Source – itproportal.com

Many organisations don’t enforce proper security measures in their DevOps environments, putting both the company and the product at risk. This is according to a new report by Venafi, looking into security practices among DevOps.

Using the same passwords for multiple machines, or not even bothering to secure communications between machines are some of the most common issues, usually among organisations in the middle of adopting DevOps practices.

However, even organisations that say their DevOps practices are ‘mature’, still make these rookie mistakes.

Just over half (53 per cent) of respondents in the middle of adopting DevOps claim security measures are enforced consistently. Among more mature environments, the percentage goes up to 82.

Among mature DevOps organisations, 62 per cent consistently replace development and test certificates with production certificates when code rolls into production. For those that are just adopting DevOps, it’s just over a third (36 per cent).

Almost nine in ten (89 per cent) of respondents from mature environments said their DevOps teams are aware of the security controls necessary to protect their organizations from attacks. Among those just adopting DevOps, the number falls down to just over half (56 per cent).

“It’s clear that most organizations are still struggling with securing the cryptographic keys and digital certificates used to uniquely identify machines,” said Kevin Bocek, chief security strategist for Venafi. “Although DevOps teams indicate that they understand the risks associated with TLS/ SSL keys and certificates, they clearly aren’t translating that awareness into meaningful protection. This inaction can leave organizations, their customers and partners extremely vulnerable to cryptographic threats that are difficult to detect and remediate.”