This article is an very intriguing read. The economics of software are hard, whether the applications are public facing and for resell or the development is internal to an organization. Security is far too often an afterthought or a nice to have in the development cycle. True devops programs and security officers should partner. Instead, they complete.
Sadly, the only real mechanism that addresses these problems today is fear – fear of penalties and fear of non-compliance. We should be motivated by security itself – a desire to protect customer data, to provide a more secure, robust service. It will take consumers willing to demand such a high-caliber standard before the market will adjust and the economics will justify a more mature, secure development cycle.
Virtual Sweater Vest 