Security in software development

At a time when companies are striving to shorten development cycles, link work processes and meet increased customer demands, the importance of DevOps is growing. As more and more companies work with DevOps, the security aspect is also becoming more important at the same time. DevSecOps has long since evolved as an integral part of software development. Why has DevSecOps established itself as a standard so quickly? The increasingly strict data protection laws definitely have something to do with it. But data security is also very important for many other reasons. An IT environment does, after all, have security vulnerabilities, and scandals caused by hacker attacks or malware don't look good in any company's portfolio. Julian Totzek-Hallhuber explains on Security-insider.de why DevSecOps has become the standard so quickly. Below we summarize his article for you.

According to a survey by Coleman Parkes, 88 percent of companies in Germany swear by their DevOps culture, which has become a crucial factor for success. DevOps allows them to combine dynamic processes in development with reliable IT. This makes development faster, more agile, and it meets the requirements of a digital business environment because experts from different fields come together to find the best solutions. Nevertheless, it is striking how many companies only worry about security gaps when a problem arises or an audit is imminent.

Those who shorten release cycles become more profitable, but usually run a security risk. This is due to the fact that development teams are under high time pressure and therefore neglect the security aspect. Veracode published in a "State of Software Security" report that over 85 percent of all programs have at least one weakness and even 13 percent have a critical vulnerability. The vulnerability in the program is only part of the challenge. Finding them is the real sticking point. Often it is simply because the developers do not (cannot) take enough time to specifically look for weak points. Only those weaknesses that are found can be fixed. The aspect of "time" plays a role here, because the sooner the application can be brought to market, the better. It costs time and money to search for weaknesses and eliminate them. Here it is necessary to weigh up: Do I invest more time in another testing phase to discover and fix any weaknesses or do I take the risk that they will be found only after the release, in the worst case by a hacker? Data leaks or program failures can, of course, also lead to criminal problems or result in fines. And then there is the potential damage to reputation. All of this must be taken into account. The "State of Software Security" report states that in 70 percent of all cases, vulnerabilities persist for one month after release, and in more than half of all cases for more than three months. At the same time, the cost of fixing a bug after release increases tenfold compared to pre-release testing. So the calculation should be quite simple, shouldn't it?

This is exactly where DevSecOps comes into play. Security is integrated into the development process from the very beginning and is not a detached topic. DevSecOps prevents the issue of security from being forgotten. But one benefit is that it also saves the development team from retroactive troubleshooting. Annoying additional rounds that have to be made because of a security issue are eliminated. Scanning for security vulnerabilities is done in parallel during the development phase. Each team has a person responsible for IT security who works closely with the developers. So far, there are not too many companies in Germany that have already fully internalized DevSecOps. But according to the "State of Software Security" report, these companies are very successful with the approach. Instead of the average six vulnerability scans per year, companies that work with DevSecOps perform an average of 300 scans. As a result, weaknesses are remediated more than ten times faster. Even with just 50 scans a year, the number of vulnerabilities can be cut in half.

The advantages are therefore obvious and are also known to most companies, at least in theory. Implementing DevSecOps methods requires a high degree of willingness to cooperate between experts from different areas who are not used to it. The technological component is comparatively simple. It mostly depends on the attitude of the various parties involved whether the implementation of DevSecOps will be a success. On this issue, it has been shown that appropriate training can reduce the hurdles and increase the chances of success. The corporate culture plays a decisive role, as does the attitude of the management level, which must be fully behind the agile concept.