Growing Security and Compliance Challenges in the Cloud
February 21, 2017

Pete Goldin
DEVOPSdigest

The stakes are high for preventing security compromises: 72.7 percent of companies have a custom application that, if it were to experience downtime, would significantly impact the organization’s ability to operate, according to the Custom Applications and IaaS Report 2017 from Skyhigh Networks and the Cloud Security Alliance (CSA).

While respondents forecast rapid IaaS adoption, they at the same time expressed numerous unresolved concerns about the security and compliance of their custom applications in IaaS platforms.

“Custom applications are a core part of how our business operates, and moving these to the cloud provide IT an opportunity to ‘start fresh’ with the right visibility, controls and overall security, without getting in the way of business operations,” said Stephen Ward, CISO, TIAA. “Meeting our security requirements for our applications, as well as our IaaS environment, is absolutely critical to accomplishing our business goals for cloud and overall software programs.”

Some of the key findings from the survey include:

Every Company Is a Software Company

Every company has developers writing custom code to improve engagement with employees, partners and customers. The average enterprise runs 464 custom applications and expects the number to grow 20.5 percent in the next 12 months. Yet IT security is aware of only 38.4 percent – a new and rapidly growing area of shadow computing.

At the Brink of the Cloud Tipping Point

Cloud adoption is accelerating with the growth of software-as-a-service (SaaS) running at 10x the growth rate of IT in general and the growth rate of IaaS at 20x that of IT in general.

In 2017, IaaS adoption will reach a tipping point because for the first time more custom applications will reside in public IaaS platforms than in corporate datacenters.

Slightly more than half – 60.9 percent – of custom applications remain in corporate datacenters today, and this number is expected to decline to 46.2 percent in the next 12 months as enterprises continue to migrate applications to public IaaS platforms.

The two top reasons for moving to the cloud are scale and cost, and a majority (62.9 percent) of respondents believe public IaaS platforms are just as or more secure than their own datacenters.

Apps Vulnerable in the IaaS Wilderness

Despite growing acceptance of public IaaS platforms, IT security departments face a host of new threats and challenges in the move to the cloud. Under cloud’s shared responsibility model, IaaS platforms secure the infrastructure but the enterprise is accountable for securing the corporate data, which includes protecting against compromised login credentials, rogue administrators and regulatory violations. These challenges are made more urgent by the fact that 46 percent of business-critical custom applications are already in the public or hybrid cloud today and by the rapidly approaching deadline for complying with the EU General Data Protection Regulation (GDPR).

C-Suite Jobs on the Line

Companies currently lack the expertise and tools to effectively deploy security for custom applications; 64.0 percent of respondents are moderately or very concerned about the security of custom applications deployed on a public IaaS platform.

Recent high-profile cyber attacks have illustrated that corporate boards ultimately hold c-level executives responsible, and 29.1 percent of respondents believe the CIO and the CISO would lose their jobs in a catastrophic attack on a custom application.

Over half, 50.3 percent, believe the IT security manager responsible for the application would be fired. Application developers are considered the least likely to face termination and only 23.3 are concerned about application security, signaling that IT security must take the initiative for custom application and IaaS security.

“The results of this survey provide an unfiltered view into the challenges companies and their IT security leadership are facing because of the exponential growth in cloud usage,” said Jim Reavis, CEO, CSA. “From custom applications to the infrastructure to the teams tasked with managing it all, we’re seeing a major evolution in how security needs to be more a focal point when it comes to planning for the increasingly complex needs of business.”

The report is based on a broad survey of software development, IT administration, IT security, operations and devops professionals across the Americas, EMEA and Asia Pacific, involved in developing, deploying and securing custom applications.

The Latest

August 15, 2017

A common belief within DevOps circles is that automation not only enables greater frequency of delivery and deployment, but improves its overall success rate. Whenever manual intervention is required, the chances of errors creeping in increases. Human error is a significant factor in many an outage, after all ...

August 14, 2017

DevOps and NetOps are both far more generous in their opinion of the other with respect to prioritization of efforts than traditional archetypes purport them to be, and they have a lot in common – even though they may disagree on details – according to a new survey by F5 ...

August 10, 2017

Only 12 percent of organizations can claim that their whole organization is on the path to business agility even though more than two thirds of survey participants agreed that agile organizations are better able to quickly respond to dynamic business conditions, according to a new survey from CA Technologies ...

August 09, 2017

Alongside its clear benefits, DevOps brings unique challenges when developing and operating a mobile environment. Mobile app developers and development teams face a unique set of requirements relating to collaboration, testing, and release. Technology fragmentation, disparate back-end systems, updates that require user action, and poor instrumentation can impede the DevOps process and become critical roadblocks to agile mobile development, ultimately impacting app retention and the bottom line ...

August 07, 2017

A crashing app might be a deal breaker, no matter how heavy the load that an alternative website entry point can handle would be. It is all about quickly verifying compliance against key functional and non-functional requirements in order to meet aggressive release schedules as part of the Go-to-market strategy. This means positioning unit testing, UI testing, API testing, and, of course, performance and load testing — as pillars of SDLC ...

August 03, 2017

Most software developers make themselves easy targets for hackers, even when they are behind a corporate firewall, according to a new survey from Netsparker Ltd. ...

August 01, 2017

Your top priority is to improve application development agility, but you may run into roadblocks put up by a security team that (mistakenly) believes speed is the enemy of effective cybersecurity. A new survey finds a majority of enterprises are working to overcome those roadblocks by integrating security into their existing DevOps methodology ...

July 31, 2017

Agile development compresses software testing cycles, jeopardizing risk coverage and opening the door for software failures. Here's what you can do ...

July 27, 2017

While 75 percent of organizations highlight continuous testing as critical or important, only a minority of survey respondents have made exceptional progress acquiring the necessary knowledge and key enablers to drive digital transformation, according to a global study by CA Technologies ...

July 25, 2017

Test teams feel the need to adopt DevOps, but that migration is not always seamless, according to a new survey by LogiGear. That may be because 25 percent of respondents said their Ops/IT team is always helpful to the test team and its needs; 37 percent said Ops teams regularly help bring about good test environments; 27 percent said Ops can be "slow or difficult" ...

Share this