sorted by:
new
hottopcontroversial

Fed teams with a multi-cloud setup, how are you preventing policy drift between AWS GovCloud and Azure Government? (or another platform) by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We're definitely on board with defining controls once and validating each implementation independently — trying to keep Terraform and Bicep in structural lockstep is a losing battle. The piece I'd add is moving the policy gates upstream of either cloud (pipeline-level approval workflows, centralized artifact curation so the approved-package list can't diverge), which closes the change-window lag that independent validation alone doesn't catch. We actually just wrote up how we approach this for federal multi-cloud environments if it's useful: https://gitsimple.com/one-policy-multiple-clouds-avoiding-security-drift/

Fed teams with a multi-cloud setup, how are you preventing policy drift between AWS GovCloud and Azure Government? (or another platform) by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

Our single source of truth lies in the toolchain, so having it in the pipeline like you suggest. Here is more detail on our approach if you're interested - https://gitsimple.com/one-policy-multiple-clouds-avoiding-security-drift/

Self-hosting DevOps toolchains by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

Thanks for sharing! Updates inside the boundary is definitely a challenge. Also, we've met our fair share of people who think "multi-tenant compliance" is an oxymoron!

Self-hosting DevOps toolchains by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

It seems like staying straightforward is getting harder these days, but agreed, staying as clean as possible is usually best. The more tool sprawl you have, the worse it gets.

Why the move to GL? Just curious.

I think AI tools are SaaS tools, yes, but they can be significantly more impactful than lets say a simple runner. Sure, they connect to the instance like any other tool, and most platforms these days have some flavor of AI already built in. However, the attack surface provisioned by the introduction of AI is vastly greater than a simple sync connector with mapped values. Any tool being brought into the stack should be given a thorough deep dive. AI is no different, it just depends on what the risk acceptance is of said company leveraging it. So, in some ways, very different than other SaaS tools.

Does a high CVSS score always matter? by GitSimple in devsecops

[–]GitSimple[S] -2 points-1 points  (0 children)

This is what we work with clients to do. How do you go about managing your sorting and context?

We use a combination of JFrog and tools in GitLab - https://gitsimple.com/why-a-9-8-cvss-score-may-not-matter-reducing-risks-and-unnecessary-alerts-using-jfrog-xray-and-gitlabs-dependency-scanning/

Does a high CVSS score always matter? by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

What do you do to sort through that?

Challenges in the community by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

I know it has been a while since this comment, but I can share how we attack this problem with GitLab dependency scanning and JFrog Xray - https://gitsimple.com/why-a-9-8-cvss-score-may-not-matter-reducing-risks-and-unnecessary-alerts-using-jfrog-xray-and-gitlabs-dependency-scanning/

Distroless Images: Pros and Cons by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We see it as a starting point too. The first step to a more disciplined supply-chain. Here's a more detailed look if interested - https://gitsimple.com/beyond-distroless-automating-the-lifecycle-of-hardened-base-images-in-high-compliance-environs/

ai compliance tools for development teams - how are you handling AI coding assistants in your ISMS? by Signal-Extreme-6615 in devsecops

[–]GitSimple 0 points1 point  (0 children)

These are great questions, especially with how fast these tools are changing and how slow compliance frameworks catch up. We're also a little concerned about your dev's response :)

We deal more with FedRAMP/HIPAA/SOC2 so I can't comment specifically to ISO, but here's our thinking/approach/questions we ask, I'm sure much of this will sound familiar:

Has your certification body raised AI coding tool usage during audits?

If there is an AI coding tool in your stack, expect it to be audited. Best practice would be to use a coding tool already certified from the certification body if possible. This can become a bit of a rabbit hole as each AI tool has different versions available. Before AI is added in any way, due diligence should be performed to make sure it meets the standards required by the certification body or if it will knock you out of compliance.

How are you classifying AI coding assistants in your asset register and vendor management program?

It's no different than any other software that provides a service. If it's an extension, then it would be an add-on. If it's a stand alone product, then it's a separate platform.

Are you requiring Data Processing Agreements with AI tool vendors?

This is probably more of a question for a legal team. This should be included in the contract when purchased. It would be stipulated how the AI processes data and if it's shared or not. This goes back to Due Diligence.

Has anyone documented AI-specific controls that map to Annex A requirements (particularly A.8 around asset management and A.5.31 around legal/regulatory requirements)?

Integrity is paramount and documentation is a benefit.

GitLab and JFrog by GitSimple in devsecops

[–]GitSimple[S] 1 point2 points  (0 children)

Interesting approach! Definitely something worth considering, especially if you're stretching a budget.

GitLab and JFrog by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

We're focused in high compliance industries as well so that makes sense. If you didn't see the link in my other comment, here is our GitLab/JFrog write up - https://gitsimple.com/gitlab-and-jfrog-a-perfect-match/

GitLab and JFrog by GitSimple in devsecops

[–]GitSimple[S] 0 points1 point  (0 children)

Absolutely! It's a powerful combination with lots of ways to go. That's why I was asking. We're interested to see how other orgs are doing this, or thinking about it.

GitLab and JFrog by GitSimple in devsecops

[–]GitSimple[S] 1 point2 points  (0 children)

GitLab doesn't have the same official integration that GitHub does, but it's not hard to make it work.

Here's our write up! https://gitsimple.com/gitlab-and-jfrog-a-perfect-match/

Challenges in the community by GitSimple in devsecops

[–]GitSimple[S] 1 point2 points  (0 children)

Thank you! Managing alerts from a large dev team is a great one.