staging-devopsy.kinsta.cloud

Author: Veronica Haggar

  • How to Build an Effective API Security Strategy

    How to Build an Effective API Security Strategy

    Application Programming Interfaces (APIs) enable organizations to grow their businesses and drive innovation. APIs allow applications to easily transfer data to external third-party developers, business partners and internal departments. Since APIs have access to valuable and sensitive data, they have increasingly become a target for cyberattacks.

    At the API Security Summit, taking place on March 3, distinguished cybersecurity leaders will discuss the top API security vulnerabilities to be on the lookout for and how to build an effective API security strategy.

    The agenda for the API Security Summit will explore the following topics:

    • The importance of API security testing
    • The role of APIs in their environment
    • How are hackers getting in? What can we learn from them?
    • How API attacks are different from traditional application attacks
    • What leading CISOs are doing today to protect themselves
    • How APIs are increasing the attack surface
    • Why API management is not enough for API security
    • The benefits and limits of “shift left” tactics
    • Ways to increase API security fluency across your organization
    • How to drive automation across dev and security teams

    The speaker lineup features top security experts, including:

    • Corey Ball, cybersecurity consulting manager at Moss Adams
    • Dr. Katie Paxton-Fear, lecturer of cybersecurity at Manchester Metropolitan University
    • Tom Salmon, head of cybersecurity at bp Launchpad
    • Nir Valtman, CEO at Arnica and former head of product security at Finastra
    • Tyler Warren, deputy information security officer at Prologis
    • Jeff Serota, principal security engineer at Ally Bank
    • Jack Hart, InfoSec professional and API security lead at City National Bank
    • David Biesack, chief API officer at Apiture
    • Curtis Simpson, CISO at Armis
    • Anthony Doerga, founder at AppyThings

    For more information and to register, please visit the API Security Summit website.

  • How to Mitigate Software Supply Chain Risks

    How to Mitigate Software Supply Chain Risks

    As new vulnerabilities are discovered on a daily basis, DevOps teams must integrate security into the early stages of the development lifecycle and be vigilant about what elements are incorporated into their applications.

    The Log4J vulnerability has dominated the headlines since it was discovered in December and it continues to send shock waves through the industry. Any application that uses Log4J is subject to the identified family of attacks known as Log4Shell.

    Many tech companies have been impacted by the Log4J vulnerability and it has become a major concern for DevOps teams.

    On March 1, cybersecurity experts from Snyk will come together at Know Your Code: Open Source and Supply Chain Summit to discuss future strategies for maintaining security throughout your software supply chain and the security of open source packages.

    The experts will lead a live panel based on the learnings from the Log4Shell vulnerability and several real-world remediation approaches as well as other fixes outside of code. The panel features demos on container and IaC hacks and Java-based game hacks.

    The sessions explore the software supply chain as an attack vector, how developers are targeted as a vehicle for malware distribution, how immensely we depend on open-source maintainers to release timely security fixes and how the race to the cloud creates new security concerns for developers to cope with, as computing resources turn into infrastructure as code.

    Meet the Speakers

    • Mic McCully, field director at Snyk
    • Simon Maple, field CTO at Snyk
    • Micah Silverman, director of developer acceleration at Snyk

    Agenda

    • Welcome (11 a.m. to 11:05 a.m. ET)
    • Are We Forever Doomed By Software Supply Chain Risks? (11:05 a.m. to 12 p.m. ET)
    • Coffee Break (12 p.m. to 12:05 p.m. ET)
    • Log4Shell Live Hack: A Hands-on, Actionable Fix Guide (12:05 p.m. to 1 p.m. ET)
    • Break (1 p.m. to 1:05 p.m. ET)
    • Mitigating Risks in Software Supply Chain Security (1:05 p.m. to 2 p.m. ET)

    For more information and to register, please visit the Know Your Code: Open Source and Supply Chain Summit website.

