Developers are spending significantly more time, and companies are spending 28K per developer each year on security-related tasks, such as manual application scan reviews, context switching, and secrets detection, among other things.
This was revealed by JFrog, the Liquid Software company and developers of the JFrog Software Supply Chain Platform. The company released the results of an IDC survey called: “The Hidden Cost of DevSecOps: A Developer’s Time Assessment,” sponsored by JFrog.
It showed that 50% of senior developers, team leaders, product owners and development managers experienced a significant increase in the number of hours spent weekly on software security-related tasks, detracting from their ability to innovate, build, and deliver new business applications.
Asaf Karas, CTO of JFrogSecurity, said securing the software supply chain is already a major challenge for organizations and one that becomes even more complex when multiple tools are used. This forces developers to toggle between multiple environments, resulting in inefficiencies, wasted time, and increased risk.
“IDC’s survey creates a compelling case for companies to invest in streamlined security processes, tooling, and training to empower their developers to be more efficient and effective in protecting the software supply chain.”
Half of the survey respondents said they spend an estimated 19% of their weekly hours on security-related tasks, oftentimes outside normal working hours, which could lead to a reactive approach to security rather than a proactive one.
Other key findings from the IDC survey include:
- Chasing Ghosts: Eliminating False Positives: Developers spend 3.5 hours on average manually reviewing security scanning findings because of false positives and duplicates.
- Context Matters: 69% of developers agree or strongly agree that their security-related responsibilities require them to frequently switch contexts between various tools, slowing efficiency. Multitool context switching can also increase token usage for bypassing reauthentication per platform. Tokens can be helpful in application development but can also be quickly forgotten and leave backdoors in companies’ systems for attacks.
- Secrets are No Fun: Developers devote 50% of their time to understanding and interpreting secrets scanning results, making changes to code to remediate findings, and updating secrets management measures.
- Infrastructure Investigation: Infrastructure-as-Code (IaC) – used to automate the provisioning and management of IT infrastructure, such as servers, networking, operating systems, and storage – must be scanned every time code changes, with more than 54% of developers saying they run IaC scans weekly or monthly.
- SAST Isn’t a Blast: Despite static application security testing (SAST) tools being integrated into local development environments to provide findings as developers code, only 23% of developers are running SAST scans before deploying code into production, leaving a huge gap for malicious code to slip through.
Katie Norton, Research Manager, DevSecOps and Software Supply Chain Security at IDC, said that DevSecOps isn’t only a business imperative; it’s the foundation of building the secure applications of the future.
“However, a significant challenge lies in overcoming inefficient, poorly implemented tools that squander developers’ time and inflate costs,” she said. “To be successful, IT and software development team leaders must automate repetitive and time-consuming tasks, ensure DevSecOps tools deliver accuracy with minimal false positives, and provide ongoing access for developers to application security education and resources so they can keep pace with a rapidly increasing threat landscape.”
The IDC InfoBrief surveyed senior developers, team leaders, product owners, and development managers from companies in 20+ industries with 1K+ employees across the U.S., UK, France, and Germany. For more insights from the IDC InfoBrief, download the full report.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.