activities.
Most importantly, DLT’s SSF provides observability to metrics related to all aspects of an application’s lifecycle so that continuous improvement activities can be implemented by your DevSecOps teams. As more applications of various languages, or micro-service architectures, are implemented; organizations are finding it imperative to have visibility into an application’s life cycle as they are each on their own release cycle and should be deployed on need, not dependent on one another.
Want to learn more about DLT's Secure Software Factory, or DevSecOps in general? Stop by our booth at WEST 2020 for multiple demos featuring leading software manufacturers.
Related Blog Posts
Application Lifecycle, Market Intelligence, Technology
Federal officials have released a first of its kind Strategy focused on the security of the government’s space-based platforms and infrastructure, and the impact commercial solutions may have on supporting the continued need in this space; pun intended. According to the document, the 2024 Department of Defense (DoD) Commercial Space Integration Strategy is a first for the Department of Defense, and “provides a vision for prioritizing and aligning efforts to integrate commercial solutions into our national security space architecture.”What’s this for?
Susanna Patten
Application Lifecycle, Education, Market Intelligence, State & Local Government
According to data contained in a recent study from Pediatrics, the official scientific journal of the American Academy of Pediatrics, the number of school shootings in the United States has increased dramatically every year since the 2017-2018 school year. At the same time, school mass shootings have become increasingly deadly. Given this trend and the risk posed by security threats to students and faculty, school districts are desperate to find solutions to improve school security.
Gabriel Zighelboim
Application Lifecycle, DevSecOps, Federal Government, State & Local Government
Technology is supposed to make our lives easier. So you know something’s wrong when nearly a third of federal government acquisition professionals surveyed say their agency’s acquisition technology makes the job more difficult.
Ben Allen
Application Lifecycle, DevSecOps, Federal Government, State & Local Government
Technology is supposed to make our lives easier. So you know something’s wrong when nearly a third of federal government acquisition professionals surveyed say their agency’s acquisition technology makes the job more difficult.
Ben Allen
Application Lifecycle, DevSecOps, Federal Government, State & Local Government, Technology
Government agencies strive to lower the cost of products and services to save taxpayers money. They also aim to shorten “procurement administrative lead time,” or PALT—the time from identification of need to delivery of value—to expedite their missions without delay.
Ben Allen
Application Lifecycle, DevSecOps, Federal Government, State & Local Government, Technology
Government agencies strive to lower the cost of products and services to save taxpayers money. They also aim to shorten “procurement administrative lead time,” or PALT—the time from identification of need to delivery of value—to expedite their missions without delay.
Ben Allen
Application Lifecycle, Business Applications, Federal Government, State & Local Government
Case work is the universal working style of government agencies. Everything from handling customer service inquiries to issuing permits to responding to weather events—in short, any workflow a public sector organization handles—is a “case” that requires a systematic approach from start to finish.
Shari Ingerman
Application Lifecycle, State & Local Government, Technology
The good news is that we’ve officially moved into the next phase of the pandemic, where the White House expects the threat of serious illness to be considerably diminished. But the bad news? Nearly 18 million Americans stand to lose the Medicaid benefits granted to them during the public health crisis as eligibility determinations return to pre-pandemic guidelines.
Vishal Hanjan
Application Lifecycle, Technology
In successful federal government acquisitions, an agency’s needs are met in the most effective, economical, and timely manner. The key to meeting your acquisition objectives? Proper acquisition planning—which begins well before you write your plan document. In other words, plan first, document later.
Ben Allen
Application Lifecycle, Technology
Whether deploying a ship or a software application, a new acquisition is only as good as its requirements.
Clearly defining your requirements in the RFP results in a less risky contract opportunity, leading to more competition and lower pricing from vendors. All the nuts and bolts of the opportunity—the many small requirements that make up the larger project—need to be captured in a deliberate, methodical fashion. And for transparency into the scope of the acquisition, the complete set of requirements should be shared with all stakeholders.
