While Most Developers Worry About Security, Many Development Teams Lack a Dedicated Security Expert
January 22, 2020

Eric Sheridan
WhiteHat Security

While nearly 75 percent of developers worry about the security of their applications, and 85 percent rank security as very important in the coding and development process, nearly half of their teams lack a dedicated security expert.
 
These are among the findings of a recent survey of 103 industry professionals at DeveloperWeek Austin in November, 2019.
 
The survey also found that while 57 percent of participants feel their teams have the right application security tools in place to incorporate security into the software development lifecycle (SDLC), 14 percent do not feel that they've been given the proper solutions to do so, and one-third weren't sure what their company provided. For those respondents who do utilize application security tools, 33 percent scan for vulnerabilities daily, 29 percent weekly and 20 percent monthly; this means that 82 percent scan their applications monthly at a minimum. The remaining 18 percent scanned either quarterly, annually or at random.

Surprisingly, 43 percent of respondents still focus on meeting their application release deadlines over security, which echoes an ongoing issue in the development community. Often, pressures to deliver a functional application by these dates cause coders to take security shortcuts or disregard it altogether. However, a promising 57 percent are realizing that application security should be a key part of the SDLC — and are prioritizing security practices over these demanding deadlines. 
 
Regardless, more than half (52 percent) of participants have experienced burnout as a result of the intense pressures to deliver the applications on time — and securely. When employees are burnt out, their performance can lag, impacting their personal life, professional growth and their company's deliverables.
 
What this research shows is that, while developers' concerns about securing their code are on an upward trajectory, it's clear the industry has a long way to go. Developers are on the front lines when it comes to protecting their organizations from cyberattacks, and they need the right tools and training to handle this burden. With applications being increasingly targeted by digital adversaries, it is vital that organizations and developers incorporate standard security protocols within DevOps, a practice known as DevSecOps. This should include regular cybersecurity training, an application security team lead and a holistic application security platform that can identify vulnerabilities in development, deployment and beyond.

Interestingly, despite this advice, 70 percent of developers have not received security certifications in their current or prior roles, and only 30 percent have. Developer respondents also provided insight into the skills needed in the field. While coding and security chops are important, soft skills are becoming more highly valued than ever when hiring new talent. Turns out, it's all about the wider group and shared responsibility. Forty-nine percent of developers say teamwork and interpersonal skills are most essential, with problem solving following in second place at 34 percent. Fourteen percent ranked communications and writing as most important, while leadership was ranked least important.
 
We are seeing strides in development and application security practices following this study. While there are still some concerns and areas for improvement, we are excited that developers are taking significant notice of this long deprioritized issue and taking steps to keep up with today's cyber risks.

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

February 27, 2020

Datadog announced an integration with Nessus from Tenable.

February 27, 2020

Talend announced the Winter ‘20 release of Talend Data Fabric.

February 27, 2020

Alcide announced that the Alcide Kubernetes Security Platform now supports compliance scans for PCI and GDPR, enabling DevOps to deliver regulatory compliance checks rapidly and seamlessly alongside Alcide’s leading Kubernetes security capabilities.

February 26, 2020

Perforce Software released a free tool for organizations considering open source software - OpenLogic Stack Builder.

February 26, 2020

Applause announced a new partnership with Infosys to provide broader end-to-end digital experience testing services to clients.

February 26, 2020

RapidMiner announced the release of its platform enhancement, RapidMiner 9.6. This update prioritizes people – not technology – at the center of the enterprise AI journey, providing new, unique experiences to empower users of varying backgrounds and abilities.

February 25, 2020

JFrog announced the availability of the "JFrog Platform," a hybrid, multi-cloud, universal DevOps platform.

February 25, 2020

Nureva added new agile canvas templates to Span Workspace, including a heat map developed by Jeff Sutherland, the co-creator of Scrum and founder of Scrum Inc. and Scrum@Scale.

February 25, 2020

Agiloft announced the addition of its new Agiloft AI Engine, complete with prebuilt AI Capabilities for contract management and an open AI integration that allows customers to incorporate custom-built AI tools into the no-code platform.

February 24, 2020

Cloudify announced that its latest product update - Cloudify version 5 - features an Environment as a Service component, designed to achieve consistent delivery and management of hybrid-cloud services and network infrastructures across CI/CD pipelines - at scale.

February 24, 2020

Checkmarx announced new enhancements to its Software Security Platform to empower more seamless implementation and automation of application security testing (AST) in modern development and DevOps environments.

February 24, 2020

Rapid7 and Snyk announced a strategic partnership to deliver end-to-end application security to organizations developing cloud native applications.

February 20, 2020

The American Council for Technology and Industry Advisory Council (ACT-IAC), the premier public-private partnership dedicated to advancing government through the application of information technology, officially announced the release of the DevOps Primer.

It was produced through a collaborative, volunteer effort by a working group from government and industry, hosted by the ACT-IAC Emerging Technology Community of Interest (COI).

February 20, 2020

DLT Solutions, a subsidiary of Tech Data, launched the Secure Software Factory (SSF), a framework that provides the U.S. public sector with consistent development and deployment of high-quality, scalable, resilient and secure software throughout an application’s lifecycle.

February 20, 2020

Netography announced the general availability of the company’s Security Operations Platform.