Evaluate Your DevSecOps
Take this quiz to assess how well your organization is positioned in DevSecOps practices and gain insights into your current strengths and areas for improvement on integrating security in your development and operational processes.
*Note: None of your answers will be recorded or stored throughout this quiz. This quiz is soley used for your self evaluation and education.
Does your organization have a formally recognized DevSecOps team, initiative and/or program in place today?
Yes
We are in the process
No
Optiv DevSecOps Quiz
1
2
3
4
5
6
7
8
9
10
Question 1 of 10
Select One
Incorporating a DevSecOps program into your organization weaves security into the development process as early as possible, and is one of the best ways to ensure your projects don’t hit unexpected roadblocks. DevSecOps done right enables businesses to save time, money and resources down the road.
Great
Rating:
91%
of 1000 respondents said that they have applied some type of DevSecOps activities into their software development pipelines.
Source: Synopsys State of DevSecOps 2023 report
Good
Source: Synopsys State of DevSecOps 2023 Report
Not every organization can incorporate a formalized DevSecOps program, but a security champion is an easy way to start. A security champion is an individual with a security background responsible for monitoring for best practices and help the formal security team support projects. It’s a perfect starting point for your DevSecOps journey.
Fair
We have a shared security ownership model
(e.g. Security Champions Programs)
We are in the process of engraining security across the organization
We provide security guidance after major incidents and send occasional phishing email tests.
Only our IT and/or InfoSec teams worry about security
We meet compliance with an annual training module.
Does a model of shared security ownership resonate with your organization or is security only a concern for IT or InfoSec teams?
Question 2 of 10
Security is clearly a priority for your business and your management team will thank you later. One of the key drivers of urgency for businesses incorporating security into their DevOps process is the increased amount of attacks targeting Continuous Integration/Continuous Delivery (CI/CD) environments.
The percentage breakdown of 1000 IT professionals when asked how to “best describe the maturity of your current software security program/initiative?” were as follows:
24.5% Level IV - Security processes and controls are logged, managed and monitored.
8.5% Level V - Security processes are continuously analyzed and improved.
24.1% Level II - Security processes are documented and repeatable for specific team.
34.3% Level III - A proactive security culture is endorsed and communicated by leadership.
8.5% Level I - Security processes are unstructured/ disorganized.
Do your development teams sacrifice time dealing with security issues related to code churn that would be better allocated towards alternative initiatives?
Question 3 of 10
Do your development teams sacrifice time dealing with security issues related to code churn which would be better allocated towards alternative initiatives?
Companies who use their dev teams in the most efficient way possible tend to build the best products for their end users. A successful SDLC program influenced by a DevSecOps framework can free up internal bandwidth to focus on a variety of alternative business critical initiatives.
of IT professionals said that critical vulnerability/security issues in deployed software impacted their delivery schedules in some form during 2022-23.
80%
It’s the nature of our business and is required
Do you have multiple development teams using different development and security tools across your organization? (e.g. lack of standardization)
Question 4 of 10
Do you have multiple development teams using multiple development and security tools across your organization? (e.g. lack of standardization)
(e.g.Security Championships Programs)
It's the nature of our business and is required
We have a feeling you might have a security champion or two on your team. Well done by limiting the cross-team usage of tooling at your business. Limiting access to certain development tooling can reduce the risk of compromise. program influenced by a DevSecOps framework can free up internal bandwidth to focus on a variety of alternative business critical initiatives.
When asked “On average, how often do you assess or test the security of your business-critical applications?”
Source: SANS DevSecOps Survey
at least weekly*
at least daily*
56%
31%
*out of 363 security practitioners surveyed
Our DevSecOps experts have found this to sometimes be a necessary evil when resources are limited and timelines are tight. With that said, limiting access to certain development tooling to only the individuals who need access to these tools can reduce the risk of compromise.
Not everything works the same way for every organization! We recommend only granting access to certain tools to the individuals who absolutely need to access these technologies to reduce the risk of compromise.
Security policies are applied throughout the development process
More often than not
My development team treats security policies and requirements as an afterthought
When it comes to your SDLC, do you push for the proper security policies throughout your development process?
Question 5 of 10
The benefits for “shifting security left” are numerous and the pros far outweigh the cons. Shifting security left creates greater alignment between the security, IT and development teams by incorporating security checks into the dev process as early as possible. The end result – a much more secure product initially brought to market.
Shift-Left
(v.) In the world of software application development, “shift-left” is a concept that promotes the value of integrating security into the SDLC as early as possible. In other words, security testing should be moved “left” in the development timeline, thereby identifying and fixing defects early on when they are easier and more cost effective to address.
Source: Optiv.com Cyber Dictionary
Have you found security vulnerabilities in your production code?
Question 6 of 10
Between first-party and third-party code, it’s never been more vital to scan and continuously asses the production code your organization is using. Ensuring your code is as secure as possible facilitates the best possible security for the SDLC.
Testing both first and third-party code throughout the SDLC is critical.
Source: Veracode State of Software Security 2024
Contains flaws in first-party code
Contains flaws in third-party code
~63%
~70%
We are integrating next-gen capabilities across our organization.
Sporadic, but not frequent
We are open to it, but unsure how to effectively fully embrace these capabilities.
Due to internal expertise/bandwidth, we don’t plan on embracing these tech capabilities soon.
Does your business suffer from frequent web application attacks?
