CloudBees Raises the Bar for DevSecOps with Audit-Ready Software Delivery Pipelines

DEVOPS WORLD 2020--CloudBees, Inc., the enterprise software delivery company, today announced a robust new set of DevSecOps capabilities for CloudBees CI and CloudBees CD. The new capabilities enable customers to perform early and frequent security checks and ensure that security is an integral part of the whole software delivery pipeline workflow without sacrificing speed or increasing risk. New functionality includes integration of feature flag capabilities within the continuous integration (CI) and continuous delivery (CD) environments, enhanced Role-Based Access Control and more robust disaster recovery capabilities.

With CloudBees CI and CloudBees CD solutions, users get access to several layers of security within the software delivery process. Rather than having to manually incorporate security steps on an ad hoc basis as a last step in the release process, security is infused within the software process from code to production. The new security features automate processes with proven integrations, hardened audit-ready pipelines and the ability to instantly mitigate defective code.

"Companies need to innovate faster, but if they don't integrate security early and often they expose themselves to a number of risks," said Shawn Ahmed, senior vice-president and general manager, Software Delivery Automation, CloudBees. "With CloudBees they can remove those risks. Tapping the power of our market-leading CI and CD solutions, they can keep moving at high speed with full confidence that their code is secure in development, secure in delivery and secure in production."

Security is typically implemented late in the software delivery process, just prior to deployment to production. Disjointed tools and processes leave teams unsure if proper security gates have been passed. Lack of integrated tooling and systems force teams to scramble to manually cobble together reports to meet audit and compliance requests.

CloudBees responded to these legacy challenges by building security functionality into its products in the following ways:

• Feature flag integration ? New features can be quickly pushed to production following an automated process. If issues crop up in production, that specific feature can be immediately pulled back and full traceability of what happened automatically provided.
• Enhanced granularity in Role-Based Access Control ? Fine-grained permissions are able to be set by team, user and even at the file level to ensure only authorized users access project assets, as needed, to perform their job. New capabilities released in CloudBees CI allow team leaders to manage non-security related configuration settings on their controllers - without granting them the powerful overall/administrator permission.
• Enhanced backup, restore and recovery ? CloudBees is extending Velero to CloudBees CI for backup, restore and recovery use cases. Velero is not only a superior solution for disaster recovery use cases, but is also purpose-built for Kubernetes. Kubernetes support brings valuable capabilities for cluster migration and portability to CloudBees CI. This technology is already being used in CloudBees CD.
• Audit-ready pipelines ? Hardened audit-ready pipelines ensure only immutable, approved components and environments are used, preventing drift and tampering. This provides full traceability and audit reports in an instant.
• Hardened CloudBees CI ? CloudBees developed a hardened version of its industry-leading continuous integration solution that meets strict government specifications for security, certified to DoD standards.
• Proven integrations ? Proven integrations to many leading security automation applications, such as Anchore, Alcide.io, CyberArk, Checkmarx, Contrast Security, FOSSA, RunSafe Security, Shiftleft.io, Snyk, Sonatype, Synopsys, WhiteSource Software and Zimperium provide increased protection against outside risks.

Additional Resources

• Discover more about DevSecOps capabilities from CloudBees
• Read the blog about DevSecOps and how to secure the software delivery process
• Listen to the DevOps Radio podcast: Artificial Intelligence the Future of DevSecOps?
• Read the eBook 9 Ways DevOps and Automation Bolster Security and Compliance
• Learn about CloudBees CI
• Learn more about CloudBees CD

About CloudBees

CloudBees, the enterprise software delivery company, provides the industry's leading DevOps technology platform. CloudBees enables developers to focus on what they do best: Build stuff that matters, while providing peace of mind to management with powerful risk mitigation, compliance and governance tools. Used by many of the Fortune 100, CloudBees is helping thousands of companies harness the power of continuous everything and gets them on the fastest path from a great idea, to great software, to amazing customer experiences, to being a business that changes lives.

Backed by Matrix Partners, Lightspeed Venture Partners, Verizon Ventures, Delta-v Capital, Golub Capital and Unusual Ventures, CloudBees was founded in 2010 by former JBoss CTO Sacha Labourey and an elite team of continuous integration, continuous delivery and DevOps professionals. Follow CloudBees on Twitter, LinkedIn and Facebook.