Cloud Security: 5 Key Takeaways from the SANS DevSecOps Survey

A recent SANS Institute report finds that DevSecOps teams are improving their tooling, processes and techniques, but their organizations’ increasingly hybrid and multi-cloud IT environments are getting harder to secure. Check out key highlights from the “SANS 2022 DevSecOps Survey.”

Organizations continue to mature DevSecOps – the alignment of development, operations and security teams, tools and processes – but improving their security posture isn’t getting easier due to newer, more complex challenges.

That’s a key takeaway from the SANS Institute’s “SANS 2022 DevSecOps Survey,” based on a survey of 431 security leaders and practitioners worldwide.

In this blog, we highlight five insights from the report, which offers a deep dive on DevSecOps trends as well as concrete recommendations to keep DevSecOps efforts on the right track. We also provide insights on how Tenable can help.

At the root of many of the DevSecOps challenges highlighted in the SANS report is the increasingly hybrid, multi-cloud nature of organizations’ IT environments, where applications are “more than ever” being hosted on-premises and in multiple cloud platforms using virtual machines, containers and serverless functions.

“Such environments present security challenges because of the inherent differences among the various cloud service providers and the very different demands of on-premises hosting,” reads the 20-page report, which was sponsored by Tenable.

Five insights to bolster your DevSecOps strategy

1. When asked to list the top factors contributing to their DevSecOps success, respondents ranked the following:
   • Management buy-in
   • Improved communications among dev, sec and ops
   • Automated build / test/ deploy workflow
   • Integrated automatic security testing
   • Developer buy-in
2. DevSecOps teams are underutilizing cloud security posture management (CSPM) software which can help secure at scale multi-cloud environments with a mix of VMs, containers and serverless. The report suggests organizations consider increasing their usage and adoption of CSPM products.
3. CSPM and policy-as-code are helping organizations further automate the enforcement of their compliance policies at scale, with the share of respondents saying that 100% of their policies are automatically enforced jumping from 5.1% in 2021 to 18.4% this year.

 Source: SANS Institute, “SANS 2022 DevSecOps Survey,” September 2022

4. With DevSecOps teams releasing software to production more quickly and frequently — some daily and others even around the clock — they should make sure that all code is delivered via a CI/CD (continuous integration / continuous deployment) pipeline with built-in security tests.
5. There’s been a general increase in security testing during the build and release cycle, with just one exception: the use of security plug-ins in integrated development environments (IDEs) is down from last year.

 Source: SANS Institute, “SANS 2022 DevSecOps Survey,” September 2022

How can Tenable help put these insights to work for you?

Tenable offers software-as-a-service (SaaS) solutions and expertise, such as Tenable Cloud Security, a unified cloud security posture and vulnerability management solution that can be applied to support many of the SANS findings, no matter where you are in your journey:

1. To improve management buy-in, and foster DevSecOps collaboration Tenable Cloud Security offers executives and DevSecOps practitioners integrated role-based dashboards that offer the targeted insights each needs to make better security decisions for their respective functions. For example, an overarching Cyber Exposure Score allows executives and cloud security architects to assess their organization's overall cloud security posture as compared to industry peers and justify investment decisions.
2. To ease the pain of securing mixed-provider cloud environments, Tenable Cloud Security supports popular best practices like Center for Internet Security (CIS) benchmarks out-of-the-box and applies them consistently across cloud providers, and technologies — from virtual machines to cloud native architectures using infrastructure as code (IaC), containers, and Kubernetes. It also allows for the definition of custom policy-as-code to meet unique requirements.
3. To enforce compliance at scale, Tenable Cloud Security enables compliance testing for critical regulatory frameworks, such as Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR) and others across all runtime environments — dev, test, staging and production — and provides automated compliance reporting, drift detection and alerting when runtime configurations deviate from compliance.
4. To ensure security tests are applied within CICD pipelines, Tenable Cloud Security integrates with popular CICD tools, and applies an extensive knowledge base of 1,500 policies, and 72,000 vulnerabilities from Tenable Research, to identify misconfigurations in IaC and vulnerabilities in images and to provide automatic guardrails to notify or prevent deployment for severe violations.
5. To drive greater automation across build and release workflows, Tenable Cloud Security provides additional testing options for DevSecOps teams, including testing of code by developers on their desktop, integration and testing of source code management repositories and the ability to create automated pull requests that include compliant code that developers can accept with just a click, or security teams can set for auto-remediation.

Learn more

• Visit the Tenable Cloud Security solutions page: https://www.tenable.com/solutions/cloud-security-posture-management
• Read the SANS Institute’s “SANS 2022 DevSecOps Survey”