DEVOPSdigest

Developers are spending significantly more time — and companies are spending $28K per developer yearly — on security-related tasks such as manual application scan reviews, context switching, and secrets detection, among other items, according to the IDC InfoBrief, The Hidden Cost of DevSecOps: A Developer's Time Assessment, sponsored by JFrog.

Source: JFrog(link is external)

The report showed 50% of senior developers, team leaders, product owners and development managers experienced a significant increase in the number of hours spent weekly on software security-related tasks, detracting from their ability to innovate, build, and deliver new business applications.

"Securing the software supply chain already poses significant challenges for organizations, but it becomes more complex when multiple tools are used, forcing developers to toggle between multiple environments, leading to inefficiencies, conflicting findings, wasted time, and increased risk," said Asaf Karas, CTO of JFrog Security. "IDC's survey creates a compelling case for companies to invest in streamlined security processes, tooling and training, to empower their developers to be more efficient and effective in protecting the software supply chain."

Half of survey respondents said they spend an estimated 19% of their weekly hours on security-related tasks, oftentimes outside normal working hours, which could lead to a reactive approach to security rather than a proactive one.

Other key findings from the IDC survey include:

Chasing Ghosts: Eliminating False Positives

Developers spend 3.5 hours on average manually reviewing security scanning findings because of false positives and duplicates.

Context Matters

69% of developers agree or strongly agree that their security-related responsibilities require them to frequently switch contexts between various tools, slowing efficiency. Multitool context switching can also increase token usage for bypassing reauthentication per platform. Tokens can be helpful in application development but can also be quickly forgotten and leave backdoors in companies' systems for attacks.

Secrets are No Fun

Developers devote 50% of their time to understanding and interpreting secrets scanning results, making changes to code to remediate findings, and updating secrets management measures.

Infrastructure Investigation

Infrastructure-as-Code (IaC) — used to automate the provisioning and management of IT infrastructure, such as servers, networking, operating systems, and storage — must be scanned every time code changes, with more than 54% of developers saying they run IaC scans weekly or monthly.

SAST Isn't a Blast

Despite static application security testing (SAST) tools being integrated to local development environments to provide findings as developers code, only 23% of developers are running SAST scans before deploying code into production, leaving a huge gap for malicious code to slip through.

"DevSecOps is not just a business imperative; it is the cornerstone of building the secure applications of the future. However, a significant challenge lies in overcoming inefficient, poorly implemented tools that squander developers' time and inflate costs," said Katie Norton, Research Manager, DevSecOps and Software Supply Chain Security at IDC. "To be successful, IT and software development team leaders must automate repetitive and time-consuming tasks, ensure DevSecOps tools deliver accuracy with minimal false positives, and provide ongoing access for developers to application security education and resources so they can keep pace with a rapidly increasing threat landscape."

Methodology: The IDC InfoBrief surveyed senior developers, team leaders, product owners and development managers from companies in 20+ industries with 1K+ employees across the US, UK, France and Germany.