12 DevSecOps Trends to Watch Right Now - Part 1
August 05, 2021

Jayne Groll
DevOps Institute

Baking security into your software and apps from the beginning is more important than ever. Without security, your development lifecycle is open to bugs and vulnerabilities putting your organization and customers at risk. DevSecOps is an augmentation of DevOps, allowing for security practices to be integrated into the DevOps approach. This approach shifts security to the left ensuring that security is implemented in the beginning of the development lifecycle.

While DevSecOps practices are still evolving, there are many trends to keep an eye on. I asked several speakers and sponsors for the upcoming SKILup Day as well as several DevOps Institute Ambassadors to weigh in on the hottest DevSecOps trends. Here's what they shared:

Sponsor, Kendall Miller
President, Fairwinds

The answer is in the question itself, the merging of security into DevOps, when historically it's been a separate practice. Now people are realizing that separating security is a mistake — it all needs to be paired together out of the gate. In the same way that the merging of dev and ops requires great tooling but leads to organizational change and efficiency gains, the addition of security also requires great tooling … but leads to incredible organizational change. So the trend is the merging itself and the tools that make the merge possible. It's really hard to bolt security on afterwards, and as the world increasingly adopts tools like Kubernetes, service ownership is increasingly common, and it must include security from the get-go.

Sponsor, Guy Eisenkot
VP of Product, Bridgecrew by Prisma Cloud

One of the biggest DevSecOps trends is shifting anything, and everything left. To make it easier, faster, and cheaper to address vulnerabilities and misconfigurations, security and compliance teams are looking for ways to collaborate with DevOps and engineering to embed guardrails earlier in the DevOps lifecycle. Whether that's in the IDE or part of build pipelines, getting early feedback helps minimize context-switching for engineers, saves DevOps time prioritizing fixes for issues found in runtime, and reduces risk.

The key for this to be successful, however, is to strike a healthy balance between enforcing security policies and moving fast. If security feedback becomes too noisy, engineers will ignore it, and if it becomes a blocker, they'll find a way around it. Either way, friction will ensue, and you'll end up having to scale back your DevSecOps efforts.

Sponsor, Rob Cuddy
Global Application Security Evangelist, HCL Software DevOps

The top trend is getting developers more involved in threat modeling activities and collaborating on them with security professionals. In 2019 Puppet Labs identified this as the #1 practice for having an impact and improving security posture. (page 35 of the 2019 State of DevOps Report)

Sponsor, Yasser Fuentes
Cloud Workload Security Technical Product Manager, Bitdefender

Security must now keep up with DevOps and the software delivery lifecycle and cadence acceleration. As a result, key areas such as Compliance, Vulnerability Management, Identity Access Management, Encryption and overall built-in security have to move at this same very high speed, otherwise non-secure code would end up deeming their software as unusable and off-market. One of the most feasible solutions (at least at a glance) for CISOs has been the adoption of the shared-ownership model of security, which facilitates application component owners to detect and fix their own related vulnerabilities. The same is true as per software intended to be sold to and used by the US Government - requirements oblige software companies to report, mitigate and fix any related vulnerabilities. However, the reality is that this is not and won't be by any means even close to 50 percent of what's required in order to ensure that the application is secure.

Sponsor, Joni Klippert
Co-Founder and CEO, StackHawk

The number of API-related security incidents is on the rise with Peloton, Coursera, and the latest Experian breach being recent examples from the last 12 months. And API security risk is going to get worse – Gartner cites that by 2022, API abuses will be the attack vector most responsible for data breaches.

Leading DevSecOps teams are beginning to awaken to the threat of API security, and updating their programs accordingly. Teams are proactively implementing processes to manage core API security principles like access control, rate limiting, data exposure testing, and vulnerability testing, in CI/CD to find issues before they are released to prod.

Like application security, API security doesn't have a silver bullet. DevSecOps teams need to implement the right tools from the planning stages of development to make sure their APIs are protected.

Stephen Walters
Sales Engineer, Everbridge

In my opinion, the top trend in DevSecOps right now is organizations and groups trying to understand exactly what it means to them. Just as we had many years of people asking the question, "What is DevOps?" before finally realizing that there is not an all conclusive answer, but merely a base construct and an ideology, so we are seeing the same happen with DevSecOps. Yes, this time we have a slight jump on that, but the greatest challenge now, as then, is the cultural change that many traditional operators are having to face in the way they conduct their roles in day-to-day security.

For example, in traditional models, security has operated, or been made to operate, in a way that reflects its culture - closed, secretive and isolated from other functions - the greatest silo of siloes. That has to change in a DevSecOps culture, where security must be open, integrated and part of the enterprise ecosystem. That is a seismic change for many and it requires a lot of effort upfront from all parties.

Learn more about DevSecOps and similar topics, by registering for an upcoming SKILup Day. Or, start your upskilling journey by learning more about the benefits of DevOps Institute membership.

Go to 12 DevSecOps Trends to Watch Right Now - Part 2, providing even more expert opinions on DevSecOps.

Jayne Groll is CEO of DevOps Institute
Share this

Industry News

May 12, 2022

Red Hat introduced Red Hat Enterprise Linux 9, the Linux operating system designed to drive more consistent innovation across the open hybrid cloud, from bare metal servers to cloud providers and the farthest edge of enterprise networks.

May 12, 2022

Couchbase announced version 7.1 of Couchbase Server.

May 12, 2022

Copado added Copado Robotic Testing to Copado Essentials.

May 11, 2022

Red Hat announced new advancements within its Red Hat Cloud Services portfolio, delivering a fully-managed and streamlined user experience as organizations build, deploy, manage and scale cloud-native applications across hybrid environments.

May 11, 2022

JFrog introduced a new Docker Desktop Extension for JFrog Xray that allows organizations to automatically scan Docker Containers for vulnerabilities and violations early in the development process.

May 11, 2022

Progress announced a series of updates in Progress Telerik and Progress Kendo UI.

May 11, 2022

Vultr announces that Vultr Kubernetes Engine (VKE) is generally available.

May 10, 2022

Docker announced new features and partnerships to increase developer productivity. Specifically, the company announced Docker Extensions which allow developers to discover and add complementary development tools to Docker Desktop.

May 10, 2022

Red Hat announced the general availability of Red Hat Ansible Automation Platform on Microsoft Azure, pairing hybrid cloud automation with the convenience and support of a managed offering.

May 10, 2022

The Fedora Project, a community-driven open source collaboration sponsored by Red Hat, announced the general availability of Fedora Linux 36, the latest version of the fully open source Fedora operating system.

May 10, 2022

Progress announced the release of Progress Chef Cloud Security, extending DevSecOps with compliance support for native cloud assets and enabling end-to-end management of all on premise, cloud and native cloud resources.

This new offering is complemented with new capabilities across the Chef portfolio targeting DevOps success in the most demanding and complex enterprise deployments.

May 10, 2022

Platform9 announced new platform capabilities in Platform9 5.5 that make it easier for cloud-native development and operations teams to build, scale, and operate apps and Kubernetes clusters in the cloud, on-premises, and at the edge.

May 09, 2022

Red Hat and Accenture have expanded their nearly 12 year strategic partnership to further power open hybrid cloud innovation for enterprises worldwide.

May 09, 2022

Opsera has partnered with Mindtree.

May 09, 2022

Mendix announced that Mendix Workflow for process automation is now generally available.