Time to Move from DevOps to DevSecOps, Finds Latest CIO Survey

While development and operations (DevOps) automation tools are still the most prevalent, DevSecOps and microservices gained traction over use of containers and serverless/FaaS, says Radware’s latest report.

Agility is the key to deliver real-time customer experience. For IT customers, this agility can drastically influence brand reputation. Today, global enterprises seek and scale their ability to adapt quickly to changing market conditions with new. Here, updated web applications are critical to success.  CIOs are constantly hounded with risky malware and data breaches. API integrations have been identified to be one of the biggest surface attack destinations. Yet, the hunt is on to provide agile infrastructures. Is it really possible to achieve the balance of CX, Security, and Agility?

What would you do if you are told that over 90% of the profit-making businesses have experienced a breach in their cybersecurity and IT operations! Out of which, only 45% are confident (half nods!) that they can stay away from any future breach.

Recommended: IDC MarketScape Evaluates 15 Automation Services Providers

Move to MicroServices with DevSecOps

In its 2019 State of Web Application Security Report, Radware has reported that while organizations shift their applications to microservices environments, the responsibility for securing these environments shifts as well. The report finds the transformation of DevOps role into a more security-specific one. It highlights the rapid surge of the Development Security Operations (DevSecOps) role and how it has changed the way companies address their security posture.

Organizations are adjusting roles and responsibilities to cope with both the agility and security requirements that accompany these new environments. More than 90% of respondents reported that their organizations have Development Operations (DevOps) or DevSecOps teams. These teams [DevSecOps + DevOps] are relatively new with only 21% of respondents reporting DevSecOps teams in place for longer than 24 months.

Read More: Data Assets at Risk from IT Security Misvaluation

More than half (58%) of organizations reported a ratio of between 1:6 and 1:10 DevSecOps to development personnel. When evaluating collaboration between DevOps and DevSecOps teams, 49% said the teams were working very closely while 46% said they were managing to work together.

At the time of this announcement, Anna Convery-Pelletier, Radware’s Chief Marketing Officer, said, “We are at an inflection point culturally between the role of DevSecOps and the CISO. Our research shows that respondents— regardless of title— feel that they have control over their security posture. Yet 90% of organizations still experienced lost data. This is a contradiction that speaks to the organizational differences between DevSecOps and traditional IT security roles. While the CISO’s organization is faced with responsibility for keeping the organization secure at all costs, the DevSecOps teams recognize that agility is critical to business operations, and so they are often forced to take a ‘good enough’ approach.”

Approximately 70% of survey respondents, who were CIOs and their peers, stated that the CISO was not the top influencer in deciding on security software policy, tools and or implementation. This shift has likely exposed companies to a broader range of security risks and gaps in protection.

In fact, 90% of respondents reported data breaches within the past 12 months, and 53% of respondents believe that cloud data or application data exposures resulted from misunderstandings of security responsibility with their cloud provider.

David Monahan, former Managing Research Director, Security and Risk Management for EMA said, “The current movement to containers and microservices is fundamentally different in its offer for ease of deployment, creating the ability for continuous integrations and continuous development (CICD) and improved application performance. Simultaneously, it brings some intrinsic risks.”

Trust in cloud security providers is falling. In 2018, 86% of respondents said they trusted their Cloud providers’ level of security. One year later, that figure has dropped 14 points to 72%.

Read More: NXM Unveils Autonomous Security Platform for IoT Devices Enabling Them to Manage Security and Data Privacy Without Human Oversight

Is it Possible to Achieve Three 9’s: Application Attacks Prevail

In a Gartner report, it stated that data breaches are more likely to occur prior to or during third-party API integrations. That left 85% of the companies vulnerable to a security breach. That means API’s are indeed a blind spot for DevOps. That’s why the focus needs to be on aligning DevSecOps and empowering them with automation to manage the three 9s – 99.9% availability of services during integration.

Even with the establishment of tighter relationships between information security and app dev teams, only 9% of respondents believed that they achieved above three 9s (i.e., 99.9%) availability application services.

Three 9s is a very low availability bar, representing more than 500 minutes of downtime annually — almost nine hours of outages.

Addressing Cyber Security Healthcare and Data Integrity

The report shows that application attacks are a constant threat. The breadth of attacks respondents experienced daily included access violations, session/cookie poisoning, SQL injections, denial of service, protocol attacks, cross-site scripting, cross-site request forgery, and API manipulations.

In addition to survey data, the report also includes trends from Radware’s Bot Manager customers’ traffic flow, which identified that 45% of internet traffic comes from bots. The breakdown of bot traffic indicates that 17% of traffic is sourced from ‘good’ bots, and 28% is malicious.

The ability to adapt quickly to changing market conditions with new and updated web applications is critical to success.