Ken Valle
Application Lifecycle, Cybersecurity, DevSecOps
Implementing zero trust may seem daunting, but it is also an opportunity to integrate more secure coding practices into your software applications from the start. Zero-trust security assumes that all traffic on your internal network is potentially malicious. Consequently, it requires taking measures to:
Don Maclean
Application Lifecycle, Cybersecurity, DevSecOps
Implementing zero trust may seem daunting, but it is also an opportunity to integrate more secure coding practices into your software applications from the start. Zero-trust security assumes that all traffic on your internal network is potentially malicious. Consequently, it requires taking measures to:
Don Maclean
Application Lifecycle, Federal Government, IT Infrastructure, Open Source
You can spend hours scrolling down the rabbit hole of government IT horror stories, which makes the recent launch of the federal website for ordering free COVID tests that much more remarkable. The website worked, and it was surprisingly easy to use. But that success belies decades of underinvestment in digital transformation that has stifled public sector innovation and hardened the government's low-tech image. For example:
Roland Alston
Application Lifecycle, Cloud Computing, DevSecOps
In this post we will look at how to accelerate the development of cloud native applications, give you a snapshot of the USAF deployment of D2iQ, and provide a link to the DLT Cloud Security Assessment to see where you currently stand.
Jeff Schad
Application Lifecycle, Cloud Computing, DevSecOps
In this post we will look at how to accelerate the development of cloud native applications, give you a snapshot of the USAF deployment of D2iQ, and provide a link to the DLT Cloud Security Assessment to see where you currently stand.
Jeff Schad
Application Lifecycle, Cloud Computing, Cybersecurity, DevSecOps, Market Intelligence
"We are making progress. This really is not just about technology. This is about changing our processes changing our approach to delivering and operating technology to IT systems and our cyber mechanical warfare systems as we move forward," said Robert Vietmeyer, DoD Director for Cloud and Software Modernization.
Toan Le
Application Lifecycle, Cloud Computing, Cybersecurity, DevSecOps, Market Intelligence
"We are making progress. This really is not just about technology. This is about changing our processes changing our approach to delivering and operating technology to IT systems and our cyber mechanical warfare systems as we move forward," said Robert Vietmeyer, DoD Director for Cloud and Software Modernization.
Toan Le
Application Lifecycle, Big Data & Analytics, Cloud Computing, Cybersecurity, DevSecOps, IT Infrastructure
For the second year in a row, Gartner named IBM a Leader in Gartner Magic Quadrant for 2021 Cloud Database Management Systems based on its Ability to Execute and Completeness of Vision. With emergence of a single cloud DBMS market, We believe our portfolio of feature-rich, enterprise-tested offerings, bold acquisitions, and partnerships enable our clients to address the unique needs of their business, respond to the growing volume, velocity and variety of today’s data and drive more accurate data driven decisions.
Holly Vatter
Application Lifecycle, Big Data & Analytics, Cloud Computing, Cybersecurity, DevSecOps, IT Infrastructure
For the second year in a row, Gartner named IBM a Leader in Gartner Magic Quadrant for 2021 Cloud Database Management Systems based on its Ability to Execute and Completeness of Vision. With emergence of a single cloud DBMS market, We believe our portfolio of feature-rich, enterprise-tested offerings, bold acquisitions, and partnerships enable our clients to address the unique needs of their business, respond to the growing volume, velocity and variety of today’s data and drive more accurate data driven decisions.
Holly Vatter
Application Lifecycle, Big Data & Analytics, Cloud Computing, Cybersecurity, DevSecOps, IT Infrastructure
This week's roundup of the latest news and insights gathered from IBM's Government Research Institute thought leaders:
Michael J. Keegan
Application Lifecycle, Big Data & Analytics, Cloud Computing, Cybersecurity, DevSecOps, IT Infrastructure
This week's roundup of the latest news and insights gathered from IBM's Government Research Institute thought leaders:
Michael J. Keegan
Application Lifecycle, Federal Government, IT Infrastructure, IT Perspective
In the post-COVID world, the federal government spends about three-fourths of its technology budget maintaining aging computer systems including platforms more than 50 years old and even some that use floppy disks, according to a recent Government Accountability Office report.
Roland Alston
Application Lifecycle, Cybersecurity, DevSecOps, Federal Government, IT Perspective, Technology
On the Tech Transforms podcast, sponsored by Dynatrace, we have talked to some of the most prominent influencers shaping critical government technology decisions. From supply chain to machine learning, this podcast explores the way technology advancement intersects with human needs.
