DevSecOps set to boom

Latest research suggests that relatively few organisations are currently securing the majority of their cloud-native applications with DevSecOps practices. This is likely to change significantly over the next two years.

DevSecOps is the philosophy of integrating security practices within the DevOps culture of your organisation. DevSecOps involves creating a 'Security as Code' culture with ongoing, flexible collaboration between release engineers and security teams.

According to findings from a study by Enterprise Strategy Group (ESG), just 8% of organisations are securing 75% or more of their cloud-native applications with DevSecOps practices today. However, this figure is set to rocket, with 68% of organisations expected to secure 75% (or more) of their cloud-native applications with DevSecOps practices within two years.

Based on a survey of 371 IT and cybersecurity professionals, the study makes it clear that current adoption of DevSecOps is still very mixed. For example, only 33% of respondents involved cybersecurity teams at the start of the application development process.

This is despite the wide range of cybersecurity challenges that organisations are facing, including consistently managing cybersecurity across multiple platforms (43%), the cost and complexity of implementing cybersecurity controls across those platforms (35%) and lack of understanding of the threats that cloud-native applications face (35%).

Another issue to emerge from the report is the way in which organisations are currently structured. It found that 82% of respondents have different teams assigned to secure cloud-native apps. Of these, half plan to merge these responsibilities in the future, while 32% intend to keep them separate.

One major conclusion was that as organisations embrace best DevOps practices to build and deploy cloud-native applications, those processes should be extended to include security controls as part of the quality assurance process. Rather than incurring the expense and disruption of bolting on security, organisations should build cybersecurity controls into their software from the ground up.

This requires closer integration between security, deployment, platform and development practices, a point that tellingly also emerged from another new piece of research, the ‘2019 State of DevOps Report’ from Puppet.

This found that integrating security deeply into the software delivery lifecycle makes teams more than twice as confident of their security posture. Recognising the importance of incorporating the highest level of security into the application development and deployment processes, the report identified the following five best practices for security integration:

• Security and development teams collaborate on threat models
• Security tools are integrated into the development integration pipeline, so engineers can be confident they’re not inadvertently introducing known security problems into their codebases
• Security requirements - both functional and non-functional - are prioritised as part of the product backlog
• Infrastructure-related security policies are reviewed before deployment
• Security experts evaluate automated tests and are called upon to review changes in high-risk areas of the code.

The messages are clear as far as DevSecOps is concerned: it will increasingly become the standard approach for securing cloud-native applications, but it will require an integrated and unified approach that includes greater involvement of the cybersecurity team.