Lisa Conference 2014: DevOps and AppSec - Who is Responsible
- 1. Developers and Application Security: Who is Responsible? SURVEY RESULTS, November 2014 Mark Miller, Senior Storyteller
- 2. Mark Miller
- 4. 41% Q5 - In what industry does your business operate? 20% 17% 10% 6% Technology / ISV Consulting / SI Financial Services & Insurance Media / Entertain Public Sector Telecommunications Consumer Goods / Retail Other 14% 10% 6%
- 5. Operations 25% Security 16% Other 3% DevOps 30% Development 26% Q1 – What is your role within your current organization?
- 6. Senior Management 8% Executive Management 6% Practitioner 46% Manager 40% Q3 – What is your responsibility level?
- 7. 13% Q9 - Percentage of open source software? 40% 14% 15% 15% 0% open source 20% open source 40% open source 60% open source 80% open source 100% open source 5% 67% >5000 employees 50% in FSI 41% in Consulting 31% in Government 27% in Tech 44% for Java developers {What people estimate they are doing
- 8. 13% Q9 - Percentage of open source software? 14% 15% 15% 0% open source 20% open source 40% open source 60% open source 80% open source 100% open source 5% 67% >5000 employees 50% in FSI 41% in Consulting 31% in Govt 27% in Tech 44% for Java developers {What people estimate they are doing What app scans reveal 40%
- 9. 57% Q10 - For custom development, what languages are used? 31% 30% 25% 21% Java PHP .NET Ruby C/C++ 83% with > 5000 employees FSI: 82.5% Banking/Finance: 88% Government: 74%{
- 10. Q11 - Who is the primary driver behind AppSec initiatives? 40% say dev (Q14) 76% say dev spends less than 15% time on AppSec (Q15) 42% say dev knows its important but does not have time to spend on it {40%
- 11. Q11 - Who primarily drives AppSec initiatives? (filtered for developers only) 67% devs think they are the primary driver; (Q15) 26% say security is not their focus, 40% say they have no time to spend on it; (Q17) 74% state we have no policies or policies are not effectively enforced Observations: 84% w/ >5000 employees think it’s compliance / risk management {67%
- 12. Q12 – Your role in AppSec? (1=not at all, 10 = highest priority) w/ >5000 employees, 75% rank security 8+ priority (Q17 – 58% of >5000 employees feel there is no clear security policy or that policy is not effectively enforced; 18% we don’t have clear policies 81% state Adherence to internal security policies is a top concern Conclusion: strong personal sense of responsibility, but little to not policies to enforce security standards; people make up their own standards w/ 101 – 1000 employees, 76% rank security 8+ priority Q17 – 67% employees feel there is no clear security policy or that policy is not effectively enforced. Q13 - 74% state adherence to internal security policies is a top concern Conclusion: “App Sec is important to me but we lack corporate policies so I’ll determine my own.”
- 13. Q13 - Are any of these security concerns? 65.03% {#2 overall issue but only 31% test it #1 issue for government
- 14. Q14 - How much time to developers spend on security?
- 15. Q15 - Interest of in-house developers in regard to AppSec 41% in FSI know its important but don’t spend time 42% in tech {
- 16. Q16 - When does App Dev spend time with security group? Observations: 23% say security checks happen, but (Q17) Only 12% have automated End of development cycle - 62% in government (#1 answer), 47% in financial services Historically, ‘end of development cycle’ is the most expensive option
- 17. Q17 - Describe your current app security policies (Overall) Observations: 67.05% do not have clear, well defined, enforced policies 12.5% have well defined, automated policies
- 18. Q17 - Describe your current app security policies (filtered for government) 59% policies not enforced compared to: 40% in FSI 28% in Tech{ 24% don’t have policies in place compared to: 20% in FSI 30% in Tech{Automated late in Development18% Automated across SW lifecycle12%
- 19. Q17 - Describe your current app security policies (Developers only) 42% Do not have clear policies Observations: “I am responsible, but I have: • No tools • No policy • No time 9% Automation across lifecycle 7% Automation late in development cycle
- 20. Q20 - If doing CI, how often is code compiled? Observations: If there is continuous integration, the percentage of automated testing increases 40% automate security testing here.
- 21. Q23 - Where is security testing automated? Lower Cost Highest Cost High Cost Lower Cost
- 22. Q18 - What are you testing? Observations: 80%+ of app composition is open source 30% of companies test open source • 37% tech • 20% in FSI • 29% in government
- 23. Summary
- 24. Get the deck right now, within seconds Community@Sonatype.com
- 25. Survey Sponsors
- 26. Developers and Application Security: Who is Responsible? SURVEY RESULTS, November 2014 Mark Miller, Senior Storyteller