InfoQ Homepage Compliance Content on InfoQ
-
How to Build Secure Software without Sacrificing Productivity
Security can clash with development efficiency. Focusing on minimizing breach impact can be more effective than prevention. Dorota Parad argues for flexibility in compliance and collaborating with security teams to define practical protections. Limiting blast radius and using automation can boost security with minimal productivity loss.
-
AWS Shield Network Security Director: Network Topology Visibility and Remediation Guidance
Introducing AWS Shield Network Security Director: a game-changer in DDoS protection and network security visibility. This innovative feature automates resource discovery, evaluates configurations against best practices, and prioritizes security findings. With actionable remediation steps and natural language queries via Amazon Q Developer, organizations can enhance their security posture.
-
Docker Launches Hardened Base Images
Docker has launched its Docker Hardened Images (DHI), a security-focused range of base images that reduce vulnerabilities by up to 95%. Built using a distroless approach, these minimal images eliminate unnecessary components, offering automatic patching and compatibility with existing Dockerfiles. Ideal for regulated environments, DHI enhances software supply chain security and transparency.
-
GitLab 17.11 Enhances DevSecOps with Custom Compliance Frameworks and Expanded Controls
On April 17, 2025, GitLab released version 17.11, introducing significant advancements in compliance management and DevSecOps integration. A standout feature of this release is the introduction of Custom Compliance Frameworks, designed to embed regulatory compliance directly into the software development lifecycle.
-
Microsoft Pledges Deeper European Tech Ties amidst Sovereignty Debate
Microsoft's five digital commitments aim to bolster Europe's tech landscape and sovereignty through a 40% cloud and AI infrastructure expansion, enhanced cybersecurity, and a robust data privacy framework. By establishing a "European cloud for Europe," Microsoft reinforces its dedication to digital resilience while fostering economic competitiveness and supporting the open-source community.
-
QCon London: Bringing DevOps Principles to Controls and Audit
Ian Miell delivered a talk at QCon London 2025 on a modernised approach to compliance, announcing an open-source project that aims to solve many of the problems seen in the audit and compliance process. Miell highlighted that there's a disconnect between modern DevOps practices of automation and repeatability, and traditional audit and compliance procedures.
-
AWS Launches Trust Center: a Centralized Resource for Security and Compliance Information
AWS Trust Center is a comprehensive online resource that enhances cloud security transparency. It details AWS's security practices, compliance protocols, and data protection controls, making it easier for customers to understand and manage their cloud security. This centralized hub provides real-time service status, security bulletins and essential resources, improving client trust & confidence.
-
Logic App Standard Hybrid Deployment Model Public Preview: More Flexibility and Control On-Premise
Microsoft's Logic Apps Hybrid Deployment Model offers unparalleled flexibility for organizations, enabling the execution of workflows on-premises or in private/public clouds. With enhanced local processing, regulatory compliance, and dynamic scalability, businesses can optimize their infrastructure while ensuring data integrity- ideal for sectors like Government, Healthcare, and Manufacturing.
-
AWS Releases User Guide for the Digital Operational Resilience Act (DORA)
Amazon recently released the AWS User Guide to the Digital Operational Resilience Act (DORA). The document details how AWS services support financial entities in complying with DORA's requirements for operational resilience, including ICT risk management, incident reporting, testing, and third-party risk management.
-
Borderless Cloud at QCon London: Q&A with Adora Nwodo
At QCon London, Adora Nkowno, senior software engineer at NexaScale, discussed the complexities of seamlessly integrating multiple clouds into application architecture, deployment processes, and CI/CD pipelines. Her session was part of the Cloud-Native Engineering track on the first day of the conference, and InfoQ did an interview.
-
Amazon Route 53 Resolver Introduces DNS over HTTPS Support for Enhanced Security and Compliance
AWS recently announced that Amazon Route 53 Resolver will support using the Domain Name System (DNS) over HTTPS (DoH) protocol for both inbound and outbound Resolver endpoints.
-
AWS Adds Automated Detection of Unused IAM Roles, Users, and Permissions
AWS recently added support for detecting unused access granted to IAM roles and users within their AWS IAM Access Analyzer tool. The new analyzer can identify unused roles, unused IAM user access keys and passwords, and unused permissions within a defined usage window. This analysis can be done across accounts within the organization and be controlled from a delegated administrator account.
-
AWS Introduces Dedicated Local Zones for Sovereignty Requirements
AWS has recently introduced Dedicated Local Zones, enabling customers to isolate sensitive workloads to meet their digital sovereignty requirements. This new option is designed for public sector and regulated industry customers who need dedicated infrastructure.
-
Azure Deployment Environments Now Generally Available
At the annual Build conference, Microsoft announced Azure Deployment Environments' general availability (GA). This service allows development teams to create segregated instances within Azure for deploying and managing applications in different stages, such as development, testing, and production, to ensure controlled and consistent deployment processes.
-
How to Build a Successful Cloud Capability on a Heavily Regulated Organization
Ana Sirvent, AWS practice lead at KPMG UK, shared her experience at QCon London on how to work with public cloud on heavily regulated organizations. Sirvent explained how to build trust with security, compliance, and client risk teams while delivering quickly and leveraging cloud services.