DEVOPSdigest

Four-fifths (80%) of organizations have experienced at least one severe cloud security incident in the past year (such as data breaches, data leaks, and intrusions into their environment), according to the State of Cloud Security Report from Snyk.

The report also found:

■ 41% of respondents say cloud native services increase complexity, further complicating their security efforts.

■ Nearly half (49%) of organizations find deployment is faster as a result of improved cloud security.

"This new research should serve as a wake-up call that our collective cloud security risk is universal and will only continue to grow if we double down on outdated approaches and legacy tools," said Josh Stella, Vice President, Chief Architect, Snyk. "The outlook is not entirely dire, however, as the data also clearly reveals that shifting cloud security left and embracing DevSecOps collaboration can allow global organizations to continue their current pace of innovation more securely."

80% Experienced a Severe Cloud Security Incident, Startups and Public Sector Currently Most Impacted

Cloud customers representing organizations of all sizes and industry sectors noted they were impacted by major cloud security events over the last 12 months, with startups (89%) and public sector organizations (88%) most impacted.

On the other hand, enterprise companies fared better (most likely due to greater investment), while small and mid-sized businesses (SMBs) reported making out the best (probably as result of a smaller cloud footprint and less infrastructure complexity).

Respondents specified data breaches, data leaks, and intrusions into their environment were among the most severe incidents they had knowledge of. All of these unquestionably carry a high cost to global businesses, including but not limited to: fines for failed audits and compliance violations, cryptomining on the customer's cloud bill, and loss of productivity due to system downtime.

Tellingly, respondents also indicated this universal risk is likely to grow in the near term. To this end, respondents admitted:

■ A quarter (25%) worry they've recently suffered a cloud data breach but are unaware.

■ The majority (58%) of both security pros and developers believe that the risk of a cloud data breach at their organization will only increase over the next year.

Cloud Native Approach: 41% Cite Additional Complexity as a Trade-Off

While cloud-native application development undoubtedly allows modern developers to move faster to produce more, at the same time, new challenges and complexities have emerged as the overall attack surface has expanded and the clear delineation of security responsibilities has blurred. 

Ultimately, many of today's cloud security failures result from a lack of effective cross-team collaboration and team training. When different teams use different tools or policy frameworks, reconciling work across those teams and ensuring consistent enforcement can be challenging.

Moreover, insufficient tooling that produces false positives often leads to alert fatigue within security teams, contributing to human error when identifying the critical issues needed to be prioritized and addressed.

Further, consider:

■ 77% of organizations cite problems with poor training and collaboration as a major challenge.

■ 45% of companies cite demand for engineering resources as the biggest impact of inefficient cloud security.

Strategic Business Results Recognized With Improved Cloud Security: Half See Resulting Faster Deployment

When organizations improve their cloud security, they experience benefits reaching beyond incident mitigation alone.

By fully embracing the cloud to build new applications, teams ultimately can no longer rely on – and therefore let go of – the traditional security approaches and technologies that were designed for legacy environments. Given the realities of cloud-native development and the numerous internal stakeholders involved, businesses that champion and adopt this paradigm shift reap the benefits of increased team collaboration, facilitating enhanced developer productivity and faster secure innovation.

To this end, respondents asserted:

■ Infrastructure-as-code (IaC) security delivers a 70% median reduction in cloud misconfigurations.

■ Close to half (48%) said their security team is able to do more with the resources they have when cloud security is improved.

■ 44% said that security improvements have led to better collaboration among teams.