DevSecOps Insights 2020
We are thrilled to announce and share with you the Snyk 2020 DevSecOps Insights! In this study, we discuss the state of DevSecOps, key activities, focus areas, and takeaways.
This study is based on data presented in the Snyk 2019 State of Open Source Security report and the Puppet 2019 State of DevOps report.
The Snyk report presents the survey results of over five hundred respondents and the Puppet report presents data from 2,949 technical professionals.
If you’re interested in reading the detailed findings of our study, we recommend you download the full version of the report in digital format. Find some more of the key takeaways in the articles below:
- DevSecOps Insights 2020
- 86% of security and tech roles agree that security is a shared responsibility
- 31% don’t track application dependencies and 38% only track direct dependencies
- 29% of highest security integration orgs endure friction when collaborating
- 48% see security a major constraint on the ability to deliver software quickly
An introduction to DevSecOps Insights 2020 study
Fast software development iterations call for baked-in security in order to keep up with the rate of building and shipping software. In a typical organization, security staff is vastly out-numbered compared to operations and developers. This significantly complicates the job of keeping up with security tests, reviews, etc, in order to mitigate the increasing application security risk.
Is security slowing down operations and developers? This is one of the major concerns and challenges for integrating security in development teams. Security teams remain accountable for the security of applications and related data, yet cannot introduce disruption to the development teams’ workflows. To overcome these challenges, development and security teams need to adopt new ways of working together, develop new processes and adopt new tooling. DevOps teams do not prioritize for security in a build pipeline or security monitoring, as there are other concerns they are tasked with. So, even for empowered DevOps teams, security is still mainly an afterthought.
Join us on the live webinar event on January 30th 11AM Eastern Time:
To address security concerns while keeping up with the rapid pace of software delivery, we need to adopt processes, culture, and proper tools through automation which sustains fast development iterations. These enable development teams to integrate security tooling within their build pipelines to detect vulnerabilities early on, and fosters healthy collaboration across security and DevOps teams.
In this report we aim to explore the state of DevSecOps adoption and the challenges organizations and teams face. What we aim to gain from this research is better insight into practices and tools that accelerates DevSecOps adoption.
DevSecOps Key takeaways
Following are takeaways and challenges faced in the DevSecOps journey:
CULTURE Security is perceived as an activity that slows down the business and overall software delivery. 33% of respondents, within the highest level of security integration, still feel that security is a major constraint on the ability to deliver software quickly. | TOOLING 79% of organizations are positioned at a medium level of DevOps evolution and face challenges in scaling the tooling, culture, and practice to properly support the business. |
CULTURE Key security activities, such as threat modelling and security tools integrated in the development pipeline, contribute to a sense of shared responsibility across different functions of the business. Seeing security as a shared responsibility improved by 31% between Level 1 — the lowest level of security integration within an organization — and Level 5, the highest. | TOOLING 22 percent of firms at the highest level of security integration are also at an advanced stage of DevOps evolution. |
CULTURE Even though there is a high correlation between the maturity of security integration and the sense of shared responsibility, 29% of all organizations, positioned at the highest level of security integration, still feel that security teams and delivery teams encounter a lot of friction when collaborating. | TOOLING 65% of respondents confirm that they employ automated security testing tools to audit their code, while a security code review is an activity that 79% of respondents follow. |
CULTURE 81% of users feel developers are responsible for open source security and 68% of users feel that developers should own the security responsibility of their container images. | TOOLING 37% of users don’t implement any sort of security testing during CI. |
TOOLING 57% of respondents test for known security vulnerabilities in their open source dependencies, and 36% of respondents perform static application security testing for their own code. | |
TOOLING 31% of respondents aren’t tracking any application dependencies in use within their organization, and 37% are only tracking direct dependencies. |
Continue reading our DevSecOps Insights 2020 study:
- DevSecOps Insights 2020
86% of security and tech roles agree that security is a shared responsibility
31% don’t track application dependencies and 38% only track direct dependencies
29% of highest security integration orgs endure friction when collaborating
48% see security a major constraint on the ability to deliver software quickly