  • Sumo Logic Boosts Automation to Deliver Increased Collaboration, Shorter Investigation and Response Times for Modern Security Operations

    Sumo Logic Introduces War Room and App Central Capabilities to Industry-Leading Cloud SOAR

    Redwood City, CA, February 22, 2022 – Sumo Logic (Nasdaq: SUMO), the pioneer in continuous intelligence, today announced new offerings further advancing its award-winning Sumo Logic Cloud SOAR with the War Room and App Central features. The War Room provides security teams with the details of an incident to expedite manual processes that could typically take minutes to now close within a matter of seconds. Within App Central, critical resources, including use cases, integrations, and playbooks, are brought together to boost necessary automation so that security teams can build standard operating procedures and respond faster to incidents.

    “Enterprise leaders have long recognized the need to share critical data across and between systems within their organizations. This is also important within a security operations center (SOC) where SOAR solutions have emerged as a necessary tool to close the investigation gap,” said Dario Forte, VP and GM Security Orchestration, Sumo Logic. “The use cases for security automation and response will continue to evolve. Tools like the War Room will provide cybersecurity teams the flexibility to focus on important tasks while leaving the rest to our robust automation, open integration capabilities, and advanced analytics to investigate and respond with confidence.”

    Read the blog: Overwhelmed: Why SOAR Solutions are a Game Changer

    The Sumo Logic Cloud SOAR War Room and App Central add greater efficiency and even more automation to drive the most important Security Operations activities.

    • Make Quick Decisions: The War Room provides a detailed view in chronological order of every relevant event that has happened in a specific incident and step-by-step processes to follow from start to finish via a series of cards. Each card shows the most critical information of the incident at a glance and provides actionable insights and visibility into the results of execution. With the new graph view, analysts gain timely visibility into the incident to make decisions based on the visualization of previous actions to analyze data in a structured way.
    • Increase Automation through the Open Integration Framework (OIF): Sumo

    Logic Cloud SOAR easily integrates with an existing security stack, including solutions for EDR, NDR, IAM, threat intelligence, SIEM, vulnerability management and more. With no limit on third-party API integrations, teams can integrate existing tools and technologies for automation with ease. The OIF not only allows the cyber team to create actions that can be inserted into a playbook but also has additional features that add flexibility such as daemons, triggers, and custom actions.

    • Access a Library of Up-to-Date Playbooks, Actions, and Use Cases: Pre-built, customizable templates, actions and use cases are available in App Central to guide security analysts so they can apply solutions based on the needs of their organization. Curated by Sumo Logic experts, Cloud SOAR is equipped with actions to close investigations on the latest threats.

    Sumo Logic Security Intelligence

    Sumo Logic Cloud SOAR is part of the Sumo Logic Security Intelligence Suite, which includes Cloud Security Monitoring & Analytics, Audit & Compliance, and Cloud SIEM. Powered by the Sumo Logic Continuous Intelligence Platform, Sumo Logic delivers modern, cloud-native solutions for modern security operations. For more information, visit: https://www.sumologic.com/solutions/modernize-security-operations/

    About Sumo Logic

    Sumo Logic Inc. (Nasdaq: SUMO) is the pioneer in continuous intelligence, a new category of software, which enables organizations of all sizes to address the data challenges and opportunities presented by digital transformation, modern applications, and cloud computing. The Sumo Logic Continuous Intelligence Platform™ automates the collection, ingestion, and analysis of application, infrastructure, security, and IoT data to derive actionable insights within seconds. More than 2,100 customers around the world rely on Sumo Logic to build, run, and secure their modern applications and cloud infrastructures. Only Sumo Logic delivers its platform as a true, multi-tenant SaaS architecture, across multiple use-cases, enabling businesses to thrive in the Intelligence Economy. For more information, visit www.sumologic.com.

    Sumo Logic is a trademark or registered trademark of Sumo Logic in the United States and in foreign countries. All other company and product names may be trademarks or registered trademarks of their respective owners.

    Any information regarding offerings, updates, functionality, or other modifications, including release dates, is subject to change without notice. The development, release, and timing of any offering, update, functionality, or modification described herein remains at the sole discretion of Sumo Logic and should not be relied upon in making a purchase decision, nor as a representation, warranty, or commitment to deliver specific offerings, updates, functionalities, or modifications in the future.

