From DevOps to DevSecOps: The Impact of Container Security on Organizational Culture
August 14, 2019

Ali Golshan
StackRox

The fast-moving nature of container and Kubernetes adoption is having a ripple effect throughout organizations. Not only is the adoption of cloud native technologies fueling digital transformation — especially in the areas of operations and service delivery — it's also forcing organizations to rethink how they structure their business units to accommodate the demands of rapid iteration, agile development, and increasingly critical security standards.

In the fall of 2018, StackRox surveyed a number of IT professionals across a range of industries to understand the state of the container and Kubernetes security within their organizations and how the cloud-native stack is shaping security strategies, operations and IT culture. Just six months later, we updated the survey, and the results highlight a number of organizational changes driven by the quick maturation of container and Kubernetes adoption.

We found that, despite rapid container adoption, organizations are still struggling to secure containers. Although respondents reported a staggering uptick in Kubernetes deployments in the last six months — a 51 percent increase — they also reported escalating concerns about container security investments and lack of strategic planning. On the surface, this data might seem alarming, but ultimately it reveals that organizations are thinking more comprehensively about their use of containers, the importance of containerized applications in their business and the role that security plays in maintaining operations.

These same adoption trends are also shaping how businesses are cultivating their IT teams. With the continued growth of containerization, respondents are reporting that the DevSecOps role is taking on increasing prominence in managing container security. Across all operations roles, the allocation of management responsibility by role has remained consistent, but the jump in those citing DevSecOps as the responsible operator for container security is significant. This increase came despite 38% of respondents identifying their role as product development/engineering. We saw an even larger jump in the allocation of responsibility to DevSecOps when we isolated responses to just those who are in a security or compliance role. Among those respondents, 42% view DevSecOps as the right organization to run container security platforms.

These results indicate that security professionals are finding increasing value in designating the specific role of DevSecOps and its responsibility in running containers security platforms. More importantly, however, we see that containers and Kubernetes have the power to unify what used to be very separate disciplines. The opportunity to create "security as code" is powerful with the cloud-native stack, but it requires workflows, processes, and security tooling that creates and enables that integration across groups.

Ultimately, it's clear that organizations are potentially putting the operational benefits of agility and flexibility at risk by not ensuring their cloud-native assets are built, deployed, and running securely. The right security tooling is critical to continue to bridge the gap between DevOps and security teams in order for security to be effective. Moreover, the continued effort to "shift left" with security, propelling the DevSecOps movement, underscores the importance of having security that's built in, not bolted on, for these cloud-native applications and environments.

Ali Golshan is CTO and Co-Founder of StackRox
Share this

Industry News

June 01, 2020

IT Revolution announced a full conference agenda for DevOps Enterprise Summit London, June 23-25, 2020.

June 01, 2020

Caltech CTME announced that Simplilearn, a global provider of digital skills training, will collaborate with CTME (Caltech's Center for Technology and Management Education) to offer a specialized Post Graduate Program in DevOps software engineering.

June 01, 2020

DevOps Institute, a global member-based association for advancing the human elements of DevOps, announced the introduction of its SKILup Playbook Library, a dynamic collective body of knowledge (cBok) that aligns thought leadership from industry experts with a set of dynamic, orchestrated artifacts, research and assets.

May 28, 2020

Docker has extended its strategic collaboration with Microsoft to simplify code to cloud application development for developers and development teams by more closely integrating with Azure Container Instances (ACI).

May 28, 2020

Eggplant announced updates to its Digital Automation Intelligence (DAI) platform.

May 28, 2020

Aptum launched its Managed DevOps Service in partnership with CloudOps, a cloud consulting and professional services company specializing in DevOps.

May 27, 2020

Red Hat announced an expansion of its application services portfolio with the addition of Quarkus as a fully supported framework in Red Hat Runtimes.

May 27, 2020

Couchbase has completed a $105 million all-equity Series G round of fundraising.

May 27, 2020

Aqua Security closed a Series D round of $30M led by Greenspring Associates.

May 26, 2020

GitLab is releasing 13.0 of its DevSecOps platform to enable organizations to efficiently adapt and respond to new and dynamic business challenges.

May 26, 2020

Solo.io announced the availability of the Istio Developer Portal to streamline the developer onboarding process for improved developer experience and increased productivity with added security features.

May 26, 2020

WhiteHat Security will offer free application scanning services to any education institution to support secure online learning.

May 21, 2020

Exadel announced the Grand Prize winner of the “Appery.io COVID-19 Virtual Hackathon.”

May 21, 2020

CloudBees announced significant advances for its Software Delivery Management (SDM) platform – integrations with additional continuous integration and continuous delivery (CI/CD) engines, including Google Cloud Build and Tekton, and extension of the availability of CloudBees’ SDM Preview Program.

May 21, 2020

OutSystems is announcing over 70 development accelerators that ensure web and mobile applications created on the OutSystems low-code development platform can comply with the highest accessibility standards and regulations.