The reengineering of the Internet is now underway for our next
generation beyond the millennials. The unification of corporate
software development and information security teams are experiencing a deja vu and reminiscent of scenes from the 1993 movie "Groundhog Day."
Operational Risk Management (ORM) is hopeful that we are having a new
resurgence of software vulnerability management thinking. Why?
"A weather man is reluctantly sent to cover a story about a weather forecasting "rat" (as he calls it). This is his fourth year on the story, and he makes no effort to hide his frustration. On awaking the 'following' day he discovers that it's Groundhog Day again, and again, and again. First he uses this to his advantage, then comes the realization that he is doomed to spend the rest of eternity in the same place, seeing the same people do the same thing EVERY day." --Groundhog Day
We are seeing the reunification of 1990's Software Quality Assurance (SQA) thinking, combined with the rigor of new 21st century rapid software development disciplines. It is called "Rugged DevOps." Application development life cycles are getting shorter these days. That is because modern day software development life cycles are taking a more component-based approach, with the reuse of standardized software capabilities. This makes sense, as long as the use of software quality assurance tools and services are not abandoned and new tools and processes are embraced.
Welcome to "Rugged DevOps." This Forrester report, "The Seven Habits of Rugged DevOps" will give you more context:
Habit 1: Increase Trust And Transparency Between Dev, Sec, And Ops
Habit 2: Understand The Probability And Impact Of Specific Risks
Habit 3: Discard Detailed Security Road Maps In Favor Of Incremental Improvements
Habit 4: Use The Continuous Delivery Pipeline To Incrementally Improve Security Practices
Habit 5: Standardize Third-Party Software And Then Keep Current
Habit 6: Govern With Automated Audit Trails
Habit 7: Test Preparedness With Security Games
"Enabling Digital Trust of Global Enterprises" in the next decade will require software development organizations to embrace security and risk professionals simultaneously, on a more consistent and non-adversarial basis:
Here are 9.5 million more reasons why:
In 2007, a class action lawsuit was filed in the United States District Court of the Northern District of California against Facebook on behalf of 3.6 million users of Facebook concerning its “Beacon” program. KamberLaw represented the plaintiffs in this action and Cooley LLP represented Facebook. This suit was settled in 2009 and was granted final approval by the Hon. Richard Seeborg in March 2010. As part of the settlement, the parties created the Foundation (the Digital Trust Foundation) “the purpose of which shall be to fund projects and initiatives that promote the cause of online privacy, safety, and security.” The case settled for $9.5 million, with the Foundation receiving approximately $6.7 million after attorney’s fees, payments to plaintiffs, and administrative costs. There were four objectors to the settlement, two of whom appealed the approval to the Ninth Circuit Court of Appeals and subsequently the Supreme Court. But ultimately, in November 2013, the appeals were rejected and the Foundation was funded. The Foundation will distribute more than $6 million and will close its doors once all of the grants have been distributed and completed.
The corporate Board of Directors conversations about the topic of "Digital Trust" is now ongoing and the subject of new business units. Security vs. Privacy has been a recent media frenzy between some of our technology companies and the U.S. government. Your elected officials in the U.S. House of Representatives are also on the hot seat now, to produce new relevant legislation. The courts are adding more privacy and data breach cases to the docket each week. The "Digital Equilibrium Project" is being established and will hopefully include an international set of stakeholders.
Authoring the rules that everyone understands and everyone can agree on, sets the stage or playing field for the environment of competition to engage with some sense of civility. Rules will be broken in plain sight and the referee (law enforcement, judges, courts, juries) will impose a penalty, while potentially millions of people watch live. Is it a penalty kick or just a loss of down?
Think global. Think at the speed of light. Think about the trust of e-commerce transactions where millions of people rely on our computing machines every waking minute of the day. Where Zettabytes of data are in use. The rules on the "Digital Playing Field" are vital to our future social and economic well being.
"Rugged DevOps" is another and necessary component of a safe, private and secure Internet ecosystem. Operational Risk Management (ORM) professionals are evermore concerned, with the root cause of our current Privacy vs. (soon to be "And") Security headlines. Digital Trust is hard to achieve and yet easy to forfeit. It is time for us to begin "Reengineering for our Next Generation".
