#Teamcity solarwinds install#
#Teamcity solarwinds software#
#Teamcity solarwinds code#

'That's the final risk - how do we know that these tools are secure?' Chaillan said.

#Teamcity solarwinds software#

Nicolas ChaillanChief Software Officer, US Air Force What we're starting to look into for Platform One, is every phase of the pipeline get signed with a key, and you cannot bypass each phase without having the key of the phase before. Still, the SolarWinds attack pointed to a cybersecurity frontier the industry must develop better answers for, according to Chaillan: locking down access to CI/CD tools and infrastructure to more effectively detect and prevent similar attacks. JetBrains, makers of the TeamCity CI software named in those reports, publicly denied its system played any role in the breach. Reports in The New York Times and Wall Street Journal in January said the breach occurred in a continuous integration (CI) server used to develop SolarWinds' Orion software.

#Teamcity solarwinds code#

In the SolarWinds attack, malicious actors injected code into SolarWinds' Orion IT monitoring product, which eventually gave them access to SolarWinds customer environments. The project is part of a response to a Presidential Executive Order prompted by last year's massive SolarWinds breach and a ransomware attack this year on Colonial Pipeline, an oil and gas distributor. DOD spearheads software supply chain security effortĮlsewhere, the DOD is working with an emerging IT vendor, BoxBoat Technologies, on a multi-party digital signing mechanism to shore up software supply chain security. 'We have dozens of companies working on bidding to become a reseller,' he said but declined to name the bidders. Overall, the DOD has seen interest from dozens of companies in Platform One Big Bang training, Chaillan said, including Deloitte, General Dynamics IT and Northrop Grumman.

However, while Cisco would be open to a public/private partnership on Platform One, it has not been engaged in any specific discussions to finalize such a deal, the spokesperson said. Cisco has DevOps engineers working with the Platform One environment, and plans on contributing infrastructure as code, model-driven DevOps pipelines via open source, and IT automation playbooks into the DevSecOps 2.0 initiative, according to a Cisco spokesperson. In that statement, Lockheed Martin also announced a Basic Ordering Agreement with the Air Force that will authorize the defense contractor to help build and support the platform for other companies and defense agencies.Įngineers from Cisco also took the workshop training earlier this year, Chaillan said. The department has done this most notably so far with Lockheed Martin, which said in February it had signed on with the Air Force to use Platform One in its internal software factory.

In exchange, the companies agreed to contribute to the project's open source code. Over the past six months, the DOD began to offer private-sector companies an 11-day training workshop on Platform One Big Bang. 'People are hearing about Platform One and they want to start using it, but they don't know how, and we don't have the bandwidth to help companies.' Air Force and co-lead for the DOD's Enterprise DevSecOps Initiative. 'It's really becoming a product and an ecosystem,' said Nicolas Chaillan, chief software officer at the U.S. Now, the DOD is working to turn this Platform One installation, hosting and training process over to private-sector companies.

#Teamcity solarwinds install#

Under a project called Platform One Big Bang, the DOD can install an instance of Platform One, called the Customer DevSecOps Platform, on behalf of other organizations and train them to run it. Platform One is based on the concept of continuous authority to operate, which updated the DOD's procurement process to accommodate the speed and frequency of modern continuous software deployments. It has also released two versions of guidance documents on enterprise DevSecOps fundamentals.ĭOD DevSecOps open source projects include the Iron Bank, a repository of DOD-vetted hardened container images, and Platform One, the DevSecOps platform design the department created for internal software deployments. Since the Department of Defense (DOD) first established its DevSecOps initiative last year, it has launched multiple open source projects meant to improve cybersecurity, not just for the department's internal operations, but for the IT industry in general.