Security in DevOps Is Lagging Despite Advantages and Opportunities

Source – bwcio.businessworld.in

Synopsys Inc. has released new data that highlights the opportunities and challenges of DevSecOps, an emerging paradigm in which DevOps teams incorporate application security into their continuous integration and continuous delivery (CI/CD) workflows.

The 451 Research report commissioned by Synopsys, DevSecOps Realities and Opportunities, analyses survey results from 350 enterprise decision-makers at large enterprises across a variety of industries. The study found that only half of CI/CD workflows include application security testing elements despite respondents citing awareness of the importance and advantages of doing so.

“While some DevOps teams are starting to incorporate application security into their CI/CD workflows, driven by factors such as improved software quality, compliance, and risk avoidance, there is ample room for improvement,” said Jay Lyman, principal analyst at 451 Research. “In many cases, security testing is not being integrated often or early enough in the process for organisations to fully benefit from reduced risk and rework headaches.”

DevOps teams today are working with large-scale infrastructures, releasing software faster, and doing so with significant code changes in each release. Sixty-three percent of respondents say they expect to deploy software at least four times faster in a DevOps model. Without a clear and informed strategy, this can make establishing and scaling application security testing within these processes complex and difficult.

While organisations cited a lack of automation and consistency, reduced speed, and the noise of false positives as the primary challenges of DevSecOps, the survey also showed that the use of automated tools integrated early in the software development life cycle can have a positive impact on both the speed and the overall quality and security of software.

The survey also revealed that software composition analysis (SCA), or the identification of open source software components affected by known vulnerabilities, is the most critical application security element that needs to be incorporated into CI/CD workflows.

Interestingly, the survey showed that nearly 40 percent of organisations either do not perform SCA or claim not to use any open source components – which may represent a lack of awareness given that a previous Open Source Security and Risk Analysis report by Black Duck Software found that over 95 percent of applications contain open source.