Many modern web development organizations are implementing a variety of security tools for developers. This shift is certainly fueled by the rising awareness of the importance of security to developers and the increasing number of malicious vulnerabilities in applications and tools.
This recent growth in developer security tools certainly has a serious impact on how well an organization’s security professionals can protect their systems. How does the contemporary developer security landscape affect a security professional’s day-to-day activities and how are you changing your approach in light of the increased number of security tools available?
Security professionals are left to deal with hundreds of tool sets
The first rule of large-scale open source security is that as more tools are released for each software, there is an increased risk that the security team is not able to keep up with the ever-growing security requirements. Tools get harder to find and maintain, and are constantly becoming out of date. Even though we do our best to manage a large inventory of code review tools and deployment, we know that not every application needs to undergo a security scan.
This leaves security professionals who are responsible for an enterprise-scale development environment (often comprised of a large number of code repositories and contributed modules) with a difficult situation. Do they pay the cost of maintaining thousands of code repositories to make sure every version of every dependency contains appropriate security features?
Given the fact that the entire DevOps movement is focused on automation, which means that the security team is no longer required to manually review every release, does that mean that security tools are becoming obsolete? Does this mean that security is not a primary concern in development anymore?