  • Styra Pioneers Context-Rich Entitlements for Modern Application Authorization

    Creators and maintainers of Open Policy Agent solve the authorization gap between IAM and application teams with policy-as-code

    Redwood City, CA, Feb. 22, 2022 — Styra, Inc., the founders and maintainers of Open Policy Agent (OPA) and leader of cloud-native authorization, today announced Styra Declarative Authorization Service (DAS) for Cloud-Native Entitlements. Solving the gap between legacy and modern application authorization, this new capability enables Identity-and-Access Management (IAM) teams to take full advantage of existing systems-of-record while providing developer teams what they need—cloud-native, context-rich authorization, replicated across clouds, regions, availability zones and clusters. With Styra DAS, organizations can use their existing centralized IAM systems to seamlessly move applications to the cloud and accelerate their cloud migration with unified authorization.

    As organizations continue their digital transformation, they discover their homegrown entitlement solutions impede progress because their functionality also must be migrated to the cloud. These services are built on top of LDAP, AD, SCIM, etc., and if left on-premises would create a high-latency, single-point-of-failure for a modern application—a clear anti-pattern for cloud applications.

    “For IAM teams that previously had to pull together their own homegrown entitlements band aid, our technology is a game changer,” said Tim Hinrichs, co-founder and chief technology officer of Styra. “Now, with Styra DAS for Cloud-Native Entitlements, IAM teams can finally move to cloud-native technologies and scale to the level their organizations require. We’re the first and only organization to support this for enterprise environments.”

    Styra DAS for Cloud-Native Entitlements

    Styra DAS for Cloud-Native Entitlements allows organizations to decouple rules, regulations and policies from an application and use existing data sources, which:

    • Improves Time-to-Market: seamlessly provide application teams a stateless, easy-to-run cloud-native entitlements service that can be deployed alongside their app.
    • Avoids Costs: use existing centralized IAM systems, avoid costly overhauls and understand the impact a policy will have on the application.
    • Provides Audit-Ready Authorization: access to pre-built policy packs that align to decision logs—the proof of authorization implementation is clear and exportable.

    “Styra DAS for Cloud-Native Entitlements is addressing a difficult problem that many enterprise IAM teams are facing as they move to cloud-native environments,” said Martin Kuppinger, Founder and Principal Analyst at KuppingerCole. “There is a strong need for policy-based management of these entitlements. Styra is launching an innovative solution to address these challenges.”

    Styra has experienced substantial growth and recently secured $40 million in a Series B funding round in May 2021. In 2022, Styra will add to its turnkey control plane for OPA to provide unified authorization across the cloud-native stack. With the open source project growing 300% YoY to hit over 125M downloads to date, OPA has become the de facto standard for authorization in the cloud-native environment. Styra DAS provides a unified policy-as-code platform, built on OPA, to ensure that cloud infrastructure, Kubernetes, application and service mesh deployments are secure and compliant. Together, OPA and Styra DAS provide security, operations and compliance guardrails across the entire cloud-native stack.

    To learn more about Styra DAS for Cloud-Native Entitlements, download our whitepaper or visit our website.

    About Styra

    Styra enables enterprises to define, enforce and monitor policy across their cloud-native environments. With a combination of open source (Open Policy Agent) and commercial products (Declarative Authorization Service), Styra provides security, operations and compliance guardrails to protect applications, as well as the infrastructure they run on. Styra policy-as-code approach lets developers, DevOps, and security teams mitigate risks, reduce human error and accelerate application development. Learn more at Styra.

  • IBM Automation Insights: Improving Observability and App Performance

    IBM Automation Insights: Improving Observability and App Performance

    Observability offers deep visibility into the internal state of complex systems in order to quickly identify and troubleshoot performance issues to keep up with customer expectations and business requirements. Observability enables better application performance monitoring (APM). So, how can DevOps teams gain full observability into modern applications? 

    On Feb. 23, experts from IBM and GitLab will come together at the IBM Automation Insights virtual event to discuss how to effectively observe, manage and maintain applications across platforms and how to improve application performance.

    The virtual event has been curated to create interactive sessions, led by DevOps experts who will deep dive on the latest innovations, conduct demos and share approaches that tackle challenges.

