May 12, 2021 By David Bisson 2 min read


We talk a lot about building a culture in which every employee and department puts digital safety first. Everyone pitching in a little bit means the job gets done more thoroughly. Bringing developers, IT operations and security together in a DevSecOps format helps do that. It includes both processes and culture shifts, all of which add a stitch to a blanket over all three teams. Take a look at the challenges to creating a DevSecOps model and how to solve them.

Who Is in Charge?

Organizations that are still struggling with their efforts to transform from DevOps to DevSecOps won’t be doing so forever. Still, there’s work to be done.

One of the main issues that still stands in their way is a lack of clarity regarding who shoulders the burden of security in a DevSecOps model. For example, over a quarter of devs said in a 2020 survey that they felt security was firmly in their hands with the way their employers’ DevSecOps processes were set up. That’s slightly more than the proportion of testers and ops workers who felt the same way at 23% and 21%.

The situation is different for sec teams, however. Close to one-third (29%) of security workers said that no one team should own defense and that everyone should have a hand in it. Plenty of others said they weren’t happy with the timing of developers’ work to find and fix openings that could lead to risk. More than two-fifths (42%) of security experts said that testing still happens too late in the software development life cycle. A further 31% calling the timing of fixes an “uphill battle.”

The Importance of DevSecOps Training

Shortcomings, such as these, highlight the need to focus on helping to make security everyone’s wheelhouse. Employers can do this by taking another look at how developers learn about it. In the process, they need to realize that their devs require different training than their ops workers. Those teams should receive still different types of lessons than other departments. One security awareness training offering does not fit every department, after all.

This point is even more relevant when different employees are working together while still performing separate tasks. Why standardize the training for devs if the types of issues they’re facing are different? You can benefit (and thereby save time and money) by targeting this training based upon what your people need to do on a daily basis.

DevSecOps or good DevOps security in general starts with cohesion and accountability. Knowing that, you might begin by first focusing training on a select number of developers. Then, enlist those people as security mentors to guide and reinforce the training that all others receive, thereby laying the groundwork for a dev sub-culture of security.

Once security is expected, not a goal, the enterprise can begin taking steps to formalize this culture. For instance, they can begin including the need for security training and skills among their devs in their job descriptions or postings. In addition, they could begin using key performance indicators to create reward structures around secure behaviors. This will encourage devs to remember their training on an ongoing basis.

Getting Realistic With DevSecOps

DevSecOps is not a milestone, but an ongoing cultural process. It’s ever-changing. Adding security in development is key. But you can’t tell developers about what they need to do to secure their software once or twice and expect new behaviors to stick. It’s just not realistic. To solve this, reinforce those behaviors with ongoing training and other formal outgrowths of a positive DevSecOps culture.

More from Application Security

Critically close to zero(day): Exploiting Microsoft Kernel streaming service

10 min read - Last month Microsoft patched a vulnerability in the Microsoft Kernel Streaming Server, a Windows kernel component used in the virtualization and sharing of camera devices. The vulnerability, CVE-2023-36802, allows a local attacker to escalate privileges to SYSTEM. This blog post details my process of exploring a new attack surface in the Windows kernel, finding a 0-day vulnerability, exploring an interesting bug class, and building a stable exploit. This post doesn’t require any specialized Windows kernel knowledge to follow along, though…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Vulnerability management, its impact and threat modeling methodologies

7 min read - Vulnerability management is a security practice designed to avoid events that could potentially harm an organization. It is a regular ongoing process that identifies, assesses, and manages vulnerabilities across all the components of an IT ecosystem. Cybersecurity is one of the major priorities many organizations struggle to stay on top of. There is a huge increase in the number of cyberattacks carried out by cybercriminals to steal valuable information from businesses. Hence to encounter these attacks, organizations are now focusing…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today