Improving DevOps Agility Does Not Mean Sacrificing Data Security
August 01, 2017

Dan Timpson
DigiCert

When was the last time you worked closely with your IT security team? Your CISO may provide you (and every other employee) with guidelines for avoiding ransomware and other types of malware, but that may be the extent of your interactions with the security team. Your top priority is to improve application development agility, but you may run into roadblocks put up by a security team that (mistakenly) believes speed is the enemy of effective cybersecurity. A new survey finds a majority of enterprises are working to overcome those roadblocks by integrating security into their existing DevOps methodology.

That is the key finding of DigiCert's 2017 Inviting Security into DevOps survey. DigiCert polled 300 senior management professionals within IT, DevOps and Security teams with small, medium and large organizations that have already implemented a DevOps posture.

98 percent of respondents say they have made integrating their security teams into their existing DevOps methodology a priority in order to accomplish two primary goals: increase business agility, and improve information security. The market is at a tipping point. About half (49 percent) are working on doing so and half (49 percent) say they have completed the process.

"The faster that we implement something, the more likely it is to have vulnerability issues," said one respondent who is an IT manager for a large central US manufacturing firm. “That's why for us security is so important; it saves us time and money in the long run."

Underscoring the security risk, 59 percent of the respondents say they sometimes or often have rogue certificates (for example, certificates that DevOps purchased, but neglected to tell anyone in Security about, causing problems when they expire).

Integrating security with DevOps is not easy and presents several issues to overcome. To make matters more complex, these challenges can change once the integration process begins.

The top three obstacles in the minds of respondents who are just beginning their efforts are that:

1. The organization structure prohibits integration

2. They lack a champion for the transition

3. The security team doesn't really work well in a team environment

However, that list changes once an enterprise nears completion:

1. Takes too much time

2. Security team resists the change

3. The relationship skills required to integrate the two teams

Note the top challenge cited after integrating was that the transition took too long. Technical teams underestimate the challenge of integrating security into DevOps, thinking the integration will take less than a year (seven to 11 months), whereas those who claim to have completed the process say it took roughly twice as long – on average one to two years.

The latter group has another list, and it's one that should encourage companies that are still in the early stages: how their efforts have improved both security and agility. They are:

■ 22 percent more likely to report they are doing well with information security

■ 21 percent more likely to report doing well meeting app delivery deadlines

■ 21 percent more likely to report doing well at lowering app risk

The survey's findings also reveal four key steps any organization can take to achieve the optimum balance of development agility and information security:

1. Appoint a Social Leader

Identify one person who will drive cultural change by clearly defining IT, security, DevOps roles and integrating the disparate teams.

2. Bring Security to the Table

Place a security lead on all DevOps teams and involve them from the beginning. Limit access, and implement automated PKI to require signing and encrypting everything within the network.

3. Invest in Automation

Automate baseline security practices within DevOps workflow, including: certificate management, patching, vulnerability scanning, stack code analysis.

4. Integrate and Standardize

Implement controls on certificate management processes and integrate with server configuration and orchestration platforms to enable automated security behind the scenes.

If there's one key takeaway of the 2017 Inviting Security into DevOps survey findings, it's this: Integrating security into DevOps is well worth the effort.

“We've found that agility was actually a byproduct of putting security upfront," said a senior project manager at a large metals manufacturer in the northeast. “If you really want to be agile, you don't want to do things twice."

Dan Timpson is CTO at DigiCert

The Latest

September 21, 2017

There are many options when it comes to container orchestration platforms and services. Figuring out which one is best for a particular organization’s needs and applications can be a challenge. Which platform for containerization you choose can significantly influence your business success, so the selection process should be carefully considered ...

September 20, 2017

A powerful tool for simplifying DevOps is containerization, which delivers a convenient form of application packaging, combined with the opportunity to automate certain IT provisioning processes. With containerization, DevOps teams can focus on their priorities — the Ops team preparing containers with all needed dependencies and configurations; and the Dev team focusing on efficient coding of an application that can be easily deployed ...

September 18, 2017

Web development and web design are intertwined in such a way that there is not one without the other — not anymore at least. The following outlines 5 benefits of collaboration ...

September 14, 2017

Mastering modern software development by building a "Modern Software Factory" is at the heart of business success in the digital economy, according to the results of a survey of over 1,200 IT leaders released today by CA Technologies ...

September 13, 2017

IT-Business convergence is needed to deliver continuous change, but many of the current tools add complexity and fail to merge the two, according to the Panaya 2017 State of Functional Testing Report ...

September 11, 2017

Application Program Interfaces (API’s) represent an effective way to build and manage mobile services. By using APIs — a set of routines, protocols and tools for building software applications — application developers no longer have to buy technology software or hardware. Instead, they can simply plug into a growing open ecosystem of API-driven services. It is simple to integrate, and saves time and money for new developers ...

September 07, 2017

More than a quarter of enterprises globally have not built, customized or virtualized any mobile apps in the last 12 months, according to the latest mobile app survey by Gartner ...

September 06, 2017

The number of malware breaches (to use a generic term) are rising in near exponential numbers and, unless there are radical changes, this is set to continue unabated. Most pundits agree with this forecast ...

September 01, 2017

DevOps encourages communication and collaboration between development and operations teams. Achieving greater synergies between the Dev and Ops teams doesn't happen overnight, but it is possible to fast track the process with the right technologies in place. One such technology is IT automation ...

August 29, 2017

Newly released data shows that distributed denial of service (DDoS) and web application attacks are on the rise once again, according to the Second Quarter, 2017 State of the Internet / Security Report released by Akamai Technologies ...

Share this