    IBM Automation Insights features a speaker lineup of distinguished engineers, IT leaders and executives, including:

    • Cosmo Schillaci, DevOps business leader at IBM
    • Jennifer Velasquez, Americas DevOps leader at IBM
    • Laurel Dickson-Bull, product manager at IBM
    • Kurt Dusek, senior solutions architect at GitLab
    • Jamie Coleman, software engineer at IBM

    Attendees will learn how Instana and GitLab can enable DevOps teams to accelerate CI/CD pipelines and how to build applications easily using cloud-native Java applications and microservices locally, with containers, and for OpenShift/Kubernetes.

    There will be a cross-platform panel discussion in which attendees will get a chance to interact with the speakers, ask questions on any of the strategies presented and discuss several topics, including cybersecurity, optimization for observability, vulnerability tool proliferation and more.

    For more information and to register, please visit the IBM Automation Insights website.

  • Shoreline Announces Multi-Cloud Incident Automation

    Added support for GCP and Azure enables Shoreline customers to debug, repair, and automate across multi-cloud environments, reducing operations complexity

    Redwood City, CA, Feb. 16, 2022 — Shoreline.io, the Incident Automation company, today announced the general availability (GA) of its platform on Microsoft Azure and Google Cloud Platform (GCP), building on existing GA support for AWS. With today’s news, customers can seamlessly remediate issues across their multi-cloud environments as if they were working on a single box.

    Today’s DevOps teams struggle with manually managing differing resource hierarchies, tags, credentials, and accounts across multi-cloud fleets. They have to learn each cloud provider’s tools and the nuances of configuring and maintaining their fleets. It can be challenging to query resources and execute actions across clouds, accounts, clusters, or regions to debug or repair an infrastructure issue.

    Shoreline manages the cloud-specific complexity of discovering resources, scraping metrics, and building automations, with commands executed in parallel across VMs and containers in all three clouds. Interactive commands return in seconds, regardless of fleet size. This allows SREs to debug in real-time and quickly build automations across the three largest cloud providers, increasing reliability.

    “Multi-cloud environments are becoming ever more common and complicated to operate,” said Anurag Gupta, CEO and founder of Shoreline. “Shoreline’s ability to provide parallel fleet-wide debugging and automated remediation has been proven with AWS. With today’s announcement, we now offer the same seamless experience across Azure and GCP as well. This makes it simpler for customers to debug incidents and automate repairs without intricate hand-coding for each cloud environment.”

    All Shoreline capabilities, including role-based access control and audit, run consistently across clouds, reducing the challenges of managing multi-cloud production environments. Shoreline automatically discovers resources and tags, providing a unified resource hierarchy across cloud environments. Customers can transparently query and execute actions across clouds, regions, accounts, and clusters without logging in and out of different VPNs, reducing manual labor and the need to juggle many cloud-specific tools.

    “If you need to manage a multi-cloud fleet, Shoreline is your best answer,” said Dr. Jay Yu, VP Product and Innovation and GM San Diego Innovation Lab at TigerGraph. “Shoreline’s approach streamlines remediation of incidents in our production cloud, and it eliminates the complexities inherent in operating across multiple cloud providers. This means we can understand and resolve issues faster, which increases our system availability.

    Whether you are handling instance maintenance events in a multi-cloud environment, moving or copying files to cloud storage, or autoscaling, Shoreline allows users to take full advantage of each cloud without worrying about the differences between clouds.

    To learn more or start a free trial visit: https://shoreline.io/blog/multi-cloud-operations-can-be-easy

    Helpful Links

     

    About Shoreline

    Shoreline provides real-time automation and control for cloud operations. Shoreline makes it easy for DevOps engineers to diagnose and repair incidents and quickly create automated remediations to fix them forever. Founded in 2019, Shoreline has raised $22M from Canvas Ventures and NTT VC. The company is headquartered in Redwood City, California. To learn more, visit https://shoreline.io/.

  • Skuid Acquires InFlight to Help Enterprise Companies Champion People Operations

    Chattanooga, TN, February 3, 2022 – Skuid, a leading toolkit for creating human-centered digital experiences, announced the acquisition of InFlight Corporation today. The InFlight platform helps enterprise organizations modernize their business applications and improve the talent and employee experience (EX). Together, Skuid and InFlight will offer the most complete solution for enterprises seeking to optimize people operations, from talent acquisition to talent management and beyond, by creating modern user experiences that are integrated with their systems of record, with unprecedented speed and ease.

