Understanding the Reality of Secure DevOps
November 14, 2016

Ashish Kuthiala
Hewlett Packard Enterprise

As organizations continue to adopt a more collaborative DevOps model, many face a common challenge: effectively integrating security practices into the application development lifecycle process. This challenge was brought to light in a new Application Security and DevOps Report from Hewlett Packard Enterprise (HPE).

According to the report, virtually all IT operations professionals, security leaders and developers (99 percent) agree that adopting a DevOps culture has the opportunity to improve application security. However, only 20 percent are actually conducting application security testing today during the development process.

Even more troublesome, 17 percent of respondents say they are not using any security technology to protect their applications. This statistic highlights a significant disconnect between the perception and the reality of secure DevOps.

DevOps shows great promise for secure software development. It provides organizations with the ability to test for, find and remediate security vulnerabilities earlier and more frequently in the application lifecycle as a result of continuous testing. Security flaws in software are not different from other software bugs – the earlier you detect and fix them, the greater the potential to prevent negative fallouts later on in the cycle. It is much more cost effective and efficient to catch a security flaw earlier in the software development cycle than to hear about it from customers using your application. If you wait to repair a flaw, you have to invest significantly more resources and time to fix the flaw in customer environments (than you would in dev) and you also risk damaging your brand and losing revenue.

However, DevOps is not a magic bullet that automatically makes applications more secure. In fact, DevOps can actually compound the issue if security is not built into the development process. Applications are being developed and released faster than ever before and the lack of an integrated approach can lead to greater security holes. Therefore it is critical that security and DevOps are incorporated and work seamlessly together.

The report shows that there are significant barriers and gaps which prevent organizations from successfully integrating security into the DevOps processes. Some of the key findings include:

Organizational challenges between security professionals and developers: The report reflected a significant disconnect between developers and security teams. In some cases, respondents admitted to not even knowing who their security colleagues were. Ninety percent of security professionals also stated that integrating application security has become more difficult since their organizations have deployed DevOps.

Lack of security awareness, emphasis, and training for developers: Out of more than 100 job postings for software developers at Fortune 1000 companies, none specified security or secure coding experience or knowledge as part of the skills required.

Shortage of application security talent: For every 80 developers in the organizations surveyed, there is only one application security professional. The lack of appropriately staffed security personnel, along with increasingly rapid development cycles, makes secure development extremely difficult.

The report offers the following recommendations to bring down these barriers and achieve better integration of security experts within DevOps teams as organizations continue to adopt DevOps practices:

Make security a shared responsibility across the organization to eliminate barriers: Security must be embedded throughout every stage of the development process, with executive support and metrics to hold teams accountable for secure development. These metrics should focus on mean-time-to-triage (MTTT), mean-time-to-fix (MTTF), and program compliance.

Make it seamless and more intuitive for developers to practice secure development by bridging awareness, emphasis, and training gaps: Organizations should integrate security tools into the development ecosystem to allow developers to find and fix vulnerabilities in real-time as they write code. This makes it easy and efficient to develop software securely, and educates the developer on secure coding in the process.

Leverage automation and analytics to streamline application security: Organizations should leverage enterprise-grade application security automation with analytics built in during the testing audit process. This allows security professionals to focus only on the highest priority risks, reducing the number of security issues that require manual review, saving both time and resources, while lowering overall risk exposure.

Both security practitioners and developers believe that the DevOps movement has the potential to significantly improve application security. Yet, organizations are struggling to realize that potential. By integrating security into the development cycles early on and making it part of the development lifecycle culture, organizations can successfully secure software in this new DevOps world without impeding the speed and agility that it brings.

Ashish Kuthiala is Senior Director of Marketing and Strategy, Hewlett Packard Enterprise DevOps.

Share this

Industry News

December 01, 2022

Salesforce introduced a new Automation Everywhere Bundle to accelerate end-to-end workflow orchestration, automate across any system, and embed data and AI-driven workflows anywhere.

December 01, 2022

Weaveworks announced that Flux, the original GitOps project, has graduated in the Cloud Native Computing Foundation (CNCF®).

December 01, 2022

Tigera announced enhancements to its cluster mesh capabilities for managing multi-cluster environments with Calico.

December 01, 2022

CloudBees achieved the Amazon Web Service (AWS) Service Ready Program for Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances.

November 30, 2022

GitLab announced the limited availability of GitLab Dedicated, a new way to use GitLab - as a single-tenant software as a service (SaaS) solution.

November 30, 2022

Red Hat announced an expansion of its open solutions publicly available in AWS Marketplace.

November 30, 2022

Sisense announced the availability of the Sisense CI/CD Git integration module.

November 29, 2022

Codenotary announced TrueSBOM for Serverless, a self-updating Software Bill of Materials (SBOM) for applications running on AWS Lamda, Google Cloud Functions and Microsoft Azure Functions that is made possible by simply adding one line to the application source code.

November 29, 2022

Code Intelligence announced its open-source Command-Line Interface (CLI) tool, CI Fuzz CLI, now allows Java developers to easily incorporate fuzz testing into their existing JUnit setup in order to find functional bugs and security vulnerabilities at scale.

November 29, 2022

Parasoft announced the 2022.2 release of Parasoft C/C++test with support for MISRA C:2012 Amendment 3 and a draft version of MISRA C++ 202x.

November 28, 2022

Kasm Technologies announced the release of Kasm Workspaces v1.12, providing major enhancements to its portfolio of digital workspaces delivering Desktop as a Service (DaaS), Virtualized Desktop Infrastructure (VDI), Remote Browser Isolation (RBI), Open-Source Intelligence Collection (OSINT), Training/Sandboxes, and Containerized Application Streaming (CAS).

November 28, 2022

Cloud4C has achieved Amazon Web Services (AWS) DevOps Competency status.

November 28, 2022

Simplilearn has acquired Fullstack Academy, for an all-cash transaction.

November 22, 2022

Red Hat introduced Red Hat Enterprise Linux 9.1and Red Hat Enterprise Linux 8.7.

November 22, 2022

Armory announced its new cloud-based solution called Continuous Deployment-as-a-Service, now available on the AWS Marketplace.