In March 2022, we sat down with these government technology visionaries:
Carolyn Ford
Application Lifecycle, Cybersecurity, DevSecOps, Federal Government, IT Perspective, Technology
On the Tech Transforms podcast, sponsored by Dynatrace, we have talked to some of the most prominent influencers shaping critical government technology decisions. From supply chain to machine learning, this podcast explores the way technology advancement intersects with human needs.
In March 2022, we sat down with these government technology visionaries:
Carolyn Ford
Cloud Computing, Cybersecurity, DevSecOps, Market Intelligence
"Zero Trust is a cybersecurity strategy and framework that embeds IT security mechanisms throughout an architecture that generate metadata used to secure, manage, and monitor every device user, application, and network transaction at the perimeter and within every network enclave."
From the Department of Defense (DoD) Zero Trust Reference Architecture v1.0
Toan Le
Application Lifecycle
Kubernetes was originally designed to support workload consolidation in a single cluster. However, there are many problem scenarios that require a multi-cluster approach to optimize performance and results. These can include workloads across regions, limiting outage blast radius, compliance issues, hard multitenancy, security, and specialized solutions.
DLT Solutions
DevSecOps
Last month, ICIT sponsored an online panel discussion featuring a number of application development and cybersecurity experts from across industry, the federal government, and the Department of Defense. This panel discussion focused on two new security vectors that have arisen as application development practices and technologies have evolved – infrastructure as code (IaC) and APIs.
DLT Solutions
DevSecOps
Article originally posted by the GovDevSecOpsHub here.
Today’s Application Security (AppSec) measures focus on protecting web applications. These measures include methods of preventing data or code within the application from being compromised or hijacked. AppSec is an essential part of the Software Development Life Cycle (SDLC) and ensuring that applications are secured must be a top priority in today’s ever-evolving and expanding digital landscape.
DLT Solutions
Cybersecurity, DevSecOps
Article originally posted to the GovDevSecOpsHub here.
When in-person processes became impossible during the pandemic, the extent to which public sector services relied on them became apparent. Town halls, municipal offices, schools, and colleges were forced to close their doors to the public, and the need to provide digital alternatives to citizen services so that constituents could continue to access them became clear.
DLT Solutions
Cloud, DevSecOps
Article originally posted to the GovDevSecOpsHub here.
DLT Solutions
Application Lifecycle
In our last article on the GovDevSecOpsHub, we sat down with Peter Archibald, the Regional Sales Manager for DoD and FSI sales at Checkmarx, and Jeff Ingram, a DoD Regional Sales Manager at Checkmarx, to discuss the inclusion of the company’s application security testing (AST) solution in Platform One’s Iron Bank.
Brandon Norris
Application Lifecycle
Right in the middle of the holiday season, as much of the world was preparing to take some deserved time off to celebrate with their families and bid 2020 a less-than-fond farewell, some terrible news broke involving a number of government agencies and large enterprises. A common network management platform that is used widely across the public and private sectors had been victim to a supply chain attack, and the networks and data of a large number of users had been compromised.
Brandon Norris
Application Lifecycle
There is no lack of high-stress industries and occupations that have to battle against burnout and employee fatigue. They’re problems that face a number of jobs – from hospital staff to airline pilots. But, when you think about occupations that deal with fatigue and burnout, application developers may not be top of mind.
However, as the application development process has accelerated, and as dev teams have begun deploying new capabilities, patches, and updates with increased frequency, burnout has become a real problem.
Brandon Norris
Application Lifecycle
The Air Force wants to open its Platform One services to private sector partnerships with the hope of tapping into a consortium of academic and industry organizations to enhance its coding environment.
Rick Stewart
Application Lifecycle, Big Data, Cloud, Cloud Computing, DevSecOps
2020 was a transformative year for public sector IT. Accelerated by necessity, agencies rapidly scaled and secured their digital ecosystems to accommodate a newly remote workforce. Against this backdrop, significant cybersecurity hacks revealed continued vulnerabilities in the federal supply chain and state and local IT infrastructures.
Looking forward there is much work to be done. A new administration, new regulations and continued reliance on the cloud will shape public sector IT through 2021.
