Latest
Topics
Videos/Podcasts
Webinars
Library
Events
Sponsored Content
Related Sites
Media Kit
About
Sponsor

AI
Cloud
CI/CD
Continuous Testing
DataOps
DevSecOps
DevOps Onramp
Platform Engineering
Low-Code/No-Code
IT as Code
More

Rocket Software Featured

Discover Rocket Open AppDev for Z

Coreen Wilson | July 7, 2021 | IBM Z, legacy systems, mainframe, mainframe efficiency, mission critical, open source software, oss, z/OS

Give your developers the open software they want through a system that combines an easy user experience with the security and support IBM® Z® customers demand. Rocket® Open AppDev for Z helps you ...

Should Modern Developers Care about Mainframe?

Rocket on TechStrong TV

Watch latest Rocket episodes

Rocket Solutions for IBM Z

Upcoming Webinars

Recent Webinars

Rocket Podcast

Home
About DevOps.com
Meet our Authors
Write for DevOps.com
Media Kit
Sponsor Info
Copyright
TOS
Privacy Policy

Application Security Check Up

AI/ML Feature Store

Step 1 of 7

14%

Does someone in your organization write software?(Required)

Yes

What portion of your cyber risk is Application Security (AppSec)? (Select one)(Required)

We over-focus on AppSec

We focus on AppSec to match the risk

We under-focus on AppSec

What are the biggest challenges you face implementing a robust AppSec strategy? (Select all that apply)

Lack of budget

Insufficient skilled personnel

Complexity of integrating security into the development lifecycle

Resistance from development teams

Keeping up with evolving security threats

Lack of executive buy-in

Other (please specify)

Other

Which DevSecOps practices are widely used for actively developed projects (not legacy) (Select all that apply):(Required)

Automated unit and functional tests for quality run in the pipeline with merge blocking

Automated application security testing (AST) in development and (SAST/IAST) runs in the pipeline

Automated AST tools to find vulnerabilities in the code you import (SCA) run in the pipeline

Merge blocking at current policy level for AST checks

Secrets management so no secrets stored in source code repositories

How do you assess and mitigate risk of For NON actively developed products (legacy) (Select all that apply):

In-production scans using DAST products like Qualys, Nessus, etc.

Periodic penetration testing

Periodic running of AST tools

Manual code reviews by security specialists

Use of third-party security assessment services

No assessment or mitigation effort is happening

How do you resolve the security issues found? (Select all that apply):(Required)

Findings are manually triaged

Findings are communicated to engineering via mostly manual processes

Finding above a certain severity automatically populate engineering backlogs

Service level agreements (SLAs) are enforced based on severity

An exception process exists to allow the business to accept risk

The exception process is rarely used and must be renewed periodically

Which best describes security training for your developers? (Select all that apply)(Required)

Monthly

Quarterly

Annually

As part of onboarding

Just-in-time via integration with AST tools when a vulnerability is found

No formal training provided