Industry executives and experts share their predictions for 2022.  Read them in this 14th annual VMblog.com series exclusive.

Cloud-native security, shared responsibility model, education

By Rani Osnat, SVP Strategy, Aqua Security

It is without a doubt that cloud migration soared in popularity in 2021, resulting in security concerns hitting an all-time high. The pressing need for cloud-native security emerged stronger than ever over the past year, and we anticipate only more demand for it in 2022 as companies strive for more digital transformation across industries to gain a competitive edge by investing in these innovations. 

Swapping out legacy for born-in-the cloud tools

There will be a continued growth of cloud adoption in general, and more specifically the move to cloud native practices and technologies (CI/CD, containers, serverless, K8s). This will replace simply lifting and shifting existing applications. This change is rendering older security tools obsolete and requires born-in-the-cloud tools for everything from app testing to network security, to runtime protection and SIEM.

Shared responsibility

User organizations are also beginning to better understand the "shared security model" and more specifically how much of it is their responsibility... a lot! This is especially true in the case of multi- and hybrid cloud scenarios, which some organizations are adopting but virtually all organizations are planning for. What this means is that organizations cannot rely exclusively on defaults or cloud provider tools. 

Unfortunately the shared responsibility model is rather simplistic when it comes to real-world implementations. In reality, it's not so much a "shared" model as it is split, and it doesn't reduce what customers need to do security-wise insomuch as requiring them to focus on areas that are different from what they've been doing in on-prem environments. The use of dedicated security solutions for cloud native security will continue to grow at the expense of technologies that are being replaced such as traditional firewalls, HIPS solutions, etc.

Increased market education on cloud native

Staffing and lack of knowledge are two of the biggest challenges for cloud native security. DevOps teams are not familiar with security methods, and it isn't their main responsibility. On the other hand, security teams are not familiar with cloud services, Kubernetes, containers, and their respective security risks and countermeasures. Educating the market and moving toward a DevSecOps transformation will be critical in 2022. 

Increased prioritization of cloud native security on CISO agenda

In 2022, we will see security teams will step up to completely own cloud native security. It's already happening. This means the CISO and his/her direct reports will determine the needs, set policies, and assign roles and responsibilities to everything related to choosing, implementing and running a cloud workload protection platform (CWP) or cloud native application protection program (CNAPP).  

A new cybersecurity acronym emerges - CNAPP

A CISO recently asked me: "I'm facing a growing stream of vulnerabilities coming from our CI/CD pipelines on the one hand, while our SecOps team is flooded with alerts and configuration issues from our production environment. How do I reconcile those separate streams and focus on what's really important?"

In the wake of these challenges, 2022 will see an emergence of CNAPPs, or cloud native application protection platforms, an emerging category of security solutions recently defined by Gartner to help identify, assess, prioritize, and adapt to risk in cloud native applications, infrastructure, and configurations.

The prevalence of large-scale cloud native deployments is forcing enterprises to combine "shift left" DevSecOps, intelligent automation, CSPM (cloud security posture management) and CWPPs (cloud workload protection platforms), to bring efficiency and speed to cloud native security.

The companies that will forge ahead in 2022 will fully lead modernization in the cloud. They will continue to swap out legacy for born-in-the cloud tools, focus on the shared responsibility security model, increase education on cloud native, prioritize cloud native security, particularly on the CISO agenda, and laser in on an emerging cybersecurity category - CNAPP (cloud native application protection platforms). 2022 will be a huge year of opportunity for cloud-native security, and we are excited to see it shape the industry as companies move forward on their innovative visions.

##

ABOUT THE AUTHOR

Rani is the SVP of Strategy at Aqua. Rani has worked in enterprise software companies more than 25 years, spanning project management, product management and marketing, including a decade as VP of marketing for innovative startups in the cyber-security and cloud arenas. Previously Rani was also a management consultant in the London office of Booz & Co. He holds an MBA from INSEAD in Fontainebleau, France. Rani is an avid wine geek, and a slightly less avid painter and electronic music composer.