LaunchDarkly announced the private preview of Warehouse Native Experimentation, its Snowflake Native App, to offer Data Warehouse Native Experimentation.
As organizations continue to adopt a more collaborative DevOps model, many face a common challenge: effectively integrating security practices into the application development lifecycle process. This challenge was brought to light in a new Application Security and DevOps Report from Hewlett Packard Enterprise (HPE).
According to the report, virtually all IT operations professionals, security leaders and developers (99 percent) agree that adopting a DevOps culture has the opportunity to improve application security. However, only 20 percent are actually conducting application security testing today during the development process.
Even more troublesome, 17 percent of respondents say they are not using any security technology to protect their applications. This statistic highlights a significant disconnect between the perception and the reality of secure DevOps.
DevOps shows great promise for secure software development. It provides organizations with the ability to test for, find and remediate security vulnerabilities earlier and more frequently in the application lifecycle as a result of continuous testing. Security flaws in software are not different from other software bugs – the earlier you detect and fix them, the greater the potential to prevent negative fallouts later on in the cycle. It is much more cost effective and efficient to catch a security flaw earlier in the software development cycle than to hear about it from customers using your application. If you wait to repair a flaw, you have to invest significantly more resources and time to fix the flaw in customer environments (than you would in dev) and you also risk damaging your brand and losing revenue.
However, DevOps is not a magic bullet that automatically makes applications more secure. In fact, DevOps can actually compound the issue if security is not built into the development process. Applications are being developed and released faster than ever before and the lack of an integrated approach can lead to greater security holes. Therefore it is critical that security and DevOps are incorporated and work seamlessly together.
The report shows that there are significant barriers and gaps which prevent organizations from successfully integrating security into the DevOps processes. Some of the key findings include:
■ Organizational challenges between security professionals and developers: The report reflected a significant disconnect between developers and security teams. In some cases, respondents admitted to not even knowing who their security colleagues were. Ninety percent of security professionals also stated that integrating application security has become more difficult since their organizations have deployed DevOps.
■ Lack of security awareness, emphasis, and training for developers: Out of more than 100 job postings for software developers at Fortune 1000 companies, none specified security or secure coding experience or knowledge as part of the skills required.
■ Shortage of application security talent: For every 80 developers in the organizations surveyed, there is only one application security professional. The lack of appropriately staffed security personnel, along with increasingly rapid development cycles, makes secure development extremely difficult.
The report offers the following recommendations to bring down these barriers and achieve better integration of security experts within DevOps teams as organizations continue to adopt DevOps practices:
■ Make security a shared responsibility across the organization to eliminate barriers: Security must be embedded throughout every stage of the development process, with executive support and metrics to hold teams accountable for secure development. These metrics should focus on mean-time-to-triage (MTTT), mean-time-to-fix (MTTF), and program compliance.
■ Make it seamless and more intuitive for developers to practice secure development by bridging awareness, emphasis, and training gaps: Organizations should integrate security tools into the development ecosystem to allow developers to find and fix vulnerabilities in real-time as they write code. This makes it easy and efficient to develop software securely, and educates the developer on secure coding in the process.
■ Leverage automation and analytics to streamline application security: Organizations should leverage enterprise-grade application security automation with analytics built in during the testing audit process. This allows security professionals to focus only on the highest priority risks, reducing the number of security issues that require manual review, saving both time and resources, while lowering overall risk exposure.
Both security practitioners and developers believe that the DevOps movement has the potential to significantly improve application security. Yet, organizations are struggling to realize that potential. By integrating security into the development cycles early on and making it part of the development lifecycle culture, organizations can successfully secure software in this new DevOps world without impeding the speed and agility that it brings.
Ashish Kuthiala is Senior Director of Marketing and Strategy, Hewlett Packard Enterprise DevOps.
Industry News
SingleStore announced the launch of SingleStore Flow, a no-code solution designed to greatly simplify data migration and Change Data Capture (CDC).
ActiveState launched its Vulnerability Management as a Service (VMaas) offering to help organizations manage open source and accelerate secure software delivery.
Genkit for Node.js is now at version 1.0 and ready for production use.
JFrog signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS).
mabl launched of two new innovations, mabl Tools for Playwright and mabl GenAI Test Creation, expanding testing capabilities beyond the bounds of traditional QA teams.
Check Point® Software Technologies Ltd. announced a strategic partnership with leading cloud security provider Wiz to address the growing challenges enterprises face securing hybrid cloud environments.
Jitterbit announced its latest AI-infused capabilities within the Harmony platform, advancing AI from low-code development to natural language processing (NLP).
Rancher Government Solutions (RGS) and Sequoia Holdings announced a strategic partnership to enhance software supply chain security, classified workload deployments, and Kubernetes management for the Department of Defense (DOD), Intelligence Community (IC), and federal civilian agencies.
Harness and Traceable have entered into a definitive merger agreement, creating an advanced AI-native DevSecOps platform.
Endor Labs announced a partnership with GitHub that makes it easier than ever for application security teams and developers to accurately identify and remediate the most serious security vulnerabilities—all without leaving GitHub.
Are you using OpenTelemetry? Are you planning to use it? Click here to take the OpenTelemetry survey.
GitHub announced a wave of new features and enhancements to GitHub Copilot to streamline coding tasks based on an organization’s specific ways of working.
Mirantis launched k0rdent, an open-source Distributed Container Management Environment (DCME) that provides a single control point for cloud native applications – on-premises, on public clouds, at the edge – on any infrastructure, anywhere.
Hitachi Vantara announced a new co-engineered solution with Cisco designed for Red Hat OpenShift, a hybrid cloud application platform powered by Kubernetes.