Last year, we conducted a survey of more than 1,500 Chef customers to help us better understand their most pressing issues related to automation: productivity, roles and technology adoption. As we’ve noted in the past, the highest-performing software organizations are able to outperform their peers in each of three key areas, and associated metrics.
At Chef, we see it as our responsibility to help cross-functional teams optimize performance in each of these areas. We do so by drawing from their and our experience and applying our knowledge to develop the tools they need. We learned a lot from the last year’s survey to help speed us toward these improvements, including the following:
While we and those with whom we shared them found all of these issues compelling — they generated a great deal of discussion on our blog, at conferences and among our customers and colleagues in the field — we wanted to dig a bit more into the last point. The growing attention to compliance and resulting need for compliance automation are issues that we have only increased in severity and importance since we launched InSpec back in 2015. The severity of the need for more advanced capabilities, however, has increased. We wanted to see how well we understood the associated dynamics, in order to determine how well we were meeting that need.
To better understand how things were changing, and how we best help our users address them, we fielded a second survey late last year. With it, we polled more than 640 practitioners globally to determine their top concerns, team behaviors and implementation practices for compliance assessment and remediation.
Survey respondents reported manually assessing for compliance throughout all stages of the application lifecycle. It seems that while companies are increasingly embracing agile software development, they neglect to automate compliance processes. They open security holes faster than they can plug them, leaving their organizations vulnerable to downtime and creating rifts between infrastructure and application development teams.
As they shift to cloud native architectures, infrastructure teams find themselves stuck between developers’ speedy software development tactics, requests for service reliability, and their own responsibility for preventing data breaches. While infrastructure, application and security teams still see assessment and remediation of security issues as more important than speed of software development and delivery, their manual processes continue to limit their productivity.
Taking a ‘detect, correct, automate’ approach to assessment and remediation greatly eases their burdens, helping them detect exposures earlier, reduce malicious exploits and remediate faster. Automating the discovery, assessment and remediation of compliance errors helps both infrastructure and security teams prevent security breaches at pace with the rest of the organization. Does our InSpec solution smooth all of the bumps and plug all of the holes that every team needs in every instance? As with any security-focused solution, it would be foolhardy to say that it does. Does it put them much further down the path toward achievement of the the speed/efficiency/risk balance they all must continue to seek? We think so.
What do you think? Please leave your comments, both on the survey and its outcomes and the solutions we are developing to address compliance needs, in the comments section.