Operations

6/7/2018
04:55 PM
50%
50%

DevSecOps Gains Enterprise Traction

Enterprise adoption of DevSecOps has surged in the past year, according to a study conducted at this year's RSA Conference.

DevSecOps is a great portmanteau word, but is it a concept in wide use? According to a survey of attendees at this year's RSA Conference, it's not yet universal, but many more organizations are now embracing at least some DevSecOps principles than was the case even a year ago.

The survey, conducted by Aqua Security, asked IT security professionals attending the San Francisco conference questions about whether their organizations were using DevSecOps principles and, if so, some of the details of that use.

In all, 63% of the participants said they have a formal or informal DevSecOps team in place. According to Andy Feit, VP, go-to-market, at Aqua Security, the "informal" part is important.

"That means they don't have to have a director, but they can say that they use some DevSecOps activities," Feit says. "We talk to a lot of organizations every day, but we don't always find a person who has 'DevSecOps' on their business card."

No matter how you define the word, though, its expansion has been impressive. "Last year only 13% of a similar pool of respondents reported they had a DevSecOps team in place; less than a year later, that number has skyrocketed to 62%," Feit says.

Perhaps more important, he says, is that a healthy percentage of the individuals responding said that their organizations were committing resources to the DevSecOps effort. "Sixty perfect said they have the people and the money," he says, adding that another 10% said they have the people but not the money, while 11% said they have the money but not the people.

Asked why so many organizations feel it's important to move in the direction of DevSecOps, Feit talks about the effort to have security "shift left" in the application creation and deployment process. "When you ask why people deploy DevSecOps, applying security across the app life cycle is No. 1, and shifting security left is No. 2," he says.

The most critical factor in DevSecOps' expansion, Feit says, is the unending need for speed in getting applications in front of users. "Everyone's trying to move more quickly through the process. They don't want to get things done and then get into a wait state," he says.

Still, the embrace of DevSecOps is not universal. In response to a Twitter query on DevSecOps deployment, Twitter user @p3l was succinct: "| sed -e s/sec//" he tweeted.

Related content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.