    Hundreds of companies, including Baker Hughes, the U.S. Department of Veterans Affairs, GolfNow, AMD, John Hancock and TalkDesk already use Skuid to build applications for people operations. This includes employee portals, audit, compliance, and workplace risk apps, recruiting and retention apps, onboarding apps, time management and reporting apps, and many others. The acquisition of InFlight extends the already impressive HR focus of Skuid, adding much deeper integrations with popular human capital management (HCM) enterprise solutions including Oracle PeopleSoft, Workday, Taleo and SAP SuccessFactors.

    “This is a game-changer for the future of people operations applications. The combined capabilities of Skuid and InFlight present a much-needed solution for enterprises that want to design, create, and deliver impactful apps,” says Ryan Niemann, Skuid CEO. “With the addition of InFlight, enterprise companies can now leverage the unique human-centered design approach of Skuid with integrations across HCM applications.”

    EX is falling short for most enterprises at a time when they need to better support their people and recruit and retain top talent. According to a recent Gartner survey, only 13% of employees are fully satisfied with their experience—the daily interactions with people, processes and technology necessary to their jobs. As workforces become increasingly digital and business priorities rapidly evolve, the right technology is no longer nice to have—it’s imperative. But having the right technology is only part of the solution. Enterprises need the right product and the right process. The human-centered design process of Skuid combined with the newly expanded offering of Skuid + InFlight provides a unique and complete path for enterprises to optimize talent and employee apps.

    With the ability to easily craft modern user experiences with Skuid, backed by InFlight integrations, enterprises can quickly create web-based, fully accessible apps across their people-facing stack, including human resource software (HRS), human resources information systems (HRIS), applicant tracking systems (ATS) and others. This results in greater control of EX without the need for heavy coding.

    James La Brash, founder and CEO at InFlight, shares, “We are thrilled to join the Skuid team. InFlight brings unique new integration capabilities to enterprises using Skuid while enhancing our own customer offering with low-code UI-building capability. This marks a new era for EX in the HCM market, where enterprises can empower citizen developers and IT teams to quickly and easily improve the digital EX of their existing applications in response to changing employee expectations and market conditions. Providing enterprises with greater agility, Skuid + InFlight will enable them to gain a competitive market advantage.”

    New and existing customers can use the Skuid + InFlight combination to dramatically unlock the value of existing systems, easily tailoring human-friendly enterprise applications and experiences across revenue, customer and people operations. Companies can seamlessly integrate multiple applications, unify disparate data and processes, and simplify the UX to drive adoption and increase productivity.

    Terms of the transaction will not be disclosed. JMP Securities LLC acted as financial advisor to Skuid. Catapult Advisors LLC acted as financial advisor to InFlight Corporation.

    About InFlight (inflightintegration.com)

    InFlight Employee Experience Platform (EXP) recognizes and resolves productivity bottlenecks while enhancing the digital experience provided by enterprise applications, removing friction for job candidates and employees. InFlight EXP uses analytics to identify, quantify, and solve for user experience challenges, increasing user adoption, reducing costly training and support requirements, and dramatically streamlining workflows.

    ‍
    About Skuid (skuid.com)

    Generic applications rarely match the unique needs of your people, which kills adoption, productivity, and ROI. Admins and developers increase app adoption and innovation with low-code tools from Skuid. Thousands of builders have used Skuid to create custom digital experiences—up to 10 times faster—for millions of users across dozens of countries, dramatically increasing adoption and innovation.‍

  • Tackle.io Launches New Program to Help Startups Kick off Their Cloud Marketplace Journey

    Startups can drastically reduce time to list and sell products on four major Cloud Marketplaces with zero engineering resources required

    Boise, ID, Feb. 1, 2022 — Tackle.io, a software company dedicated to helping software providers generate revenue through the clouds, today announced its new Startup Acceleration Program to help independent software vendors (ISVs) generate revenue through the four major Cloud Marketplaces—AWS, Microsoft Azure, Google Cloud, and Red Hat Marketplace. Through the program, early-stage ISVs can fast-track a Cloud Marketplace listing while learning the ins and out of Marketplace selling from Tackle.

