Software Integrity Blog

Author Archive

Charlie Klein

charlie-klein

As a Product Marketing/Business Rotational Program Associate at Synopsys, Charlie will rotate through the sales, marketing, sales operations, and finance departments four months at a time. He joined Black Duck Software in July, before Black Duck Software was acquired by Synopsys. During his time in sales and marketing, Charlie has researched and learned about the importance of open source risk management—especially pertaining to container security and secure DevOps practices. While in marketing, Charlie has been helping with the launch of OpsSight, a product designed for IT Operations and Infrastructure teams hoping to automate security practices in the production environment. He holds a B.A. in Political Economy from Bates College.


Posts by Charlie Klein:

 

Securing containers at scale

Open source is the foundation of most modern applications. However, left untracked, open source can put containerized applications at risk of known vulnerabilities such as Heartbleed and CVE-2017-5638 found in Apache Struts.

Continue Reading...

Posted in Container Security, Open Source Security, Software Composition Analysis (SCA)

 

Securing applications with Coverity’s static analysis results

This is the third post in a three-part series on how you can maximize the impact of a static analysis solution by supporting developers and their goals.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Static Analysis (SAST)

 

Integrating Coverity static analysis into development workflows

This is the second post in a three-part series on how you can maximize the impact of a static analysis solution by supporting developers and their goals.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Static Analysis (SAST)

 

Maximizing the impact of static analysis

This is the first post in a three-part series on how you can maximize the impact of a static analysis solution by supporting developers and their goals.

Continue Reading...

Posted in Static Analysis (SAST)

 

Enable DevSecOps with Coverity: Deliver secure code faster

Traditional software security can be too slow for DevOps. The answer: DevSecOps. To create secure software quickly, you need automated static analysis.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Static Analysis (SAST)

 

The best way to secure applications in 2018? Learn from 2017

2017—a turbulent year in application security From breaches making headlines to exciting new technologies, 2017 was abuzz with conversation around securing applications and the implications of access to personal data. We saw what can happen when sensitive data is not properly secured, providing a sharp reminder of why application security is so important. Looking ahead, we need to reflect on emerging threats, technologies, and practices in application security in 2017, so organizations can prepare for building secure applications in 2018.

Continue Reading...

Posted in Data Breach Security

 

Migrating to Docker on Black Duck

Before Black Duck began leveraging Docker, customers utilized the App Manager Install Method to deploy it. Black Duck now deploys as a set of containers, so customers need to install Docker to take advantage of updates to the application. By the end of this guide, you’ll have a basic understanding of how to migrate Black Duck to a containerized environment, as well as the benefits of using containers.

Continue Reading...

Posted in Container Security, Open Source Security, Software Composition Analysis (SCA)

 

Container adoption today: Advantages and challenges

Organizations today work in a continuous delivery environment, requiring speed and agility in deployment and the ability to monitor applications once deployed. These requirements are accelerating the adoption of containers in the production environment. In October, DockerCon Europe revealed that 24 billion containers have been downloaded. Not surprisingly, there’s been a corresponding 77,000% growth in Docker job listings. Why use containers? As application development teams are pressured to deliver software faster than ever, container adoption offers clear advantages. A Forrester study found that 66% of organizations who adopted containers experienced accelerated developer efficiency, while 75% of companies achieved a moderate to significant increase in application deployment speed. Got a lot of containers to secure?Download the eBook. As the saying goes, time is money. As development and operations teams deliver software without the hassle of constantly reconfiguring infrastructure, they save time and cut costs. In a different study, Forrester discovered that organizations saved upward of 70% on dev/test costs after container adoption, and 40% on production costs, while operating on 80% fewer servers. Similarly, case studies revealed that organizations who adopted containers experienced average cost savings of 50% in the production environment. Since containers do not require hypervisors, much of these savings come from a reduction in hypervisor licensing costs.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Container Security