Can Financial Service DevOps Teams Improve Their Cryptographic Security?
July 20, 2017

Tim Bedard
Venafi

It's imperative for organizations to embrace new and groundbreaking technology. This is especially true in the financial service sector, which has always been at the forefront of innovation. Think about how much your preferred payment methods have shifted over the last decade, or even over the previous year. From mobile banking to high speed trading, the financial industry leads the way on technological advancement.

So, it's not especially shocking that the financial service industry has been early, and prominent, adopter of DevOps technologies and methodologies. Organizations in the sector use DevOps to accelerate application development and faster releases to improve the customer experience in order to remain relevant in today's hyper competitive market. However, as my previous blog discussed, this innovation cannot come at the cost of organizational security.

As we've seen with the SWIFT attacks, financial services organizations are high value targets for cyber criminals all over the world. Because of this, it is imperative that the keys and certificates used by financial service DevOps teams are properly protected. If not, bad actors can easily exploit cryptographic assets and wreak havoc on sensitive corporate data, all while remaining undetected.

Venafi was curious to see if financial services DevOps teams were properly protecting their keys and certificates. To that end, Venafi recently conducted a study that polled over 100 IT professionals in the financial service industry who said they were responsible for cryptographic assets of their DevOps programs. Unfortunately, the financial sector could stand to see some improvements.

According to the study, many financial services organizations have fairly strong cryptographic security policies in their production systems; however, they often fail to enforce the same vital security measures in their DevOps environments.

In addition, financial services organizations continue to use DevOps certificates once software, applications and updates have gone live. This oversight leaves easily preventable vulnerabilities in their DevOps development and test environments and systems.

Interesting highlights from our study included:

■ Almost a third (30 percent) of financial services organizations do not consistently enforce the same cryptographic security policies for DevOps projects as they do with production environments.

■ Only half (51 percent) of financial services organizations replace all DevOps certificates with production certificates once live. If certificates are not changed, there is no way to differentiate between the identities of untested machines that should remain in development and trusted machines that are safe to place in production.

■ The majority (80 percent) of financial services DevOps teams are aware of the volume and severity of cyber attacks as a result of compromised keys and certificates. However, only two thirds (67 percent) of these teams are aware of the controls needed to prevent this type of cyber attack.

On a positive note, financial services organizations generally implement robust cryptographic security practices throughout their operations, with 75 percent requiring strong keys (2048-bit or stronger) and 60 percent of organizations requiring different certificate authorities for development and production environments. Encouragingly, only 2 percent of respondents said their organization does not require key and certificate policies.

So what steps can financial service DevOps teams take to guard their cryptographic assets and yet remain innovative? Ultimately, we in the information security sector must reiterate that protection does not come at the cost of agility or speed. As this study demonstrates, DevOps teams understand the importance cryptographic security, but implementation or poor implementation can be an major security issue.

DevOps teams and their security solution providers must be able to work together in order to provide fast, but safe, development, innovation and releases. And the financial service industry is in a unique position to embrace this mindset and drive these security best practices throughout the market.

Just as finance has led in technology innovation; they are also strong advocates for effective cyber security. As long as we all work together, we can create a trailblazing, and protected future.

Tim Bedard is Director of Threat Intelligence and Analytics for Venafi
Share this

Industry News

March 28, 2024

Check Point® Software Technologies Ltd. announced a collaboration with Microsoft that utilizes the Microsoft Azure OpenAI Service to enhance Check Point Infinity AI Copilot, marking a significant advancement in cyber security AI applications.

March 28, 2024

ArmorCode announced ArmorCode Risk Prioritization, providing a 3D scoring approach for managing application security risks.

March 28, 2024

AppViewX and Fortanix announced a partnership to offer cloud-delivered secure digital identity management and code signing.

March 27, 2024

WaveMaker has updated its platform in response to customer demand for more sophisticated API and code management tools.

March 27, 2024

Vercara announced the launch of UltraAPI™, a product suite that protects APIs and web applications from malicious bots and fraudulent activity while ensuring regulatory compliance.

March 27, 2024

Legit Security announced the launch of its standalone enterprise secrets scanning product, which can detect, remediate, and prevent secrets exposure across the software development pipeline.

March 26, 2024

Progress announced a strategic partnership with Veeam® Software, the #1 leader by market share in Data Protection and Ransomware Recovery, to provide customers with an enterprise-ready cyber defense solution that strengthens the security of their business-critical data.

March 26, 2024

GitGuardian released its Software Composition Analysis (SCA) module.

March 26, 2024

DataStax announced a milestone in its journey to simplify enterprise retrieval-augmented generation (RAG) for developers by integrating with Microsoft Semantic Kernel.

March 25, 2024

Check Point® Software Technologies Ltd. is collaborating with NVIDIA to enhance the security of AI cloud infrastructure. Integrating NVIDIA BlueField DPUs, which feature a broad range of purpose-built, innovative security capabilities, the new Check Point AI Cloud Protect solution will help prevent threats at both the network and host levels.

March 25, 2024

Sentry announced the release of Autofix, an AI-powered feature to debug and fix code in minutes, saving important time and resources.

March 25, 2024

Apiiro announced a product integration and partnership with Secure Code Warrior, the agile developer security training platform, to extend its ASPM technology and processes to the people layer.

March 21, 2024

Progress announced that Progress® Semaphore™, its metadata management and semantic AI platform, was named a Champion in SoftwareReviews’ 2024 Metadata Management Emotional Footprint Awards.

March 21, 2024

The Cloud Native Computing Foundation® (CNCF®) has partnered with Udemy, an online skills marketplace and learning platform.

March 21, 2024

GitLab has acquired Oxeye, the provider of a cloud-native application security and risk management solution.