Application Security

12/20/2016
03:20 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Application Security Still Slows Developer Work

Cooperation among DevOps teams might be growing, but security testing still seen as a road block to continuous delivery.

The cooperative nature of DevOps software delivery has done a lot to reduce friction between operations staff and developers, but looping security into the greater process still remains a challenge. According to a survey out today from Veracode, over half of developers report that security causes delays in the development process.

Conducted among more than 350 developers worldwide, the survey took a look at developer perceptions of application security and the impact that security testing has on their professional lives. As things stand, 52% of developers and 54.3% of DevOps managers report that security testing slows down development and threatens deadlines. This was the biggest challenge they reported about their work. Closely following that challenge is the difficulty of legacy application security processes adding complexity and slowing time-to-market, which was reported as a top challenge by 46% of developers and 44% of DevOps managers.

This is a huge business problem considering the intense heat turned up by the business on developers and DevOps to shorten development timelines. In a report earlier this year, Forrester found that 88% of developers feel increased pressure to produce more frequent releases. A little more than half of developers surveyed for that report now release at least monthly and 77% say that the business is also demanding software with more complex requirements and capabilities.

While there's clearly a lot of work to offer a more seamless mode of injecting security into the development process, the Veracode survey shows that a statistically significant ratio of organizations are moving in the right direction.

"Although it’s a best practice to address security early in the software development lifecycle, the shift towards continuous delivery and DevOps is providing more opportunities to integrate security throughout the entire lifecycle," the survey report explained. The study shows that the majority of organizations are seeking to incorporate security earlier in the software development lifecycle, with only about 16% relying inserting it after the programming stage. One of the best signs is that almost one in three organizations say they're involving security during requirements or design phases of development.

According to analysts with Forrester, that's huge not just for the security of the software but also the value an organization gets out of it.  

"Developers who regularly collaborate with their security colleagues on software development tasks get significant value from their efforts, which produce major and tangible business and technical benefit," Forrester experts write.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
12/22/2016 | 2:41:05 AM
Common Ground
I hear this complaint all the time, have even been the one complaining in the past.  Perhaps the answer is in refining the existing processes of development and operations to make security an integral function.  If you've been hired as a programmer for a killer app that uses some new killer lib, you'd never say "Gee, learning how to program against this new library is really slowing my time to market down!"  That's your job, to learn, to experiment, and to do it in a timely fashion.  So should secure programming be, and so should security in general.  It is as integral to software projects and release infrastructures as learning how to program is.  DevOps especially should be an innovator of finding common ground for security to be embraced on by both coders and security engineers.  You know what a really killer app is?  An unhackable app; uncrackable and well coded.  A secure app that protects the user's data while still being useful.  That kind of app doesn't just appear, it needs to be intentionally created, and lovingly created.  These rifts and complaints about security bringing down the dev process isn't going to produce that killer app. 
rickkaun
50%
50%
rickkaun,
User Rank: Apprentice
12/21/2016 | 11:01:27 AM
Application Security Still Slows Developer Work
Wow! Is everyone ever missing the point here!  When cybersecurity testing is included in functional testing or QA then these types of surveys go away.  Cybersecurity is a core component of any code or it should be.  Failing to see this and recognize its importance just shows how ignorant the development community still is.  None of these survey respondents seemed to complain about functionality testing or QA cycles in their development plans did they?  
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.