Top Performing Software Development Teams Embrace DevSecOps Automation
March 23, 2017

Derek Weeks
Sonatype

Start with DevSecOps: Eat Carrots, Not Cupcakes

Mature development organizations ensure automated security is woven into their DevOps practice, early, everywhere, and at scale, according to Sonatype's 2017 DevSecOps Community Survey.


Analysis of responses also found that IT organizations continue to struggle with breaches, as nearly a 50% increase was recorded between Sonatype’s 2014 and 2017 survey.

The adoption of DevOps around the world is evidenced by 67% of survey respondents describing their practices as very mature or of improving maturity. Where traditional development and operations teams (47%) see security teams and policies slowing them down, DevOps teams have discovered new ways to integrate security at the speed of development. Only 28% of mature DevOps teams believe they are being slowed by security requirements.

Other key findings from the survey include:

■ Developers are taking more responsibility for security with 24% of all respondents saying it’s a top concern while in mature DevOps organizations that number rises to 38%.

■ 58% of mature DevOps teams have automated security as part of Continuous Integration (CI) practices compared to 39% of all survey participants.

■ For DevOps teams, security controls are increasingly automated throughout the development lifecycle. 42% of mature DevOps organizations perform application security analysis at every stage of the software delivery lifecycle (SDLC). This number shrinks to just 27% when all survey respondents are counted.

■ 88% of survey respondents indicated that security was a top concern when deploying containers, yet only 53% leverage security solutions to address this problem.

■ 35% of organizations keep a complete software bill of materials to help them track down new open source vulnerabilities faster (e.g., Commons-Collection, Struts2).

■ 85% of those surveyed from highly mature DevOps practices received some form of application security training, ensuring awareness of secure coding practices. In immature DevOps practices, 30% received no training.


"As evidenced by this year’s survey results, organizations everywhere are now transforming their development from waterfall-native to DevOps-native tools and processes,” said Wayne Jackson, CEO, Sonatype. “Along the way, they are coming to grips with one simple fact: DevOps is not an excuse to do application security poorly; rather it is an opportunity to do application security better than ever.”

Methodology: The 2017 DevSecOps Community Survey provides visibility into the attitudes of software professionals toward DevOps best practices and the changing role of application security. The survey was conducted by Sonatype, Contino, DZone, Emerasoft, Ranger4, and Signal Sciences. The survey’s margin of error is ±2.02 percentage points for 2,292 IT professionals at the 95% confidence level.

Derek Weeks is VP and DevOps Advocate at Sonatype.

The Latest

May 25, 2017

DevOps brings Development and Operations together with the sheer objective of ensuring quality and enabling faster time to market. However, what happens to QA in this scenario? How does the Testing team fit in? Let's ponder on this further and understand the role of QA and Testing in the DevOps world ...

May 23, 2017

When organizations adopt containers and microservice style architectures in production, systems become incredibly complex. For operations it's a shock because it means coming to grips with many new container tech nuances - plus letting go of the old monitoring rule book ...

May 22, 2017

Managing application performance today requires analytics. IT Operations Analytics (ITOA) is often used to augment or built into Application Performance Management solutions to process the massive amounts of metrics coming out of today's IT environment. But today ITOA stands at a crossroads as revolutionary technologies and capabilities are emerging to push it into new realms. So where is ITOA going next? With this question in mind, DEVOPSdigest partner site APMdigest asked experts across the industry for their opinions on the next steps for ITOA ...

May 18, 2017

In Part 3 of my Q&A with industry analysts, I ask: What trends will have the biggest impact on the software industry and DevOps in particular this year and beyond? How can enterprises set themselves up to succeed with so many rapid changes occurring in development and delivery? ...

May 16, 2017

See how to turbo-charge the impact of APIs, according to a global study conducted by CA Technologies ...

May 15, 2017

APIs are vital components for business success and thriving in the application economy, according to a global study conducted by CA Technologies ...

May 11, 2017

In Part 2, I'll dive into some findings from CollabNet's outreach to industry analysts. I asked them about the greatest challenges facing enterprises venturing into the world of DevOps and to touch on what lies ahead for the future of the DevOps movement ...

May 09, 2017

DevOps teams bring significant benefits to their organizations. Unfortunately, DevOps teams, like many business programs, tend to believe innovation must come with a detriment to security. Security measures are often seen as obstacles that impact the agility that DevOps teams rely on ...

May 08, 2017

With increased competition, enterprises now require greater agility than ever before, and traditional approaches simply can’t provide the speed enterprises demand. To remain competitive with these new players, companies need to improve their operational agility both in the data center and the WAN ...

May 04, 2017

There is no "right" culture for DevOps, but characteristics such as open communication, high cooperation, collaboration, respect, and trust are essential. If your organization does not have these characteristics, they must be developed. Culture is learned, not inherited. It must be genuinely nurtured by everyone from executive management on down the line. Here are some hacks to help develop a positive DevOps culture ...

Share this