[レポート] 世界のDevSecOps の現状 2023

AST DevOpsDevSecOps 2023DevSecOpsDevOpsDevSecOpsDevSecOpsASOC/ASPM DevOps() DevSecOps 2023Cybersecurity Research Center(CyRC)Censuswide1,000ITDevOpsCISO/ DevOpsDevSecOpsDevOpsDevSecOps(SDLC)CI 2023DevSecOps 2023DevSecOps 1DevSecOpsCISO DevSecOpsSANS 2023 DevSecOpssurveyDevSecOps(AST)SDLCASTDevOps() 2023DevSecOpsDevOpsDevSecOpsDevSecOpsASOC/ASPM DevOpsSDLC DevOpsDevOps (CI/CD) 2023DevSecOps CI/CD 2023DevSecOps ASPMASPM DevSecOpsASOC/ASPM 2023DevSecOpsDevOpsDevSecOpsDevSecOpsASOC/ASPM DevSecOps/ ASPM (ASOC)(ASPM)ASPM 2023DevSecOps 1,000AST(35%)/(29%)ASOC/ASPM 31/ 70%34%AST 2023DevSecOps 2023DevSecOps2023DevSecOps / DevOpsDevSecOps /SDLCBSIMMSAMM 91%DevSecOpsDevSecOps SDLC AST 80%20222023/ 1,000AST(35%)/(29%) 29%DevSecOps()//QA 28%/320%1 52%DevSecOpsAI43AI DevSecOps 1 AIAIAIIPAI 33%(31%)/(31%)(30%) 2023DevSecOps 2023DevSecOps DevSecOps 1,000313325%44 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI 91%DevSecOpsDevSecOpsDevOps •SAST(DAST)SCA B() 2023DevSecOps BDevSecOps(30%)(28%) • 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI •30% 358(35.1%)SDLC • •SDLC••(SAST)(SCA) CBSIMMSAMM 70%(BSIMM)31 2023DevSecOps 33% 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI BSIMM 35.8% 33.6% ()69.4% BSIMM1() BSIMM(SAMM) 33% 18.1% 8.4% DevSecOps 2023DevSecOps 29%DevSecOps()(Q16)//QA(DevSecOps) 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI ()QASDLC 33% E() 2023DevSecOps ()DAST 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI 44% FDevSecOpsKPI(3) (KPI) DevSecOpsKPI3KPI295(29%)288(28%)SDLC3KPI281(28%) 2023DevSecOps 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI 3KPISDLC DevSecOps3 •/•SDLC• G AST DevSecOps(DAST)(IAST)(SAST)(SCA) 2023DevSecOps (SAST) 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI ASTSAST72%IAST (69%)SCA (68%)DAST(67%) SASTDASTSDLCSASTSDLCDASTSASTDASTIAST (IAST) /(SCA) SCA43IoTASTSCA I/// 2023DevSecOps (H)123 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI 28%3(I) DevSecOps31%/29%(K) 1 J1(20222023)/() ()12 (CVSS)(CWE)() 2023DevSecOps 2023DevSecOps CVSSNational Vulnerability Database (NVD)CVSS(Base) DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI ()SDLC(J) (Temporal)(Remediation Level)(Report Confidence)CVSS 42.7% 38.4% ()81.1% IDECI() CWECWE()SDLC1SQL(DoS) DevSecOps DevSecOpsK350/ 2023DevSecOps 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI 1QA/ AST(ASOC)(ASPM)ASOC/ASPMAST SASTDAST IAST SCAAST(L) L(3) 2023DevSecOps 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI ASOC/ASPMASOC/ASPM() DevOps43211(I) 80%20222023/(J) MAI NAIDevSecOps() AI 50%DevSecOpsAIAI54%AI58%AI 2023DevSecOps 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI AIDevSecOpsDevOpsCI SDLCAI(54%)(48%)2 AIAIAI DevSecOpsAIAIDevOpsAI 2023DevSecOps 2023DevSecOps DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI AI1AIAI 2022AIGitHub CopilotCopilotGitHubMicrosoft OpenAICopilot ChatGPTGoogle BardAI() PAI 2023DevSecOps 2023DevSecOps AIChatGPTAI(URL)()ChatGPTPyPInpm DevSecOpsDevSecOps(KPI)ASTDevSecOpsAI AI (ASPM)ASPM DevOpsDevSecOpsASPM 2023DevSecOps2023DevSecOps DevSecOps2 •(AST)• •ASPM1 Software Risk Manager:ASPM 28%/3()20%1AST •ASPMDevSecOpsASPM ••••• 1DevSecOps •ASPMASPM ASPMSoftware RiskManager 20215%ASPM(ASOC)202328%ASOC/ASPMDevSecOpsDevSecOps 2023DevSecOps2023DevSecOps CISODevOpsITITQA////SVPVPVPVP 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps Q101(20222023)/() 2023DevSecOps2023DevSecOps Q12/// 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps 2023DevSecOps2023DevSecOps DevSecOps www.synopsys.com/jp/software