12 DevSecOps Trends to Watch Right Now - Part 1
August 05, 2021

Jayne Groll
DevOps Institute

Baking security into your software and apps from the beginning is more important than ever. Without security, your development lifecycle is open to bugs and vulnerabilities putting your organization and customers at risk. DevSecOps is an augmentation of DevOps, allowing for security practices to be integrated into the DevOps approach. This approach shifts security to the left ensuring that security is implemented in the beginning of the development lifecycle.

While DevSecOps practices are still evolving, there are many trends to keep an eye on. I asked several speakers and sponsors for the upcoming SKILup Day as well as several DevOps Institute Ambassadors to weigh in on the hottest DevSecOps trends. Here's what they shared:

Sponsor, Kendall Miller
President, Fairwinds

The answer is in the question itself, the merging of security into DevOps, when historically it's been a separate practice. Now people are realizing that separating security is a mistake — it all needs to be paired together out of the gate. In the same way that the merging of dev and ops requires great tooling but leads to organizational change and efficiency gains, the addition of security also requires great tooling … but leads to incredible organizational change. So the trend is the merging itself and the tools that make the merge possible. It's really hard to bolt security on afterwards, and as the world increasingly adopts tools like Kubernetes, service ownership is increasingly common, and it must include security from the get-go.

Sponsor, Guy Eisenkot
VP of Product, Bridgecrew by Prisma Cloud

One of the biggest DevSecOps trends is shifting anything, and everything left. To make it easier, faster, and cheaper to address vulnerabilities and misconfigurations, security and compliance teams are looking for ways to collaborate with DevOps and engineering to embed guardrails earlier in the DevOps lifecycle. Whether that's in the IDE or part of build pipelines, getting early feedback helps minimize context-switching for engineers, saves DevOps time prioritizing fixes for issues found in runtime, and reduces risk.

The key for this to be successful, however, is to strike a healthy balance between enforcing security policies and moving fast. If security feedback becomes too noisy, engineers will ignore it, and if it becomes a blocker, they'll find a way around it. Either way, friction will ensue, and you'll end up having to scale back your DevSecOps efforts.

Sponsor, Rob Cuddy
Global Application Security Evangelist, HCL Software DevOps

The top trend is getting developers more involved in threat modeling activities and collaborating on them with security professionals. In 2019 Puppet Labs identified this as the #1 practice for having an impact and improving security posture. (page 35 of the 2019 State of DevOps Report)

Sponsor, Yasser Fuentes
Cloud Workload Security Technical Product Manager, Bitdefender

Security must now keep up with DevOps and the software delivery lifecycle and cadence acceleration. As a result, key areas such as Compliance, Vulnerability Management, Identity Access Management, Encryption and overall built-in security have to move at this same very high speed, otherwise non-secure code would end up deeming their software as unusable and off-market. One of the most feasible solutions (at least at a glance) for CISOs has been the adoption of the shared-ownership model of security, which facilitates application component owners to detect and fix their own related vulnerabilities. The same is true as per software intended to be sold to and used by the US Government - requirements oblige software companies to report, mitigate and fix any related vulnerabilities. However, the reality is that this is not and won't be by any means even close to 50 percent of what's required in order to ensure that the application is secure.

Sponsor, Joni Klippert
Co-Founder and CEO, StackHawk

The number of API-related security incidents is on the rise with Peloton, Coursera, and the latest Experian breach being recent examples from the last 12 months. And API security risk is going to get worse – Gartner cites that by 2022, API abuses will be the attack vector most responsible for data breaches.

Leading DevSecOps teams are beginning to awaken to the threat of API security, and updating their programs accordingly. Teams are proactively implementing processes to manage core API security principles like access control, rate limiting, data exposure testing, and vulnerability testing, in CI/CD to find issues before they are released to prod.

Like application security, API security doesn't have a silver bullet. DevSecOps teams need to implement the right tools from the planning stages of development to make sure their APIs are protected.

Stephen Walters
Sales Engineer, Everbridge

In my opinion, the top trend in DevSecOps right now is organizations and groups trying to understand exactly what it means to them. Just as we had many years of people asking the question, "What is DevOps?" before finally realizing that there is not an all conclusive answer, but merely a base construct and an ideology, so we are seeing the same happen with DevSecOps. Yes, this time we have a slight jump on that, but the greatest challenge now, as then, is the cultural change that many traditional operators are having to face in the way they conduct their roles in day-to-day security.

For example, in traditional models, security has operated, or been made to operate, in a way that reflects its culture - closed, secretive and isolated from other functions - the greatest silo of siloes. That has to change in a DevSecOps culture, where security must be open, integrated and part of the enterprise ecosystem. That is a seismic change for many and it requires a lot of effort upfront from all parties.

Learn more about DevSecOps and similar topics, by registering for an upcoming SKILup Day. Or, start your upskilling journey by learning more about the benefits of DevOps Institute membership.

Go to 12 DevSecOps Trends to Watch Right Now - Part 2, providing even more expert opinions on DevSecOps.

Jayne Groll is CEO of DevOps Institute
Share this

Industry News

February 02, 2023

Red Hat announced a multi-stage alliance to offer customers a greater choice of operating systems to run on Oracle Cloud Infrastructure (OCI).

February 02, 2023

Snow Software announced a new global partner program designed to enable partners to support customers as they face complex market challenges around managing cost and mitigating risk, while delivering value more efficiently and effectively with Snow.

February 02, 2023

Contrast Security announced the launch of its new partner program, the Security Innovation Alliance (SIA), which is a global ecosystem of system integrators (SIs), cloud, channel and technology alliances.

February 01, 2023

Red Hat introduced new security and compliance capabilities for the Red Hat OpenShift enterprise Kubernetes platform.

February 01, 2023

Jetpack.io formally launched with Devbox Cloud, a managed service offering for Devbox.

February 01, 2023

Jellyfish launched Life Cycle Explorer, a new solution that identifies bottlenecks in the life cycle of engineering work to help teams adapt workflow processes and more effectively deliver value to customers.

January 31, 2023

Ably announced the Ably Terraform provider.

January 31, 2023

Checkmarx announced the immediate availability of Supply Chain Threat Intelligence, which delivers detailed threat intelligence on hundreds of thousands of malicious packages, contributor reputation, malicious behavior and more.

January 31, 2023

Qualys announced its new GovCloud platform along with the achievement of FedRAMP Ready status at the High impact level, from the Federal Risk and Authorization Management Program (FedRAMP).

January 30, 2023

F5 announced the general availability of F5 NGINXaaS for Azure, an integrated solution co-developed by F5 and Microsoft that empowers enterprises to deliver secure, high-performance applications in the cloud.

January 30, 2023

Tenable announced Tenable Ventures, a corporate investment program.

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.