    Today, most startups are built cloud-native and integrating the cloud into their go-to-market strategies from day one is a natural complement. The Cloud Marketplaces are a perfect starting point because they unlock access to buyer budgets, limit time spent in legal and procurement by using cloud contracts, and offer the ability to streamline early deals. However, listing a product on a Marketplace can be challenging, especially for early-stage companies with limited developer resources to dedicate to non-product work. With 83% of software buyers stating that they are likely or extremely likely to purchase through the Marketplace in the future, early-stage ISVs must meet their buyers where they are – in the clouds.

    “The Cloud Marketplaces are a fast-growing channel, and early-stage ISVs are in a prime position to take advantage of it,” said John Jahnke, CEO at Tackle. “We want to invest in startups and enable them to accelerate their revenue with the clouds. We know how tricky it can be to navigate the nuances of selling your product on the Marketplaces while simultaneously developing a product, recruiting a team, and establishing a brand. We created the Startup Acceleration Program so early-stage companies have access to the technology and resources necessary to kick off their Cloud GTM journey the right way.”

    To qualify for the Startup Acceleration Program, ISVs must be early-stage (seed, angel, or Series A), have less than $5M in revenue, and have fewer than 30 employees with a market-ready SaaS product. The ISV must also meet the Cloud Provider’s listing requirements.

    Once qualified, ISVs have access to Tackle’s Cloud Marketplace Platform, including premium features needed to launch and grow a Marketplace business, and a team of Tackle experts ready to be a go-to-market resource. These include:

    • Smart Onboarding: Provides a frictionless process to product listing across all Marketplaces

    • Tackle Offers: Simplifies the selling process by streamlining seller workflow and providing visibility into an order’s movement through acceptance stages

    • Easy Metering: Minimal engineering for a better way to manage monthly financial activities

    • Reporting and Insights: Access to advanced reporting, aggregated views, and real-time visibility into the entire purchase cycle, no from quote to cash

    • Marketplace Success Resources: Receive guided onboarding and consultative sessions with Tackle experts along with access to on-demand resources, including Tackle Academy and Knowledge Base.

    “Running a startup is hectic, but Tackle’s Startup Acceleration Program is helping us grow in the right direction,” said Alexis Culp, Director of Alliances at Censys. “Getting listed on the Cloud Marketplaces alone would be a heavy lift for our team, costing us greatly in time, money, and resources. With Tackle, we have been able to stand up a listing and prepare to transact, and we have comfort in knowing that we have continued support from Tackle as we scale.”

    To learn more about the Tackle Startup Acceleration Program, visit tackle.io/startups.

    About Tackle

    Tackle is a software company dedicated to helping software providers accelerate revenue through Cloud Marketplaces. Tackle’s Cloud Marketplace Platform drastically reduces time to list and sell products on the Marketplaces while providing granular transaction reporting, all with zero engineering resources required. Tackle works with 350+ cloud leaders today, including A Cloud Guru, AppDynamics, Auth0, Fivetran, HashiCorp, Looker, McAfee, NewRelic, PagerDuty, and Talend. Tackle is available for purchase on the AWS Marketplace, Azure Marketplace, Google Cloud Platform Marketplace, and Red Hat Marketplace.

  • Octopus Deploy Acquires Dist to Power Cloud-Native Software Deployments

    • Continuous deployment orchestration software company, Octopus Deploy, announces acquisition of Dist, a cloud-native container registry solution. 
    • Dist’s technology will provide seamless container registry experience to Octopus Deploy customers
    • Brisbane-based company’s first acquisition since USD$172.5m capital raise from Insight Partners

    BRISBANE, Australia – Feb. 1, 2022  (Jan. 31, 2022) – Octopus Deploy, a leading provider of continuous deployment orchestration software, today announced that it has acquired Dist, a Sydney-based cloud-native container registry and artifact repository service.

    Over the past decade, container technology that seamlessly deploys software to any computing environment has exploded in popularity. These containers package everything required to run software, from the executable program, systems tools, libraries and settings, simplifying the deployment process so that applications can run on any operating system without the need for extensive revisions to operate.

