Businesses don't understand how security can be integrated into DevOps

Claranet says businesses must be prepared to train employees, encouraging security teams to work with developers and operations staff

Office workplace security

DevSecOps is confusing businesses, leaving them open to attack by criminals, a report conducted by Vanson Bourne for Claranet has revealed.

Although DevOps is now a widely understood area (88% of UK businesses have adopted it or plan to in the next five years), only 19% of organisations think they are able to transfer the principles over to their security practices.

Claranet argues that businesses need to train their teams to understand what DevSecOps is and how it can be integrated into the usual DevOps scene.

"Embracing DevOps is clearly at the forefront of the minds of the majority of IT leaders across the UK, which provides some cause for encouragement," said Sumit Siddarth, director at NotSoSecure (a Claranet Group company). "But the overall lack of integration of security best practices into this process shows that, for many businesses, security is still being considered as something that is administered separately to the development lifecycle, rather than incorporated into it from end to end."

Advertisement
Advertisement - Article continues below

"Given the frequent development cycles that are an inherent characteristic of DevOps, seeing security as a separate entity can slow processes down and reduce efficiency, which either compromises the agility which is so central to any DevOps philosophy, or leads to windows where vulnerabilities can be released and won't be spotted until the next security testing cycle."

Siddarth explained that IT teams need to be the first port of call for working out how to implement and automate application security, including the basics such as continuous monitoring and static analysis. Making it clearer to staff how security processes can be integrated into a DevOps environment is key.

"Furthermore, newer approaches to security testing, such as continuous security testing, need to be used to ensure any testing approach is keeping up with the rate of change DevOps approaches allow for," he said.

But this training can't just be offered to the select few. All parties responsible for security and DevOps processes within a business should be trained on how the two parts of a business can benefit the entire organisation.

"If these formerly disparate components can be brought together, an effective DevSecOps philosophy will follow as a matter of course," he concluded.

Advertisement
Related Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
Visit/domain-name-system-dns/34842/microsoft-embraces-dns-over-https-to-secure-the-web
Domain Name System (DNS)

Microsoft embraces DNS over HTTPS to secure the web

19 Nov 2019
Visit/strategy/28115/the-pros-and-cons-of-net-neutrality
Business strategy

The pros and cons of net neutrality

4 Nov 2019
Visit/social-media/34844/can-wikipedia-founders-social-network-really-challenge-facebook
social media

Can Wikipedia founder's social network really challenge Facebook?

19 Nov 2019