November 2018 Summaries

Mobile app development requires specialized tools to ensure both efficiency and security, and the integration of CircleCI and NowSecure provides a comprehensive solution for DevOps teams. CircleCI offers a robust continuous integration/continuous deployment (CI/CD) environment with mobile-specific features, supporting cross-platform execution and simplifying iOS app processes through tools like Fastlane Match and Homebrew. NowSecure complements this with its AUTO mobile app security testing, which executes rapid, automated security tests post-build, detecting issues such as data leakage and encryption weaknesses. This integration allows seamless, closed-loop development cycles by automatically feeding test results and remediation instructions into ticketing systems like Jira, minimizing workflow disruption and enhancing security without the need for new IDE plug-ins or manual intervention. The combined power of CircleCI and NowSecure thus streamlines the development and deployment of secure mobile applications, catering to the needs of developers and security analysts alike, whether in cloud or on-premises environments.

Cypress.io has developed an open-source, MIT-licensed end-to-end test runner designed to simplify the testing of complex modern web applications by being easy to install and learn. The test runner can be used locally or on continuous integration (CI) servers, although setting up a CI suite can be challenging. The introduction of CircleCI Orbs has provided a solution, allowing Cypress to create small reusable CI configuration pieces that simplify the deployment process for users. These orbs enable efficient execution of tasks like code checkouts, dependency installations, and parallel test runs with minimal configuration. Users can also customize their CI settings using the CircleCI CLI tool if needed. The author expresses excitement about the potential of Orbs to streamline CI processes, comparing their impact to that of Docker in simplifying repeatable builds. Gleb Bahmutov, a leader at Cypress.io, emphasizes the significance of Orbs in enhancing user experience and advocates for exploring their documentation for further insights.

Docker enables developers to efficiently handle the packaging, storage, and deployment of applications, but as container technologies become more prevalent, the security of these images poses a significant challenge. Integrating security checks into an automated pipeline has become a best practice, and tools like Anchore facilitate this by providing static analysis and user-defined policy enforcement on container images. This integration is crucial within Continuous Integration (CI) environments, as container images remain immutable, necessitating new builds for any application changes. Anchore allows for deep insight and governance over container contents, and examples show how it can be seamlessly added to CircleCI workflows for both public and private image scans. The process not only ensures compliance with security policies but also prevents non-compliant images from progressing in the pipeline, thereby promoting secure and efficient deployment practices.