Question 7 of 10
Application vulnerabilities are the leading attack vector for a reason. Threat actors target the “CIA triad” which consists of confidentiality, integrity and/or availability of vulnerabilities within an organization’s applications.
According to the Data Breach Incident Report from Verizon, web applications were the top attack vector in 2023, used in
incidents
breaches
60%
Source: Data Breach Incident Report
How confident are you that your business could withstand a cloud-focused attack today if a threat actor wanted to compromise your single or multicloud environment?
10% - 50%
We have the tools and talent we need to effectively run our SecOps program.
51% - 80%
We often deal with these challenges.
81% - 99%
We are not equipped with the tools and talent we need to effectively face these challenges.
Question 8 of 10
How confident are you that your business could withstand a cloud-focused breach today if a threat actor wanted to compromise your single or multicloud environment?
Well done! You are clearly confident in your cloud security process and policies. Embracing Cloud Security Posture Management (CSPM) tooling such as a Cloud Native Application Protection Platform (CNAPP) can help you gain crucial visibility into your cloud environment and secure your applications better than ever before.
94%
of 650+ cybersecurity professionals indicated they are moderately or extremely concerned about their cloud security.
Source: CheckPoint’s 2022 Cloud Security Report
You’re doing better than most cloud adopters out there! Embracing Cloud Security Posture Management (CSPM) tooling such as a Cloud Native Application Protection Platform (CNAPP) can help you gain crucial visibility into your cloud environment and secure your applications better than ever before.
You are not alone! Embracing cloud security can be challenging. Embracing Cloud Security Posture Management (CSPM) tooling such as a Cloud Native Application Protection Platform (CNAPP) can help you gain crucial visibility into your cloud environment and secure your applications better than ever before.
When was the last time your business assessed its SDLC process to evaluate for effectiveness and efficiency?
<3 Months
4 – 12 months
Over 1 year
Question 9 of 10
You take your SDLC seriously and we applaud you. An SDLC program must be evaluated and evolve with an organization as it grows and changes throughout time. It is crucial to adjust processes, policies and cyber hygiene as your business needs shift.
Don’t know where to start? Check out Optiv’s Secure SDLC Hardening program for a comprehensive assessment on how you can shift security left in your organization.
of phishing attacks exploited public-facing applications.
26%
Source: IBM Security X-Force Threat Intelligence Index, 2023
Good work! An SDLC program must be evaluated and evolve with an organization as it grows and changes throughout time. It is crucial to adjust processes, policies and cyber hygiene as your business needs shift.
Let’s fix that! An SDLC program must be evaluated and evolve with an organization as it grows and changes throughout time. It is crucial to adjust processes, policies and cyber hygiene as your business needs shift.
Does your business have a roadmap in place for your secure SDLC program development?
Question 10 of 10
Does your business have a roadmap in place for your Secure SDLC program development?
You’re a security champion for your organization and are heading down a path to resilience. Be sure to evaluate your SDLC program at least once every 6 months to ensure your business is still on the right path.
application-layer attacks have spiked by as much as 80% in 2023.
Source: CloudFlare’s DDoS Threat Report for 2023 Q2, July 18, 2023
We recommend assessing your SDLC at least once every 6 months to ensure your business priorities are aligned with your security goals. Optiv's application security experts are ready and willing to help you design a strategy to help you uplevel your AppSec program. Reach out today.
Increasing your security maturity takes time and we all start from somewhere. We understand the challenges, and help organizations like yours evolve their security programs to ensure they are managing risk to secure business outcomes.
Analyze your current operations to determine your organization’s current state, strengths, weaknesses and gaps, while looking through the lenses of people, processes and technologies. Prioritize security awareness training for all development stakeholders to educate them on basic security principles and threats. Partner with a solutions provider to identify what’s performing well and where the gaps in your defenses remain. Then, collaborate on a more robust solution that defends your entire cloud ecosystem – including on-premise, native and hybrid cloud environments.
Low
Maturity Level:
Your recommendations:
You’re off to a great start! You are on the right track for building a proactive and mature DevSecOps program within your organization. Use the following recommendations to help you fill in the gaps to enhance your security maturity.
Strengthen collaboration between development, security and operations teams to ensure security is integrated seamlessly into the SDLC. Improve your incident response capabilities by enhancing monitoring and establishing clear incident response procedures. Stay future-ready by partnering with an end-to-end security solutions provider that allows you to continuously extend the capabilities of your people, processes and technologies.
Moderate
We tip our hats to you! It looks like your DevSecOps program is well positioned and already showing positive indicators of success. Remember, a good DevSecOps program must be adjusted and routinely reassessed to remain effective in order to protect against threats and further your business goals.
Continue fostering a culture of improvement by regularly reviewing and updating security practices and tools. Automate security testing throughout your development pipeline to catch any vulnerabilities early and consistently. Invest in ongoing training for your teams to keep them updated on the latest security trends and best practices.
High
CNAPP Secure SDLC Hardening
Recommended Services
Your Score: High
Optiv works closely with many cloud security vendors to enable organizations to innovate faster, remove silos and transform their processes to ensure a seamless transition for organizations to securely move their business to the cloud.
Application Security Technology Services Secure SDLC Hardening
Your Score: Moderate
Your Score: Low
Application Security Advisory Services Secure Cloud Strategy Secure SDLC Hardening