    In the Flexera 2021 State of the Cloud Report, 49% of organizations surveyed said they are currently using containerized applications in public clouds, and a further 39% are either currently experimenting with or plan to use containerized applications.

    The acquisition and integration of Dist will make deploying cloud-native applications with Octopus even more seamless. Customers will also be able to deploy applications faster, meet their compliance objectives with retention policies and minimize storage costs for cloud-native apps.

    Octopus Deploy CEO and co-founder Paul Stovell said that Dist’s technology and expertise would be central to the company’s platform as it continues to build out its public and on-premises cloud functionality.

    Octopus Deploy met with Dist back in October last year, and immediately noticed a lot of similarities between the two companies. Just like Octopus Deploy, Dist was entirely bootstrapped by its two Sydney-based founders, Yun Huang Yong and Stephen Haynes, who will both join Octopus Deploy as cloud architects within its cloud division. The Dist brand will also be merged into Octopus Deploy.

    “In the past, if we identified functionality that was missing in Octopus Deploy, our first instinct would have been to spin up a team of engineers to develop that functionality, but as we’re growing and maturing we realize, starting from scratch in-house won’t always be the best way to serve our customers,” said Stovell.

    “Together with the Dist team, we will make it even easier for software teams to deliver more features and reduce downtime, and with less effort to manage. I am delighted to welcome the Dist team to Octopus Deploy and can’t wait to see what we build together!”

    Following the announcement in April 2021 that Insight Partners has invested USD$172.5 million, Octopus Deploy has also gone from strength-to-strength, growing revenue by 60% in 2021 and more than doubling staff headcount to 179 people.

    About Octopus Deploy 

    Founded in 2012, Octopus Deploy helps DevOps teams at over 25,000 companies accelerate reliable, repeatable, and traceable deployments across clouds and on-prem infrastructure. Octopus provides an API-first approach, built-in multi-tenancy, security, release management, deployment and runbook automation across all teams, projects, and tech stacks. Our customers get best practices with access to 500+ automation step templates. Octopus also integrates with hundreds of technologies, including Azure, AWS, GCP, and Kubernetes. Companies use Octopus Deploy to minimize downtime, deliver more features and meet their compliance needs.

  • Anchore Continues Expansion into Software Supply Chain Security Market

    New customer adoption and open source community involvement fuel expansion

    Santa Barbara, CA, January 28, 2022 — Anchore today announced strong results in the software supply chain security market over the last year. With concerns about the security of the software supply chain driving demand for automated tooling and a rise in SBOM adoption across the industry, Anchore has delivered new product capabilities, seen exploding adoption of its open source tools, and continued to proactively prepare its customers and organizations for inevitable future breaches and hacks.

    Software Supply Chain Security Focus

    2021 started with the fallout of the SolarWinds SUNBURST attack and ended with multiple exploits against the Log4j zero-day vulnerability, highlighting the critical importance of securing the software supply chain. According to the Anchore 2022 Software Supply Chain Security Report, 62 percent of organizations were affected by a software supply chain security attack last year. Software suppliers face increased risk with 73 percent impacted by an attack.

    The report also highlights that organizations are responding to these risks with 54 percent placing a heavy focus on securing the software they build and use. While the U.S. Executive Order on Improving the Nation’s Cybersecurity highlights the software bill of material (SBOM) as a critical foundation for supply chain security, 76 percent of organizations plan to increase use of SBOMs next year. The importance of SBOMs, combined with the need for automated tooling and continuous security checks in the development process, is driving significant growth in Anchore’s software supply chain management solutions.

    “Recent security breaches have catapulted the topic of software security to the forefront of business conversations everywhere. Software supply chain security does not just impact the software industry, today every organization needs to bolster their security practices to reduce risk in their cloud-native applications,” said Said Ziouani, CEO of Anchore. “Last month’s Log4j zero-day vulnerability underscores the need for organizations to use SBOMs and automated tooling to reduce the risk of successful attacks and speed remediation of the next zero-day vulnerability.”

