XebiaLabs launched the chain of custody, security and compliance risk assessment tracking for software releases available for enterprise software delivery.
Organizations struggle to track application release status information and understand security and compliance risks across many different applications, teams, and environments. When risk assessment, security testing, and compliance checks aren’t built into the Continuous Integration/Continuous Delivery (CI/CD) pipeline, releases fail and cause delays, security vulnerabilities threaten production, and IT governance violations result in expensive fines.
According to Derek Langone, CEO of XebiaLabs: “To effectively manage software delivery at enterprise scale, DevOps teams need a way to accurately manage and report on the ‘chain of custody’ and other compliance requirements throughout the software delivery pipeline. It’s also vital for them to have visibility into the risk of release failures or security issues as early in the release process as possible. That’s when development teams can address issues the quickest without impacting the business.”
Spotlight on security and compliance reduces software release risk
The XebiaLabs DevOps Platform provides a single pane of glass for technical and business stakeholders to track the release chain of custody across the end-to-end CI/CD toolchain, from code to production. And, with visibility into security and compliance issues, teams can take action to ensure that release failure risks, security vulnerabilities, and IT governance violations are resolved early in the software delivery cycle.
XebiaLabs’ latest features for chain of custody, security, and compliance include:
Enhanced chain of custody reporting that offers a new all-in-one deployment dashboard. This dashboard provides a view into what is being deployed, who is deploying it, and what the deployment status is—no matter which deployment tools are being used or what type of environments are being targeted, whether on premise or private, public, or hybrid cloud. Developers, release managers, and compliance staff can see what is deployed where and track deployments back to feature development and delivery.
New security risk dashboard for software releases that combines automated risk assessment for software delivery pipelines with security and compliance information from commonly used tools such as Black Duck, Fortify, SonarQube, and Checkmarx. Visualizing security risk helps teams shift security and compliance activity left, so they can detect application vulnerabilities earlier and address them during development—before those vulnerabilities make it to production.
New compliance overviews that summarize IT governance violations for common standards such as OWASP, PCI 3.2, and CWE/SANS. Compliance scanning activity and rule violations are presented in a format that makes sense for technical, business, and compliance teams who are part of the software delivery process.
“Security and compliance are critical aspects of product delivery—just as important as quality. This is especially true for those of us in regulated industries,” said Russell Webster, VP & Sr. Manager – Delivery Tools & Services, DevOps Discipline Lead, Zions Bancorporation.
“In modern IT, the demands for transparency and traceability of compliance requirements are increasing. With XebiaLabs, we can enable our DevOps pipeline to meet or exceed those demands. There is great power and comfort in being able to see the data related to each release in a centralized tool and as early as possible in the delivery process. If we have a failure or risk of failure, we want to identify it early and trace its roots rapidly. XebiaLabs allows us to achieve that goal.”