Growing Security and Compliance Challenges in the Cloud
February 21, 2017

Pete Goldin
DEVOPSdigest

The stakes are high for preventing security compromises: 72.7 percent of companies have a custom application that, if it were to experience downtime, would significantly impact the organization’s ability to operate, according to the Custom Applications and IaaS Report 2017 from Skyhigh Networks and the Cloud Security Alliance (CSA).

While respondents forecast rapid IaaS adoption, they at the same time expressed numerous unresolved concerns about the security and compliance of their custom applications in IaaS platforms.

“Custom applications are a core part of how our business operates, and moving these to the cloud provide IT an opportunity to ‘start fresh’ with the right visibility, controls and overall security, without getting in the way of business operations,” said Stephen Ward, CISO, TIAA. “Meeting our security requirements for our applications, as well as our IaaS environment, is absolutely critical to accomplishing our business goals for cloud and overall software programs.”

Some of the key findings from the survey include:

Every Company Is a Software Company

Every company has developers writing custom code to improve engagement with employees, partners and customers. The average enterprise runs 464 custom applications and expects the number to grow 20.5 percent in the next 12 months. Yet IT security is aware of only 38.4 percent – a new and rapidly growing area of shadow computing.

At the Brink of the Cloud Tipping Point

Cloud adoption is accelerating with the growth of software-as-a-service (SaaS) running at 10x the growth rate of IT in general and the growth rate of IaaS at 20x that of IT in general.

In 2017, IaaS adoption will reach a tipping point because for the first time more custom applications will reside in public IaaS platforms than in corporate datacenters.

Slightly more than half – 60.9 percent – of custom applications remain in corporate datacenters today, and this number is expected to decline to 46.2 percent in the next 12 months as enterprises continue to migrate applications to public IaaS platforms.

The two top reasons for moving to the cloud are scale and cost, and a majority (62.9 percent) of respondents believe public IaaS platforms are just as or more secure than their own datacenters.

Apps Vulnerable in the IaaS Wilderness

Despite growing acceptance of public IaaS platforms, IT security departments face a host of new threats and challenges in the move to the cloud. Under cloud’s shared responsibility model, IaaS platforms secure the infrastructure but the enterprise is accountable for securing the corporate data, which includes protecting against compromised login credentials, rogue administrators and regulatory violations. These challenges are made more urgent by the fact that 46 percent of business-critical custom applications are already in the public or hybrid cloud today and by the rapidly approaching deadline for complying with the EU General Data Protection Regulation (GDPR).

C-Suite Jobs on the Line

Companies currently lack the expertise and tools to effectively deploy security for custom applications; 64.0 percent of respondents are moderately or very concerned about the security of custom applications deployed on a public IaaS platform.

Recent high-profile cyber attacks have illustrated that corporate boards ultimately hold c-level executives responsible, and 29.1 percent of respondents believe the CIO and the CISO would lose their jobs in a catastrophic attack on a custom application.

Over half, 50.3 percent, believe the IT security manager responsible for the application would be fired. Application developers are considered the least likely to face termination and only 23.3 are concerned about application security, signaling that IT security must take the initiative for custom application and IaaS security.

“The results of this survey provide an unfiltered view into the challenges companies and their IT security leadership are facing because of the exponential growth in cloud usage,” said Jim Reavis, CEO, CSA. “From custom applications to the infrastructure to the teams tasked with managing it all, we’re seeing a major evolution in how security needs to be more a focal point when it comes to planning for the increasingly complex needs of business.”

The report is based on a broad survey of software development, IT administration, IT security, operations and devops professionals across the Americas, EMEA and Asia Pacific, involved in developing, deploying and securing custom applications.

The Latest

March 27, 2017

A recent survey, conducted by Forrester and commissioned by Compuware, showed 96 percent of new business initiatives involve the mainframe. However, the platform is not without challenges. The survey also revealed frustration and concern among development leaders, particularly when it comes to their team's ability to accommodate the speed and agility required to compete in today's digital market ...

March 23, 2017

Mature development organizations ensure automated security is woven into their DevOps practice, early, everywhere, and at scale, according to Sonatype's 2017 DevSecOps Community Survey ...

March 21, 2017

When it comes to food, we all know what's considered "good" and what's "bad". We can all understand this simple rule when eating. But for many, when it comes to software development, simple rules and advice from nutritional labels aren't always there for us ...

March 20, 2017

Monitoring and understanding what software is really doing, and maintaining good levels of software quality is increasingly important to software vendors today. Even a minor bug is capable of shutting down whole systems, and there is a real risk that development cycle pressure competes with quality assurance best practices ...

March 16, 2017

More than half (54 percent) of IT professionals surveyed indicate they have no access to self-service infrastructure, according to a new DevOps survey of 2,000 IT industry executives by Quali.This means that more than half of respondents take a ticket-based approach to infrastructure delivery, impacting productivity and increasing time to market ...

March 15, 2017

Driven by the adoption of cloud and modernization of application architectures, DevOps practices are fast gaining ground in companies that are interested in moving fast – with software eating everything - between "write code and throw it across the wall" to creating more pragmatic mechanisms that induce and maintain operational rigor. The intent behind DevOps (and DevSecOps) is quite noble and excellent in theory. Where it breaks down is in practice ...

March 13, 2017

There might be many people across organizations who claim that they’re using a DevOps approach, but often times, the “best practices” they’re using don’t align with DevOps methodologies. They can say what they do is “DevOps”, but what we’ve found is that many are actually not following basic agile methodology principles, and that’s not DevOps ...

March 09, 2017

The velocity and complexity of software delivery continues to increase as businesses adapt to new economic conditions. Optimizing and automating your deployment pipelines will dramatically reduce your lead times and enable you to deliver software faster and with better quality. Here are three more most common areas that generate the longest lead times ...

March 08, 2017

Every enterprise IT organization is unique in that it will have different bottlenecks and constraints in its deployment pipelines. With that being said, there are some common problem areas that typically produce the longest lead times in your software delivery process. Here are the most common areas that generate the longest lead times ...

March 06, 2017

The findings of an independent survey of IT leaders, application developers and database administrators, conducted by IDG Research for Datical, indicate that database administrators are unable to keep up with the pace and frequency of database changes caused by the accelerated pace of application releases, thus creating a bottleneck and delaying digital transformation initiatives. An overwhelming number of databases administrators (91 percent) and application development managers (90 percent) cited database updates as the cause for application release delays ...

Share this