Organizations Not Fully Embracing Automation to Secure Cloud Deployments
May 08, 2024

A surprising amount of organizations aren't embracing automation when it comes to securing cloud deployments, according to the State of DevSecOps 2024 report from Datadog.

At least 38% of organizations leveraging AWS had deployed workloads or completed sensitive actions manually through the AWS console in a production environment within a 14-day period, meaning they are relying on manual click operations instead of automation.

Adoption of infrastructure as code (IaC) also varied across cloud providers. IaC is considered a critical practice when securing cloud production environments, as it helps ensure that human operations have limited permissions on production environments, all changes are peer reviewed and issues are identified earlier in the process. The report found that in AWS, over 71% of organizations use IaC through at least one popular IaC technology. This number is lower in Google Cloud, at 55%.

"These findings from the State of DevSecOps show that there is still room for improvement when it comes to embracing automation for the sake of improving security," said Andrew Krug, Head of Security Advocacy at Datadog. "Modern DevOps practices go hand-in-hand with strong security measures — and in fact, security helps drive operational excellence across the organization. While security starts with visibility, securing applications is only realistic when practitioners are given enough context and prioritization to understand which security signals matter and which are irrelevant."

Other key findings from the report include:

■ While attacks from automated security scanners represent the largest number of exploitation attempts, the vast majority of these attacks are harmless and only generate noise for defenders. Out of the tens of millions of malicious requests that were identified coming from such scanners, only 0.0065% successfully triggered a vulnerability.

■ A substantial number of organizations continue to rely on long-lived credentials — one of the most common causes of data breaches — in their CI/CD pipelines, even in cases where short-lived ones would be both more practical and more secure. 63% used a form of long-lived credential at least once to authenticate GitHub Actions pipelines.

■ Java applications are the most impacted by third-party vulnerabilities; 90% of Java services are susceptible to one or more critical or high-severity vulnerabilities introduced by a third-party library, versus an average of 47% for other programming languages.

Methodology: For the report, Datadog analyzed tens of thousands of applications and container images, along with thousands of cloud environments to assess the security posture of applications today and evaluate the adoption of best practices that are at the core of DevSecOps.

Share this

Industry News

December 19, 2024

Check Point® Software Technologies Ltd. has been recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for Email Security Platforms (ESP).

December 19, 2024

Progress announced its partnership with the American Institute of CPAs (AICPA), the world’s largest member association representing the CPA profession.

December 18, 2024

Kurrent announced $12 million in funding, its rebrand from Event Store and the official launch of Kurrent Enterprise Edition, now commercially available.

December 18, 2024

Blitzy announced the launch of the Blitzy Platform, a category-defining agentic platform that accelerates software development for enterprises by autonomously batch building up to 80% of software applications.

December 17, 2024

Sonata Software launched IntellQA, a Harmoni.AI powered testing automation and acceleration platform designed to transform software delivery for global enterprises.

December 17, 2024

Sonar signed a definitive agreement to acquire Tidelift, a provider of software supply chain security solutions that help organizations manage the risk of open source software.

December 17, 2024

Kindo formally launched its channel partner program.

December 16, 2024

Red Hat announced the latest release of Red Hat Enterprise Linux AI (RHEL AI), Red Hat’s foundation model platform for more seamlessly developing, testing and running generative artificial intelligence (gen AI) models for enterprise applications.

December 16, 2024

Fastly announced the general availability of Fastly AI Accelerator.

December 12, 2024

Amazon Web Services (AWS) announced the launch and general availability of Amazon Q Developer plugins for Datadog and Wiz in the AWS Management Console.

December 12, 2024

vFunction released new capabilities that solve a major microservices headache for development teams – keeping documentation current as systems evolve – and make it simpler to manage and remediate tech debt.

December 11, 2024

CyberArk announced the launch of FuzzyAI, an open-source framework that helps organizations identify and address AI model vulnerabilities, like guardrail bypassing and harmful output generation, in cloud-hosted and in-house AI models.

December 11, 2024

Grid Dynamics announced the launch of its developer portal.

December 10, 2024

LTIMindtree announced a strategic partnership with GitHub.