Just over half of developers feel that security policies stifle their innovation and only about a third of developers reported that they are thoroughly educated on the security procedures they are expected to execute, according to a new report by VMware and Forrester. 

Forrester conducted a VMware-commissioned survey called “Bridging the Developer and Security Divide” with 1,475 respondents and five interviews with IT, security, and development managers and above (including CIOs and CISOs) with responsibility for development or security strategy decision-making to explore this topic. 

The survey respondents noted that the top two most challenging tasks are ensuring security in the cloud at 79% and securing workloads and containers at 71%.

“Organizations expect developers to be more involved with security tasks in the future, particularly among cloud and workload tasks. However, developers currently aren’t very involved in security strategy planning or execution,” the report stated. It is important for security and development teams to work together so that development teams are clear which policies to comply with and which tools are approved.

The best way around these bottlenecks is to make sure security is no longer a specialization at an organization and that security tasks should be embedded across people, teams processes, and technologies like in DevSecOps, according to Forrester.

Other methods to improve security include sharing KPIs with developers, automating security to improve scalability, and having the security side learn to speak the language of the development team rather than the other way around. 

“Having a security advocate who asks the right questions and takes the time to get to know the development teams will go a long way to building trust between teams,” the report added. 

The report found that there is room for growth in security education programs since only just over half of developers at 54.3% said there is a formal education process for new and updated security policies within their organizations. 

The biggest challenge will be changing the culture among developer and security teams to foster more collaboration and drive shared outcomes and while some organizations have already made improvements there is still a long way to go, according to Rick McElroy, Principal Cybersecurity Strategist at VMware. 

“Developers are more aware of threats and security risks, but they are challenged by the time to market on many efforts. Tradeoffs happen during the development cycle and, up until very recently, one of the major ones has been security. This has changed given board-level involvement in cybersecurity — we are seeing organizations shifting left on security and delivering solutions that have security built in from development to maintain applications in production over time,” McElroy said.