Check Point® Software Technologies Ltd. has been recognized as a leader in The Forrester Wave™: Zero Trust Platform Providers, Q3 2023 report.
How much are organizations investing in the shift to cloud native, how much is it getting them? ...
Start with Spending Developers on Security - Part 1
What's it Going to Cost Me?
Let's boil that into time spent. Let's assume a 50 person development organization, managing 500 functions, where each developer deploys a new version 3 times a week. Remember, in serverless, people tend to roll out changes more frequently, but then again the changes are often small (which is why the two-minute strategy can work in the first place).
So you're rolling out 3 ⨉ 50 = 150 versions a week across your teams, or 150 ⨉ 52 = 7,800 versions per year. From my experience, this is a low estimate. We have customers with considerably higher rates.
Let's assume that we measure how much time a developer or devop engineer spends on security per deploy, how frequently the permissions are missing which causes an exception during testing or production, and how much time is spent. Of course, these are just based on a small survey and you can play with numbers as you see fit.
As you can see, exceptions are pretty costly, as they are out of context. Also, as you read the impact of this, bear in mind that the level of security attained (as in, how well the security posture prevents future attacks and damages) varies drastically between the three strategies. Also, I've tried to estimate the yearly average rates. Exception rates are much higher for new functions, and drop much lower for mature functions, so this is just a simplification.
Here's how that adds up per year:
If we translate that into dollars, assuming a cost of $150k per engineer ($120k salary + $30k additional costs), you are spending:
Can I Improve on That?
You can, of course, try to make all your developers fundamentalists when it comes to security. There is no doubt that a little security awareness goes a long way. Having said that, it's a pretty expensive way to get the security you need.
Let's compare that to using tools to help you close the gaps. The idea is that if you have the right tools in place, within your deployment and monitoring workflows, then you catch things as early as possible, give developers detailed guidance on when, where and what to focus on, and keep security overhead to a minimum. You can achieve or even exceed the levels of the Fundamentalists, while spending less time than the Minimalists.
Let's add in the security tool strategy to the mix:
The main trick is to spend under a minute on average per deploy (mostly that's adding permissions you know you need, and handling build-time errors that come from wrong permissions). A side benefit is that the number of exceptions also drops significantly, since the security tools usually catch missing permissions as well, and you can fix that while the files are still open in your IDE.
How does this add up yearly?
So as you can see, while freeing up significant developer time, you can also improve your security, if you have the right tools in place.
Industry News
Red Hat and Oracle announced the expansion of their alliance to offer customers a greater choice in deploying applications on Oracle Cloud Infrastructure (OCI). As part of the expanded collaboration, Red Hat OpenShift, the industry’s leading hybrid cloud application platform powered by Kubernetes for architecting, building, and deploying cloud-native applications, will be supported and certified to run on OCI.
Harness announced the availability of Gitness™, a freely available, fully open source Git platform that brings a new era of collaboration, speed, security, and intelligence to software development.
Oracle announced new application development capabilities to enable developers to rapidly build and deploy applications on Oracle Cloud Infrastructure (OCI).
Sonar announced zero-configuration, automatic analysis for programming languages C and C++ within SonarCloud.
DataStax announced a new JSON API for Astra DB – the database-as-a-service built on the open source Apache Cassandra® – delivering on one of the most highly requested user features, and providing a seamless experience for Javascript developers building AI applications.
Mirantis launched Lens AppIQ, available directly in Lens Desktop and as (Software as a Service) SaaS.
Buildkite announced the company has entered into a definitive agreement to acquire Packagecloud, a cloud-based software package management platform, in an all stock deal.
CrowdStrike has agreed to acquire Bionic, a provider of Application Security Posture Management (ASPM).
Perforce Software announces BlazeMeter's Test Data Pro, the latest addition to its continuous testing platform.
CloudBees announced a new cloud native DevSecOps platform that places platform engineers and developer experience front and center.
Akuity announced a new open source tool, Kargo, to implement change promotions across many application life cycle stages using GitOps principles.
Check Point® Software Technologies Ltd. announced that it has been recognized on Newsweek’s inaugural list of the World’s Most Trustworthy Companies 2023.
CloudBees announced significant performance and scalability breakthroughs for Jenkins® with new updates to its CloudBees Continuous Integration (CI) software.