"A weather man is reluctantly sent to cover a story about a weather forecasting "rat" (as he calls it). This is his fourth year on the story, and he makes no effort to hide his frustration. On awaking the 'following' day he discovers that it's Groundhog Day again, and again, and again. First he uses this to his advantage, then comes the realization that he is doomed to spend the rest of eternity in the same place, seeing the same people do the same thing EVERY day." --Groundhog Day
We are seeing the reunification of 1990's Software Quality Assurance (SQA) thinking, combined with the rigor of new 21st century rapid software development disciplines. It is called "Rugged DevOps." Application development life cycles are getting shorter these days. That is because modern day software development life cycles are taking a more component-based approach, with the reuse of standardized software capabilities. This makes sense, as long as the use of software quality assurance tools and services are not abandoned and new tools and processes are embraced.
Welcome to "Rugged DevOps." This Forrester report, "The Seven Habits of Rugged DevOps" will give you more context:
Habit 1: Increase Trust And Transparency Between Dev, Sec, And Ops
Habit 2: Understand The Probability And Impact Of Specific Risks
Habit 3: Discard Detailed Security Road Maps In Favor Of Incremental Improvements
Habit 4: Use The Continuous Delivery Pipeline To Incrementally Improve Security Practices
Habit 5: Standardize Third-Party Software And Then Keep Current
Habit 6: Govern With Automated Audit Trails
Habit 7: Test Preparedness With Security Games
"Enabling Digital Trust of Global Enterprises" in the next decade will require software development organizations to embrace security and risk professionals simultaneously, on a more consistent and non-adversarial basis:
DevOps practices can only increase speed and quality up to a point without security and risk (S&R) pros' expertise. Old application security practices hinder speedy releases, and security vulnerabilities represent defects that can leave a company open to cyberattacks. But DevOps practitioners can leap forward with both increased speed and quality by including S&R pros in DevOps feedback loops and including security practices in the automated life cycle. These new practices are called rugged DevOps. This report presents the seven main principles of rugged DevOps so I&O pros and developers can break down barriers with S&R pros and achieve faster releases with stronger application security.Chief Information Officers (CIO), Chief Privacy Officers (CPO), Chief Legal Officers (CLO), Chief Operating Officers (COO), Chief Security Officers (CSO) and maybe the Chief Executive Officers (CEO) are now paying more attention to these issues.
Here are 9.5 million more reasons why:
In 2007, a class action lawsuit was filed in the United States District Court of the Northern District of California against Facebook on behalf of 3.6 million users of Facebook concerning its “Beacon” program. KamberLaw represented the plaintiffs in this action and Cooley LLP represented Facebook. This suit was settled in 2009 and was granted final approval by the Hon. Richard Seeborg in March 2010. As part of the settlement, the parties created the Foundation (the Digital Trust Foundation) “the purpose of which shall be to fund projects and initiatives that promote the cause of online privacy, safety, and security.” The case settled for $9.5 million, with the Foundation receiving approximately $6.7 million after attorney’s fees, payments to plaintiffs, and administrative costs. There were four objectors to the settlement, two of whom appealed the approval to the Ninth Circuit Court of Appeals and subsequently the Supreme Court. But ultimately, in November 2013, the appeals were rejected and the Foundation was funded. The Foundation will distribute more than $6 million and will close its doors once all of the grants have been distributed and completed.
The corporate Board of Directors conversations about the topic of "Digital Trust" is now ongoing and the subject of new business units. Security vs. Privacy has been a recent media frenzy between some of our technology companies and the U.S. government. Your elected officials in the U.S. House of Representatives are also on the hot seat now, to produce new relevant legislation. The courts are adding more privacy and data breach cases to the docket each week. The "Digital Equilibrium Project" is being established and will hopefully include an international set of stakeholders.
Authoring the rules that everyone understands and everyone can agree on, sets the stage or playing field for the environment of competition to engage with some sense of civility. Rules will be broken in plain sight and the referee (law enforcement, judges, courts, juries) will impose a penalty, while potentially millions of people watch live. Is it a penalty kick or just a loss of down?
Think global. Think at the speed of light. Think about the trust of e-commerce transactions where millions of people rely on our computing machines every waking minute of the day. Where Zettabytes of data are in use. The rules on the "Digital Playing Field" are vital to our future social and economic well being.
"Rugged DevOps" is another and necessary component of a safe, private and secure Internet ecosystem. Operational Risk Management (ORM) professionals are evermore concerned, with the root cause of our current Privacy vs. (soon to be "And") Security headlines. Digital Trust is hard to achieve and yet easy to forfeit. It is time for us to begin "Reengineering for our Next Generation".
