Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

DevSecOps Gains Enterprise Traction

Enterprise adoption of DevSecOps has surged in the past year, according to a study conducted at this year's RSA Conference.

DevSecOps is a great portmanteau word, but is it a concept in wide use? According to a survey of attendees at this year's RSA Conference, it's not yet universal, but many more organizations are now embracing at least some DevSecOps principles than was the case even a year ago.

The survey, conducted by Aqua Security, asked IT security professionals attending the San Francisco conference questions about whether their organizations were using DevSecOps principles and, if so, some of the details of that use.

In all, 63% of the participants said they have a formal or informal DevSecOps team in place. According to Andy Feit, VP, go-to-market, at Aqua Security, the "informal" part is important.

"That means they don't have to have a director, but they can say that they use some DevSecOps activities," Feit says. "We talk to a lot of organizations every day, but we don't always find a person who has 'DevSecOps' on their business card."

No matter how you define the word, though, its expansion has been impressive. "Last year only 13% of a similar pool of respondents reported they had a DevSecOps team in place; less than a year later, that number has skyrocketed to 62%," Feit says.

Perhaps more important, he says, is that a healthy percentage of the individuals responding said that their organizations were committing resources to the DevSecOps effort. "Sixty perfect said they have the people and the money," he says, adding that another 10% said they have the people but not the money, while 11% said they have the money but not the people.

Asked why so many organizations feel it's important to move in the direction of DevSecOps, Feit talks about the effort to have security "shift left" in the application creation and deployment process. "When you ask why people deploy DevSecOps, applying security across the app life cycle is No. 1, and shifting security left is No. 2," he says.

The most critical factor in DevSecOps' expansion, Feit says, is the unending need for speed in getting applications in front of users. "Everyone's trying to move more quickly through the process. They don't want to get things done and then get into a wait state," he says.

Still, the embrace of DevSecOps is not universal. In response to a Twitter query on DevSecOps deployment, Twitter user @p3l was succinct: "| sed -e s/sec//" he tweeted.

Related content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9342
PUBLISHED: 2020-02-22
The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 (on Linux) of Cloud Protection For Salesforce, Email and Server Security, and Internet GateKeeper.
CVE-2020-9338
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
CVE-2020-9339
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
CVE-2020-9340
PUBLISHED: 2020-02-22
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.
CVE-2020-9341
PUBLISHED: 2020-02-22
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI.