DevOps - Current issues and security related-benefits
- Date: September 03, 2018
We take a look at highlights from two recent reports which consider issues around the current adoption of DevOps and how getting it right can enhance your organisation's security posture.
Firstly, and perhaps surprisingly, automation is not as pervasive as you might think. This is one of the key points to emerge from the recent 'State of DevOps: Market Segmentation Report' released by Puppet.
Addressing almost 3,200 technical professionals, the survey found that whilst DevOps has increased significantly in popularity, the majority of respondents still reported high levels of manual work across activities such as configuration management, deployment, testing and change approval processes.
The results also show that when it comes to getting started on the DevOps journey, many choose to start by addressing their most acute pain points. These typically include deployment automation, version control, continuous integration and infrastructure automation.
Amongst the least common starting points were lean practices, such as working in small batches to allow single piece flow, visualisation of key quality and productivity metrics, and setting limits on work in progress.
Do you work in a large company? If so you might be interested to learn that the larger the company size, the higher the proportion of low IT performers! The survey actually found that as the company size grows, the proportion of low IT performers also increases. And this can have a very significant effect, since high performers have 46 times more frequent code deployments, significantly lower change failure rate, and 440 times faster lead time from commit to deploy.
Elsewhere, the report also confirms that Windows continues to dominate the installed OS base, with 100% of the respondents having Windows servers of some kind, whilst Linux was a distant second at 63%. The findings also confirm just how far DevOps has travelled over the past few years. Expectations have certainly risen and what might have been considered a 'great' IT effort just a few years ago is now viewed as pretty average by many.
Taking this point further, it seems that getting departments and teams to work better across an organisation is no longer just a 'nice to have' but is now a given, with DevOps simultaneously raising the bar and expectations of what's possible. Meanwhile the second report, Sonatype's 5th annual DevSecOps Community Survey found that respondents with mature DevOps practices were 338% more likely to integrate automated security than those organisations with no DevOps practice.
The report also highlighted the potential security threats posed by open source software. Over one-third of businesses had suspected or found security breaches in their software products that contain open source components over the past 12 months. It's reassuring, therefore, that 77% of mature DevOps organisations had open source policies in place, with a 76% adherence rate. This compares favourably with the finding that only 58% of respondents without mature DevOps practices had a policy, with a 54% adherence rate.
Other key points to emerge from the report include:
- 59% of mature DevOps companies are building more security automation into their development process in response to GDPR compliance
- 63% of respondents with mature DevOps practices say they leverage security products to identify vulnerabilities in containers, as these components become more ubiquitous in modern IT landscapes
One of the more concerning aspects is the revelation that 35% of developers from companies with no DevOps practices had received no training on application security in the past year.
Overall, the findings from both surveys demonstrate that more and more organisations are waking up to the DevOps approach, and getting it right can certainly deliver significant benefits, particularly in comparison to those yet to adopt DevOps.