Brandon Norris
Application Lifecycle, Big Data, Cloud, Cloud Computing, DevSecOps
2020 was a transformative year for public sector IT. Accelerated by necessity, agencies rapidly scaled and secured their digital ecosystems to accommodate a newly remote workforce. Against this backdrop, significant cybersecurity hacks revealed continued vulnerabilities in the federal supply chain and state and local IT infrastructures.
Looking forward there is much work to be done. A new administration, new regulations and continued reliance on the cloud will shape public sector IT through 2021.
Brandon Norris
Application Lifecycle
Each month DLT’s GovIT podcast series explores a different technology, what it is and how it can help public sector organizations achieve their monetization goals and accomplish their missions. Recently, our host, Tom Temin, sat down with BMC Software's Jon Powers for a Q&A about security operations or SecOps for the public sector.
Here are some highlights of their discussion.
Q: What is SecOps?
Brandon Norris
Application Lifecycle, IT Perspective
Blog originally posted by Federal News Network here.
Savanna Evans
Application Lifecycle
Article originally posted to the GovDevSecOpsHub here.
Rick Stewart
Application Lifecycle
Article originally posted to the GovDevSecOpsHub here.
DLT Solutions
Application Lifecycle, Cybersecurity
Federal agencies are developing and releasing software and apps at a rapid speed. This haste comes at a price. Verizon reports that nearly 70% of the data breaches it investigated in 2019 were due to attackers targeting vulnerabilities in public-facing web applications. It also introduces compliance risk.
Farah Alam
Application Lifecycle
Cloud native is transforming how the public sector builds and runs applications bringing agility, flexibility, scalability, and decreased downtime and cost. The de facto foundation of cloud native application development is Kubernetes. But getting started with Kubernetes isn’t as simple as it appears. While it’s relatively uncomplicated to spin up a cluster in the cloud, getting from there to production is a bit more daunting.
DLT Solutions
Application Lifecycle
In my blog earlier this year, I sat down with Ben Chicoski from CloudBees to discuss the importance of their technology in the federal government, the work they’re doing in the SDLC, and the role they play in DLT’s Secure Software Factory.
Today, I am very excited to share a conversation I recently had with Larry Johnsen, VP of Sales for the Military/Aerospace/Government Solutions verticals at Parasoft.
Jim Fitzmaurice
Cloud Computing, DevSecOps, IT Infrastructure
Cloud governance shouldn’t be an afterthought. Indeed, it should be a foundational element of any cloud security strategy. Why? Because the cloud is enormous – it’s software, hardware, developer tools and platforms, and more. All delivered by a host of vendors.
DLT Solutions
Application Lifecycle, DevSecOps
As a public sector solutions aggregator, DLT Solutions creates effective go-to-market strategies that its technology vendors and channel partners can leverage to deliver optimal business-oriented solutions to government, healthcare and education customers.
Jim Fitzmaurice
Application Lifecycle, DevSecOps
As a public sector solutions aggregator, DLT Solutions creates effective go-to-market strategies that its technology vendors and channel partners can leverage to deliver optimal business-oriented solutions to government, healthcare and education customers.
Jim Fitzmaurice
Application Lifecycle, DevSecOps
Kubernetes has emerged as the de-facto platform of choice for implementing containerized microservices and accelerating cloud migration. It saves time, is cost-effective, and can run in the cloud or on-premises. No wonder adoption is skyrocketing. In 2019 Kubernetes usage grew almost 50% in the span of just six months.
DLT Solutions
Application Lifecycle, DevSecOps
Kubernetes has emerged as the de-facto platform of choice for implementing containerized microservices and accelerating cloud migration. It saves time, is cost-effective, and can run in the cloud or on-premises. No wonder adoption is skyrocketing. In 2019 Kubernetes usage grew almost 50% in the span of just six months.
DLT Solutions
DevSecOps, Open Source
You say “DevOps”, I say “what about DevSecOps?”. But neither exists in a silo. If you’re taking advantage of DevOps tools and methods, you need to integrate DevSecOps into the mix. In other words, IT security must play an integrated role in the full lifecycle of your apps.
But what is DevSecOps? For this, we turn to DLT partner, Red Hat, who has put together a user-friendly guide to DevSecOps.
DLT Solutions