The report also found that adoption of DevOps practices leads to improved security outcomes
- Limited Automation in Cloud Security:
According to Datadog’s State of DevSecOps 2024 report, a surprising number of organizations are still relying on manual operations rather than automation to secure their cloud deployments. At least 38% of organizations using AWS completed sensitive actions manually through the AWS console in a production environment within a 14-day period.
- Variation in Infrastructure as Code Adoption:
The report also found disparities in the adoption of infrastructure as code (IaC) across different cloud providers. IaC is considered crucial for securing cloud production environments, yet adoption rates vary. In AWS, over 71% of organizations use IaC, while in Google Cloud, the number drops to 55%.
- Importance of Automation for Security:
Andrew Krug, Head of Security Advocacy at Datadog, emphasizes the importance of embracing automation to improve security. He highlights that modern DevOps practices and strong security measures are interconnected, with security contributing to operational excellence. However, there is still room for improvement in automating security processes.
- Key Findings from the Report:
– While automated security scanners generate the largest number of exploitation attempts, the majority of these attacks are harmless, with only 0.0065% successfully triggering vulnerabilities.
– Many organizations still rely on long-lived credentials in CI/CD pipelines, despite the risks they pose. Sixty-three percent used long-lived credentials at least once to authenticate GitHub Actions pipelines.
– Java applications are particularly susceptible to third-party vulnerabilities, with 90% of Java services vulnerable to critical or high-severity vulnerabilities introduced by third-party libraries.
- Methodology:
Datadog analyzed tens of thousands of applications and container images, along with thousands of cloud environments, to assess the security posture of applications and evaluate the adoption of DevSecOps best practices.
