Intro Security and compliance controls are an important part of the software development life cycle. When organizations and teams move software delivery from months to hours, the processes related to compliance evaluation can become a bottleneck for delivery. In his article, “Compliance in a DevOps Culture,” Carl Nygard outlines different approaches teams can take to Read more…
Built on Control Tower Mphasis Stelligent is proud to be an AWS Built on Control Tower Partner and a Management and Governance Partner! Find this blog interesting? Make sure you register and join us on Nov 17 for an AWS Control Tower Activation Day. Control Tower and BoCT Overview Cloud transformation is a large undertaking. The setup and Read more…
Many enterprises attempt to drive software development and delivery towards a DevOps mindset. Likewise, organizations struggle with increasing security challenges while adopting these innovative software practices. Embedding security within the deployment lifecycle is non-negotiable. Therefore, integration of security into CI/CD workflows need be done cautiously to meet an ever-evolving technology landscape. DevSecOps is an important Read more…
“AWS Config provides AWS managed rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resources comply with common best practices.” (Source) There are over 100 Managed Config Rules that AWS provides for all types of checks including Analytics, Compute, Database, Machine Learning, Security, Identity & Compliance, and Storage – Read more…
Whether it’s in or out of the cloud, most IT compliance usually comes in the form of a multitude of checklists – like the one you see below. It might be a spreadsheet, website, or other “digital” tool but, in the end, it’s still checklists that software teams must comply with by filling out forms Read more…
It’s 7:37 AM on a Sunday. You’re in the Security Operations Center (SOC) and alarms and emails are seemingly being triggered everywhere. You and a colleague are combing through dashboards and logs to determine what is causing these alerts. After running around with your “hair on fire” for around 30 minutes, you finally determine that Read more…
This is an older post. For newer information please check out these posts: Deployment Pipeline Compliance and Control – a Service-based Approach Continuous Compliance on AWS with CodePipeline and CloudFormation Continuous Compliance on AWS Workflow How does compliance work in many organizations? From what I’ve seen, it might look something like this: ‘Internal compliance is Read more…
In the book, Accelerate, by Forsgren, et al., it states the following about Segregation of Duties: What About Segregation of Duties?…First, when any kind of change is committed, somebody who wasn’t involved in authoring the change should review it either before or immediately following commit to version control. Second, changes should only be applied Read more…