    Customer Growth

    In 2021 Anchore saw 2.5 times growth in ARR from the prior year, as organizations looked to proactively secure their software supply chains against growing exploits. Anchore customers include the largest global enterprises as well as government agencies. In 2021 Anchore welcomed leading Fortune 100 organizations to the customer roster, joining dozens of Global 500 organizations and major software companies that use Anchore technology to secure their software supply chains. New customer NVIDIA uses Anchore to secure containers for AI, machine learning and high-performance computing on the NVIDIA NGC.

    Anchore more than tripled its government customers in 2021, adding the U.S. Space Force’s Kobayashi Maru program along with numerous programs across the U.S. Air Force, U.S. Department of Defense, U.S. General Services Administration, U.S. Navy, U.S. Marine Corps and the Defense Information Systems Agency (DISA). Anchore also expanded its relationship with the U.S. Air Force Platform One program with a $4.6M contract to harden its software supply chain with a focus on container scanning technology and services.

    Product Expansion 

    Over the past twelve months the company advanced its software supply chain management capabilities, with multiple releases to the Anchore Enterprise platform. New capabilities include:

    • Broadened coverage of the software supply chain by making the security status of running images visible to developers and security teams reducing the risk of insecure code being included in production applications.

    • Expanded remediation capabilities with remediation recommendations and automated workflows.

    • A new FedRAMP policy pack that enables software vendors and cloud service providers to identify and resolve compliance issues for containerized applications and shorten the timeline to achieve a FedRAMP authority to operate (ATO) certification.

    • Ability to automate STIG checks for cloud-native applications and provide a unified view of both vulnerabilities and STIG compliance vulnerabilities that are required by the U.S. Department of Defence applications.

    • A new policy pack that alerts on vulnerabilities found in the CISA catalog of Known Exploited Vulnerabilities.

    Rapid Adoption of Open Source Tools

    Anchore saw accelerating adoption of its two open source software supply chain security tools that easily integrate into development processes and toolchains. Syft, a tool that performs deep inspection of container images and filesystems to generate an SBOM, now has over 400,000 downloads, representing a 150% increase in the last 5 months. Grype, a vulnerability scanner, now has over 500,000 downloads, an 80% increase in the same time period. Together, Syft and Grype have garnered over 4,500 stars on GitHub, a tenfold increase since the beginning of 2021.

    Updates to Syft and Grype in 2021 include the ability to generate accurate SBOMs and vulnerability reports via plugins to popular CI/CD systems including GitHub, GitLab, and Jenkins. Syft has also added support for the Software Package Data Exchange (SPDX) standard which makes it easy to share data across systems and organizations. SPDX is an internationally recognized ISO standard for SBOMs that is sponsored by the Linux Foundation.

    “The ability to produce accurate SBOM and vulnerability results from a wide variety of software artifacts has led to growing adoption of Syft and Grype by both the open source community and end users, particularly as more and more project maintainers are looking to include security tooling directly into their development environments,” said Daniel Nurmi, CTO and co-founder of Anchore. “During the initial and on-going response to the Log4j zero-day vulnerability, practitioners were able to quickly and easily identify the presence of Log4j across their software environments using Anchore’s Syft and Grype tools, even when the library was nested several levels deep inside Java archives, which has led to a large jump in downloads and usage.”

    “As enterprises look to accelerate their operational velocity, an increasing number of them are focusing on improving their developer experience. The challenge facing these organizations is how to offer a frictionless experience to their developers while simultaneously improving their overall security posture,” said Stephen O’Grady, Principal Analyst with RedMonk. “One approach that’s growing in popularity is to integrate API-driven security resources into their existing development toolchains. This is exactly the opportunity that Syft and Grype were constructed for.”

    For more information about Anchore’s technology and software supply chain security offerings go to Anchore.com.

    About Anchore

    Anchore is a leader in software supply chain security and enables organizations to protect cloud-native applications against software supply chain attacks. Anchore technology embeds continuous security and compliance checks at every stage of the software development process to prevent security risks from reaching production. Large enterprises and government agencies use Anchore solutions to generate a comprehensive software bill of materials, pinpoint vulnerabilities, identify malware and discover unprotected credentials that can lead to hacks and ransomware. With an API-centric approach, Anchore solutions integrate into the tools developers already use to detect issues earlier, saving time and lowering the cost to fix vulnerabilities. To learn more visit www.anchore.com.