Application Security

12/20/2016
03:20 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Application Security Still Slows Developer Work

Cooperation among DevOps teams might be growing, but security testing still seen as a road block to continuous delivery.

The cooperative nature of DevOps software delivery has done a lot to reduce friction between operations staff and developers, but looping security into the greater process still remains a challenge. According to a survey out today from Veracode, over half of developers report that security causes delays in the development process.

Conducted among more than 350 developers worldwide, the survey took a look at developer perceptions of application security and the impact that security testing has on their professional lives. As things stand, 52% of developers and 54.3% of DevOps managers report that security testing slows down development and threatens deadlines. This was the biggest challenge they reported about their work. Closely following that challenge is the difficulty of legacy application security processes adding complexity and slowing time-to-market, which was reported as a top challenge by 46% of developers and 44% of DevOps managers.

This is a huge business problem considering the intense heat turned up by the business on developers and DevOps to shorten development timelines. In a report earlier this year, Forrester found that 88% of developers feel increased pressure to produce more frequent releases. A little more than half of developers surveyed for that report now release at least monthly and 77% say that the business is also demanding software with more complex requirements and capabilities.

While there's clearly a lot of work to offer a more seamless mode of injecting security into the development process, the Veracode survey shows that a statistically significant ratio of organizations are moving in the right direction.

"Although it’s a best practice to address security early in the software development lifecycle, the shift towards continuous delivery and DevOps is providing more opportunities to integrate security throughout the entire lifecycle," the survey report explained. The study shows that the majority of organizations are seeking to incorporate security earlier in the software development lifecycle, with only about 16% relying inserting it after the programming stage. One of the best signs is that almost one in three organizations say they're involving security during requirements or design phases of development.

According to analysts with Forrester, that's huge not just for the security of the software but also the value an organization gets out of it.  

"Developers who regularly collaborate with their security colleagues on software development tasks get significant value from their efforts, which produce major and tangible business and technical benefit," Forrester experts write.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
12/22/2016 | 2:41:05 AM
Common Ground
I hear this complaint all the time, have even been the one complaining in the past.  Perhaps the answer is in refining the existing processes of development and operations to make security an integral function.  If you've been hired as a programmer for a killer app that uses some new killer lib, you'd never say "Gee, learning how to program against this new library is really slowing my time to market down!"  That's your job, to learn, to experiment, and to do it in a timely fashion.  So should secure programming be, and so should security in general.  It is as integral to software projects and release infrastructures as learning how to program is.  DevOps especially should be an innovator of finding common ground for security to be embraced on by both coders and security engineers.  You know what a really killer app is?  An unhackable app; uncrackable and well coded.  A secure app that protects the user's data while still being useful.  That kind of app doesn't just appear, it needs to be intentionally created, and lovingly created.  These rifts and complaints about security bringing down the dev process isn't going to produce that killer app. 
rickkaun
50%
50%
rickkaun,
User Rank: Apprentice
12/21/2016 | 11:01:27 AM
Application Security Still Slows Developer Work
Wow! Is everyone ever missing the point here!  When cybersecurity testing is included in functional testing or QA then these types of surveys go away.  Cybersecurity is a core component of any code or it should be.  Failing to see this and recognize its importance just shows how ignorant the development community still is.  None of these survey respondents seemed to complain about functionality testing or QA cycles in their development plans did they?  
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
How Well Is Your Organization Investing Its Cybersecurity Dollars?
Jack Jones, Chairman, FAIR Institute,  12/11/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18397
PUBLISHED: 2018-12-12
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/us...
CVE-2018-20094
PUBLISHED: 2018-12-12
An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
CVE-2018-20095
PUBLISHED: 2018-12-12
An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls.
CVE-2018-20096
PUBLISHED: 2018-12-12
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVE-2018-20097
PUBLISHED: 2018-12-12
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.