Can Financial Service DevOps Teams Improve Their Cryptographic Security?
July 20, 2017

Tim Bedard

It's imperative for organizations to embrace new and groundbreaking technology. This is especially true in the financial service sector, which has always been at the forefront of innovation. Think about how much your preferred payment methods have shifted over the last decade, or even over the previous year. From mobile banking to high speed trading, the financial industry leads the way on technological advancement.

So, it's not especially shocking that the financial service industry has been early, and prominent, adopter of DevOps technologies and methodologies. Organizations in the sector use DevOps to accelerate application development and faster releases to improve the customer experience in order to remain relevant in today's hyper competitive market. However, as my previous blog discussed, this innovation cannot come at the cost of organizational security.

As we've seen with the SWIFT attacks, financial services organizations are high value targets for cyber criminals all over the world. Because of this, it is imperative that the keys and certificates used by financial service DevOps teams are properly protected. If not, bad actors can easily exploit cryptographic assets and wreak havoc on sensitive corporate data, all while remaining undetected.

Venafi was curious to see if financial services DevOps teams were properly protecting their keys and certificates. To that end, Venafi recently conducted a study that polled over 100 IT professionals in the financial service industry who said they were responsible for cryptographic assets of their DevOps programs. Unfortunately, the financial sector could stand to see some improvements.

According to the study, many financial services organizations have fairly strong cryptographic security policies in their production systems; however, they often fail to enforce the same vital security measures in their DevOps environments.

In addition, financial services organizations continue to use DevOps certificates once software, applications and updates have gone live. This oversight leaves easily preventable vulnerabilities in their DevOps development and test environments and systems.

Interesting highlights from our study included:

■ Almost a third (30 percent) of financial services organizations do not consistently enforce the same cryptographic security policies for DevOps projects as they do with production environments.

■ Only half (51 percent) of financial services organizations replace all DevOps certificates with production certificates once live. If certificates are not changed, there is no way to differentiate between the identities of untested machines that should remain in development and trusted machines that are safe to place in production.

■ The majority (80 percent) of financial services DevOps teams are aware of the volume and severity of cyber attacks as a result of compromised keys and certificates. However, only two thirds (67 percent) of these teams are aware of the controls needed to prevent this type of cyber attack.

On a positive note, financial services organizations generally implement robust cryptographic security practices throughout their operations, with 75 percent requiring strong keys (2048-bit or stronger) and 60 percent of organizations requiring different certificate authorities for development and production environments. Encouragingly, only 2 percent of respondents said their organization does not require key and certificate policies.

So what steps can financial service DevOps teams take to guard their cryptographic assets and yet remain innovative? Ultimately, we in the information security sector must reiterate that protection does not come at the cost of agility or speed. As this study demonstrates, DevOps teams understand the importance cryptographic security, but implementation or poor implementation can be an major security issue.

DevOps teams and their security solution providers must be able to work together in order to provide fast, but safe, development, innovation and releases. And the financial service industry is in a unique position to embrace this mindset and drive these security best practices throughout the market.

Just as finance has led in technology innovation; they are also strong advocates for effective cyber security. As long as we all work together, we can create a trailblazing, and protected future.

Tim Bedard is Director of Threat Intelligence and Analytics for Venafi

The Latest

August 17, 2017

Mobile SDKs (software developments kits); love them or hate them, they're here to stay. They provide our apps with all sorts of functionality that would be incredibly time consuming to build, and they give us another means to monetize our apps. While it would be difficult to argue that SDKs aren’t useful, it’s also hard for developers to get a good idea of the amount of resources used by each SDK once the app is in production ...

August 15, 2017

A common belief within DevOps circles is that automation not only enables greater frequency of delivery and deployment, but improves its overall success rate. Whenever manual intervention is required, the chances of errors creeping in increases. Human error is a significant factor in many an outage, after all ...

August 14, 2017

DevOps and NetOps are both far more generous in their opinion of the other with respect to prioritization of efforts than traditional archetypes purport them to be, and they have a lot in common – even though they may disagree on details – according to a new survey by F5 ...

August 10, 2017

Only 12 percent of organizations can claim that their whole organization is on the path to business agility even though more than two thirds of survey participants agreed that agile organizations are better able to quickly respond to dynamic business conditions, according to a new survey from CA Technologies ...

August 09, 2017

Alongside its clear benefits, DevOps brings unique challenges when developing and operating a mobile environment. Mobile app developers and development teams face a unique set of requirements relating to collaboration, testing, and release. Technology fragmentation, disparate back-end systems, updates that require user action, and poor instrumentation can impede the DevOps process and become critical roadblocks to agile mobile development, ultimately impacting app retention and the bottom line ...

August 07, 2017

A crashing app might be a deal breaker, no matter how heavy the load that an alternative website entry point can handle would be. It is all about quickly verifying compliance against key functional and non-functional requirements in order to meet aggressive release schedules as part of the Go-to-market strategy. This means positioning unit testing, UI testing, API testing, and, of course, performance and load testing — as pillars of SDLC ...

August 03, 2017

Most software developers make themselves easy targets for hackers, even when they are behind a corporate firewall, according to a new survey from Netsparker Ltd. ...

August 01, 2017

Your top priority is to improve application development agility, but you may run into roadblocks put up by a security team that (mistakenly) believes speed is the enemy of effective cybersecurity. A new survey finds a majority of enterprises are working to overcome those roadblocks by integrating security into their existing DevOps methodology ...

July 31, 2017

Agile development compresses software testing cycles, jeopardizing risk coverage and opening the door for software failures. Here's what you can do ...

July 27, 2017

While 75 percent of organizations highlight continuous testing as critical or important, only a minority of survey respondents have made exceptional progress acquiring the necessary knowledge and key enablers to drive digital transformation, according to a global study by CA Technologies ...

Share this