Enabling Shared Security Responsibility with DevSecOps Analytics and Reporting
April 26, 2021

Christian van den Branden
ZeroNorth

Regardless of where your organization sits in the journey towards better application security (AppSec), the reality of what drives future success remains the same. From emerging to maturing to optimizing, all AppSec programs will eventually need to lock down the gold ring of security — otherwise known as visibility.

With strong AppSec visibility comes a myriad of organizational benefits, among them the ability to establish a more federated and shared responsibility model for the security of the software we build. For CISOs and other executives now tasked with pushing this shared model for AppSec forward, identifying how to achieve this level of visibility for the business has become a top priority.

Advanced enterprise AppSec analytics and reporting provides a way to move forward with a true DevSecOps model. This type of security insight enables CISOs to critically assess where they need to focus their efforts and resources to address the biggest corporate risk issues. These reports offer context around risk and set up a successful model for DevSecOps. Security and development teams can both use these analytics to drive better workflows and minimize friction among teams.

The "How" of Better Visibility

To achieve the best value from an enterprise AppSec program, while also supporting the critical journey towards DevSecOps, CISOs need to have continuous visibility into the state of their AppSec program, across the entirety of the application portfolio. This goal is achievable through better security analytics and reporting.

In fact, advanced reporting on AppSec risk now sits at the heart of the security conundrum because it turns vulnerability data into a reliable, actionable stream of high-value intelligence. Unwieldy data from all those security scanning tools turns into usable information. Paired with granular details, this level of security visibility gives CISOs and other executives the clarity they need to assess the overall health of the business.

Further, reliable analytics and reporting around AppSec allow CISOs to track detected vulnerabilities and their remediation efforts, throughout the software development life cycle (SDLC), to pinpoint weakness in their products. This degree of security insight then enables teams to determine their next move.

Decisions around existing bottlenecks in DevSecOps; how to remove obstacles standing in the way of software excellence, and how processes should evolve become easier. Through better AppSec visibility, CISOs can capture the enterprise-wide visibility into risk that's necessary, while also empowering DevOps teams to prioritize remediation around the most pressing security issues.

Communication in a Business Context

Once CISOs have the visibility they need, they are now equipped to provide the proper and relevant communication. This ranges from coordination on security issues between teams to executive reporting to the grueling task of collecting data towards audit preparation.

The level of visibility gained with strong reporting and analytics drives the accountability at all levels within the organization. Given that CISOs are required to push this degree of shared accountability for AppSec, they are often elated to see the way solid analytics and reporting can spread security ownership outward, framing AppSec results in a business context.

Framing AppSec risk in a business context is key. CISOs and other business leaders can use security analytics to assess the overall health and inherent risk of revenue-generating applications — and make their operational decisions based on data, not guesswork.

In the process of building out an AppSec program, older legacy applications can often present some security debt, which means they haven't been scanned well or even at all. As a result, legacy applications can sometimes present unexpected security issues. CISOs who are faced with handling these complex stacks of new and old applications must be able to communicate and report when scanning occurred and how security issues were remediated.

Recording this scanning work is what allows CISOs to make informed business and operational decisions, including timeframes and revenue projections, and help developers solve problems more effectively. At the end of the day, AppSec directly impacts the bottom line of the business.

Takeaways

Visibility into corporate AppSec risk through analytics enables security, engineering and business leaders to get on the same page, making the right business and operational decisions for the organization that are based on a comprehensive and real-time view of AppSec and risk.

CISOs today need this type of enterprise-level visibility so they can meet their corporate security, governance and compliance responsibilities, thereby enabling their business unit colleagues to understand, own and prioritize risk. When communication and visibility come together in this way, presented in business terms through high-level intelligence and granular insight, information becomes a key enabler of executive decision making.

Christian van den Branden is SVP Engineering at ZeroNorth
Share this

Industry News

July 29, 2021

Couchbase announced the general availability of Couchbase Server 7.

July 29, 2021

Cycloid has unveiled Infra Import, a tool that automatically reverse engineers Terraform Infra-as-Code (IaC) from manually deployed infrastructure.

July 29, 2021

Launchable closed a $9.5 million Series A investment.

July 29, 2021

Rafay Systems announced automation and monitoring enhancements to its flagship Kubernetes Management Cloud (KMC).

July 28, 2021

Progress announced the R2 2021 release of Progress Telerik Test Studio, the enterprise UI test automation platform.

July 28, 2021

Synopsys announced the availability of new Rapid Scan capabilities within the company's Coverity static application security testing (SAST) and Black Duck software composition analysis (SCA) solutions.

July 28, 2021

Bitdefender announced GravityZone Security for Containers, expanding its cloud workload security (CWS) offering with run-time support for containers and Linux kernel independence.

July 28, 2021

Armory announced Armory Enterprise on AWS Quick Starts, automated reference deployments built by Amazon Web Services (AWS) solutions architects and AWS Partners.

July 27, 2021

Katalon introduced Katalon TestOps, an open and comprehensive test orchestration platform designed to help enterprises scale test automation and streamline DevOps pipelines.

July 27, 2021

Digital.ai achieved Federal Risk and Authorization Management Program (FedRAMP) “In Process” status for an Enterprise Agile Planning (EAP) tool.

July 27, 2021

Aqua Security rolls out the availability of its new Aqua Platform, with a unified console to ease the journey from scanning and visibility to workload protection in cloud native environments.

July 26, 2021

Parallel Agile announced a new version of CodeBot, a low-code MERN stack application generator.

July 26, 2021

Appian unveiled its new Appian Japan regional office.

July 26, 2021

CloudTruth raised $5.25 million in seed funding led by Glasswing Ventures and Gutbrain Ventures, with additional funding from Stage 1 Ventures and York IE.

July 22, 2021

Postman successfully obtained the System and Organization Controls (SOC) 2 Type 2 and SOC 3 Type 2 reports for the Postman API platform, meeting critical industry standards relative to the Trust Services Criteria for security, availability, and confidentiality.