DEVOPSdigest

As businesses everywhere undergo a digital transformation, the hybrid cloud has become a key component of success. Organizations around the world are moving applications and services workloads to the cloud, and reaping the benefits of lowered CAPEX, OPEX, and quicker time to market with new services as a result.

The role of DevOps in capitalizing on these benefits has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud. However, as the deployment pipeline continues to gather speed, so too does the risk of potentially harmful flaws and vulnerabilities that go unnoticed until it’s too late.

One perspective of what enterprises are facing today can be found in the 2018 NETSCOUT Threat Intelligence Report covering the latest trends and activities from nation-state advanced persistent threat (APT) groups, crimeware operations and Distributed Denial of Service (DDoS) attack campaigns. The report makes clear that threat actors are increasingly leveraging internet-scale threats, such as NotPetya, for targeted, highly selective campaigns. In addition, APT groups have expanded their scope. State-sponsored activity has developed to the point where campaigns and frameworks are discovered regularly for a broad tier of nations and therefore the applications developed by DevSecOps need to eliminate susceptibility to vulnerabilities such as buffer overflows, back doors, and Trojans.

What can an enterprise do as hybrid cloud and multi-cloud change the IT landscape and create greater exposure to cyber security threats?

It is impossible for existing defenses to stop every attack or eliminate every vulnerability. To begin with, tools may lack in-depth monitoring and forensics analysis for true identification of threats, or to understand risks to digital assets, intellectual property and personal/ business information. The depth of monitoring and forensics is highly dependent on data used by these tools. Visibility may be constrained by syslog or NetFlow data and the cost to overcome blind spots can be prohibitive.

Enterprises also face substantial business risk when they can’t fix what they don’t see. These include loss of revenue, reputation, availability of services to customers and employees, trade secret theft, and falling out of regulatory compliance.

To better protect against cyber threats and innovate with confidence, DevOps teams must evolve into full-fledged DevSecOps teams, and obtain unobstructed end-to-end visibility across the entire service delivery infrastructure.

One way to get there is through continuous monitoring of wire data (IP traffic flows) and turning it into smart data at its point of collection, optimized for analytics at the highest possible speed and quality. Unlike log data, which needs to be collated and analyzed before it can be acted upon, smart data involves analyzing every IP packet that traverses the network during a development cycle and beyond, in real time, and uses that information to deliver meaningful and actionable insights, which create a common situational awareness for the entire team. By providing relevant actionable and intelligent datasets on events as they happen, smart data enables all teams — from developers to operations, security, QA and everyone in between — to work closely together as parameters continue to evolve throughout the development process and traffic flows from and to data centers, clouds and network edge.

Enterprises need solutions to protect against DDoS attacks that threaten availability and continuous monitoring to guard against advanced threats that infiltrate networks to steal critical business assets. Analyzing data after a breach will help troubleshoot problems but knowing about flaws in an application in real time will allow developers, operations, and security teams to deal with any issues with greater agility. When combined with automation, this process will help to create more secure applications and will, in turn, save time and money plus reduce risk.