Securing applications in the era of DevOps

Unfortunately, however, while speed to innovation has been skyrocketing, application security hasn’t kept pace within many organizations, In the latest research from Cisco AppDynamics, ‘The shift to a security approach for the full application stack’, 92% of technologists admitted that the rush to rapidly innovate has come at the expense of robust application security during software development.

The potential consequences of security vulnerabilities are well understood; from slow run times and outages which damage digital experience and erode customer trust, through to derailed digital transformation initiatives and, ultimately, customer or proprietary data loss, negative impact of revenue and damaged reputation.

DevOps teams therefore need to act quickly to ensure that security is integrated into their processes from the very outset of the application lifecycle. That means shifting towards a DevSecOps culture, with much greater collaboration with security colleagues. And it means embracing new tools and technologies, such as automation, continuous security monitoring and security as code.

Application security vulnerabilities exposed by siloed approach

Arguably the biggest challenge to application security today is siloed structures and working practices in the IT department, where DevOps teams often operate entirely separately from security teams. In many cases, the only time any form of collaboration happens is when a potential issue is identified – essentially, when it is already too late. Developers deliberately avoid getting input from security teams because they believe it will act as a brake on release velocity – in fact, the research found that most technologists perceive security to be more of an inhibitor than an enabler of innovation.

Until now, organizations have mostly been able to get away with this fragmented approach. But as organizations are now building more dynamic applications using low-code and no-code platforms, IT teams are faced with a huge expansion in attack surfaces. Widespread adoption of multi-cloud environments means that application components are increasingly running on a mix of platforms and on-premises databases, and this is exposing visibility gaps and increasing the risk of a security event.

Weaknesses in current approaches to application security are being brutally exposed by modern application stacks and technologists need to act now to avoid a catastrophic security event on their watch.

DevSecOps can minimize risk, accelerate innovation and boost career progression

For many years, security teams (SecOps) have operated separately from the rest of the IT department. Security has often been viewed as a reactive function, only there to resolve security breaches and patch up vulnerabilities.

But with modern application stacks set to dominate future innovation programs, IT departments need to switch to a DevSecOps approach, where security is integrated into the application lifecycle from day one of the development process, rather than being an afterthought at the end of the development pipeline.

DevSecOps brings together ITOps and SecOps teams so that application security and compliance testing are incorporated into every stage of the application lifecycle, from planning through to shipping. By taking this approach, developers can embed robust security into every line of code, resulting in more secure applications and easier security management, before, during and after release.

IT departments can avoid the current situation where security vulnerabilities are only addressed right before launch or identified after the application has already been released. By incorporating security testing from the outset, security teams can analyze and assess security risks and priorities during planning phases to lay the foundation for smooth development.

The shift to DevSecOps requires cultural change, with closer collaboration between teams and new ways of working. As such, technologists need to revise their attitudes to security and recognize that, with the right approach and the right tools and technologies, security can lead to faster and more sustainable innovation, rather than slowing it down.

Encouragingly, rather than being resistant to this change, most DevOps engineers acknowledge that a DevSecOps approach is now essential for organizations to effectively protect against a multi-staged security attack on the full application stack. And on an individual level, they recognize that the move to DevSecOps provides them with a chance to expand their knowledge and skill sets and to become more rounded IT professionals – something which will help them in their careers moving forward.

Automation and AI to manage spiraling complexity and data noise

As well as new working practices, DevSecOps also requires the implementation of holistic monitoring systems which leverage Artificial Intelligence (AI) and Machine Learning technologies to cope with the soaring volumes of security threats organizations are facing across an expanded attack surface.

This type of automation is essential to identify threats, weaknesses, exploited vulnerabilities and self protect through an automated response. . Once technologists can teach AI tools to identify threats and resolve them independent of an admin, the benefits are game-changing – reduced human error, increased efficiency, and greater agility in development. In fact, as many as 76% of technologists believe that AI will play an increasingly important role in addressing the challenges around speed, scale and skills that their organization faces in application security.

IT leaders need a security approach for the full application stack that delivers total protection for their applications, from development through to production, across code, containers and Kubernetes. In addition, technologists need to be able to integrate performance and security monitoring with business transaction insights to understand how vulnerabilities and incidents could impact end users and the business. This allows IT teams to cut through data noise and prioritize those threats that could really damage a business-critical area of the environment or application.

Encouragingly, there is now a widespread realization that DevSecOps is the only way for IT departments to cope with increasing cybersecurity risk, without sacrificing innovation speeds. Indeed, 76% of technologists now regard a DevSecOps approach as critical for organizations to effectively protect against a multi-staged security attack on the full application stack.

Application security can no longer be an afterthought within DevOps practices – IT teams need to recognize it as a critical element of the application lifecycle, and the foundation for sustainable and accelerated innovation.