Security in DevOps is lagging despite advantages and opportunities, according to 451 Research and Synopsys

Andreas Kuehlmann of Synopsys Inc.

Synopsys, Inc. released new data that highlights the opportunities and challenges of DevSecOps, an emerging paradigm in which DevOps teams incorporate application security into their continuous integration and continuous delivery (CI/CD) workflows.

The 451 Research report commissioned by Synopsys, DevSecOps Realities and Opportunities, analyses survey results from 350 enterprise decision-makers at large enterprises across a variety of industries. The study found that only half of CI/CD workflows include application security testing elements despite respondents citing awareness of the importance and advantages of doing so.

“While some DevOps teams are starting to incorporate application security into their CI/CD workflows, driven by factors such as improved software quality, compliance, and risk avoidance, there is ample room for improvement,” said Jay Lyman, principal analyst at 451 Research. “In many cases, security testing is not being integrated often or early enough in the process for organisations to fully benefit from reduced risk and rework headaches.”

DevOps teams today are working with large-scale infrastructures, releasing software faster, and doing so with significant code changes in each release. 63% of respondents say they expect to deploy software at least four times faster in a DevOps model. Without a clear and informed strategy, this can make establishing and scaling application security testing within these processes complex and difficult.

While organisations cited a lack of automation and consistency, reduced speed, and the noise of false positives as the primary challenges of DevSecOps, the survey also showed that the use of automated tools integrated early in the software development life cycle can have a positive impact on both the speed and the overall quality and security of software.

The survey also revealed that software composition analysis (SCA), or the identification of open source software components affected by known vulnerabilities, is the most critical application security element that needs to be incorporated into CI/CD workflows.

Jay Lyman

Interestingly, the survey also showed that nearly 40% of organisations either do not perform SCA or claim not to use any open source components – which may represent a lack of awareness given that a previous Open Source Security and Risk Analysis report by Black Duck Software found that over 95% of applications contain open source. Synopsys acquired Black Duck Software, the global leader in software composition analysis solutions, in December 2017.

“DevSecOps presents an opportunity to make application security part of the cultural and technological fabric of modern, high-velocity development and deployment models,” said Andreas Kuehlmann, general manager of the Synopsys Software Integrity Group.

“This study highlights many of the opportunities and challenges DevOps team face in adapting and applying application security tools and best practices. It also validates that automation, speed, accuracy, and CI/CD integration—attributes Synopsys has built into its application security solutions—are critical to making DevSecOps successful.”

To read the full report, click here.

To register for the joint 451 Research and Synopsys webinar exploring the result of this study on May 15, click here.

Comment on this article below or via Twitter: @IoTNow OR @jcIoTnow

RECENT ARTICLES

HUAWEI IdeaHub S2 launched for smart office and education

Posted on: August 16, 2022

Beijing, China. 16 August, 2022 – On August 8, 2022, CCTV news joined Huawei at the Intelligent Collaboration 2022 new product launch, which officially released the HUAWEI IdeaHub S2 – the HarmonyOS collaboration flat panel. The IdeaHub S2 is another success to add to Huawei’s portfolio of innovative, creating better value for customers.

Read more

Nordic-powered smart utility access cover offers anti-theft protection and detects open/close events

Posted on: August 16, 2022

Oslo, Norway – China-based Jian-IOT has launched a smart utility access cover that can detect when the cover has been opened or closed, records water level and temperature data, identifies any damage, and includes an anti-theft system that tracks the current location of the device. The ‘Integrated Intelligent Manhole Cover’ employs Nordic’s nRF52832 SoC to both act

Read more
FEATURED IoT STORIES

9 IoT applications that will change everything

Posted on: September 1, 2021

Whether you are a future-minded CEO, tech-driven CEO or IT leader, you’ve come across the term IoT before. It’s often used alongside superlatives regarding how it will revolutionize the way you work, play, and live. But is it just another buzzword, or is it the as-promised technological holy grail? The truth is that Internet of

Read more

Which IoT Platform 2021? IoT Now Enterprise Buyers’ Guide

Posted on: August 30, 2021

There are several different parts in a complete IoT solution, all of which must work together to get the result needed, write IoT Now Enterprise Buyers’ Guide – Which IoT Platform 2021? authors Robin Duke-Woolley, the CEO and Bill Ingle, a senior analyst, at Beecham Research. Figure 1 shows these parts and, although not all

Read more

CAT-M1 vs NB-IoT – examining the real differences

Posted on: June 21, 2021

As industry players look to provide the next generation of IoT connectivity, two different standards have emerged under release 13 of 3GPP – CAT-M1 and NB-IoT.

Read more

IoT and home automation: What does the future hold?

Posted on: June 10, 2020

Once a dream, home automation using iot is slowly but steadily becoming a part of daily lives around the world. In fact, it is believed that the global market for smart home automation will reach $40 billion by 2020.

Read more

5 challenges still facing the Internet of Things

Posted on: June 3, 2020

The Internet of Things (IoT) has quickly become a huge part of how people live, communicate and do business. All around the world, web-enabled devices are turning our world into a more switched-on place to live.

Read more

What is IoT?

Posted on: July 7, 2019

What is IoT Data as a new oil IoT connectivity What is IoT video So what’s IoT? The phrase ‘Internet of Things’ (IoT) is officially everywhere. It constantly shows up in my Google news feed, the weekend tech supplements are waxing lyrical about it and the volume of marketing emails I receive advertising ‘smart, connected

Read more
IoT Newsletter

Join the IoT Now online community for FREE, to receive: Exclusive offers for entry to all the IoT events that matter, round the world

Free access to a huge selection of the latest IoT analyst reports and industry whitepapers

The latest IoT news, as it breaks, to your inbox