I am not exaggerating when I say that every organization of any size now uses some sort of cloud-based service, and most operate at least some business-critical functions from the cloud. But the story of how we got to this point has myriad routes, as each organization’s cloud journey is unique. Organizations leverage different types of approaches in order to meet their business needs and have embraced a multitude of cloud technologies, ranging from cutting edge to more mainstream implementations.
Organizations that began as “brick-and-mortar” enterprises often started their foray into the cloud with a handful of Software-as-a-Service (SaaS) tools, followed by the “lift-and-shift” migration of existing commercial off-the-shelf (COTS) business applications from their internal data centers to the cloud. As their experience in leveraging the cloud grew, organizations began to realize the benefits of cloud-centric models, and in return, became more sophisticated, developing new applications in the cloud, consuming technologies such as containers and microservices, and even leveraging serverless architectures to improve business agility.
CLOUD-NATIVE TECHNOLOGIES HAVE MOVED INTO THE MAINSTREAM
The fact that so many organizations are living out variations of this story means that adoption of cloud-native technology is not just growing, it is becoming the standard by which organizations operate. Forrester predicted a year ago that by the end of 2021, 30% of developers would regularly use cloud containers and 25% would use serverless computing. More recently, a study by Canonical found that while only 15% of organizations had achieved full adoption of cloud-native technologies, more than 45% are running some types of business applications on Kubernetes or are in the process of fully migrating.
The reasons for this rapid adoption are many, but the demand of digital transformation means that organizations in all industries must operate with maximum agility in order to survive in today’s quickly evolving marketplace. Contrast Security research has repeatedly found that organizations are under constant pressure to speed up the delivery of business value to their consumers. For example, our 2021 State of DevSecOps Report found that 79% of security and development professionals affirm that this pressure exists at their organizations.
CLOUD-NATIVE TECHNOLOGIES BRING SECURITY CHALLENGES
Most organizations discover early in their cloud journey that public cloud providers do not provide security coverage for anything beyond their own infrastructure; the rest of the burden resides on the consumer of the cloud services. This type of relationship is called the shared responsibility model, meaning organizations are responsible to protect anything that is considered out of scope to cloud providers-including operating systems, networking tools, application components, data, and development environments. This problem is magnified by the fact that 93% of organizations operate using a heterogeneous cloud strategy. This makes security even more complicated, as every cloud has its own architecture and security best practices to account for its particular nuances.
At the same time, security risks are increasing for applications and development environments. For example, only 5% of respondents in Contrast’s 2021 State of DevSecOps Report report no successful application attacks over 12 months, and 61% saw three or more. More than 7 in 10 organizations (72%) saw business-critical data exposed in at least one attack, and more than 6 in 10 experienced operational disruption and/or brand degradation as a result of these attacks.
One needs to look no further than news headlines over the past year to confirm this trend. Debilitating application attacks on software providers like SolarWinds, Microsoft, Kaseya, and Atlassian have impacted thousands of software customers; these successful breaches, in turn, affected millions of their customers. These attacks on software integrity hit close to home for those using cloud-native approaches to application development.
A PLATFORM APPROACH TO CLOUD-NATIVE SECURITY
Traditional application security tools and processes were designed at a time when software development was more manual, more methodical, more isolated, and significantly slower. These approaches became far less effective as methodologies like Agile and DevOps became more widespread, improving the speed and efficiency of software development exponentially. Cloud-native approaches accelerate software development even more, resulting in the potential for big security gaps and long security-related delays. This ultimately creates longer delivery times and subpar user experiences.
Security for cloud-native environments has been something of an afterthought for many organizations. This is partly because the technology and the cultural change needed to incorporate security into a product’s value stream via cross-functional product teams is more of a recent development in the enterprise landscape. The result is a “tool soup” of disconnected security products based on the specific tech stack associated with the solution (i.e., Kubernetes, vendor-specific Platform-as-a-Service [PaaS], etc.).
And this doesn’t take into account the automation necessary to facilitate the delivery of software across an organization that are known as delivery pipelines. This is another layer that adds even more complexity to security coverage, as these implementations add additional attack vectors which may be exploited by malicious third parties, as happened in the case of the SolarWinds attack.
Taking all this into account, the best approach to secure cloud-native technologies is the same as with all other aspects of application security-a platform approach. DevSecOps platforms provide comprehensive application security across the entire software development life cycle (SDLC), from the beginning of development through production and beyond. This enables full observability from a single source of truth and robust reporting for governance, risk, and compliance policies to ensure that an organization and its products are safe and secure. The rapid adoption of cloud-native technologies and acceleration of software development and delivery create the requirements for a platform approach.
INSTRUMENTATION BRINGS ACCURATE RESULTS AND FASTER REMEDIATION
But an integrated platform does little good if it only uses legacy scanning techniques that require security experts to interpret the reports and pass vulnerability information back to developers-days or weeks later. Security instrumentation is a runtime technique to detect vulnerabilities and detect exploits-which is especially relevant to runtime environments like Kubernetes. Instrumentation leverages sensors embedded in the application code to monitor it continuously as it makes its way through the SDLC. These sensors detect vulnerabilities as they are created-or added to an application via an open-source library or framework. Developers and product teams then receive immediate feedback on how to remediate the vulnerability that was just created-without help from a member of the security team.
When it emulates the runtime behavior of the application, instrumentation can deliver highly accurate results throughout development and into production. It can help organizations focus on vulnerabilities that are actually exploited, rather than generating alerts for every potential threat. This limits the amount of noise teams need to deal with, enabling them to concentrate their resources on delivering value where it matters. Instrumentation that uses route intelligence significantly reduces the vulnerability space that analysts need to address, and virtually eliminates false positives and the staff time wasted dealing with them.
FOLLOWING AN ORGANIZATION’S CLOUD JOURNEY
No matter the nuances of a specific organization’s cloud story, a platform approach that leverages security instrumentation makes each stage of an organization’s cloud journey more secure, mitigating a variety of challenges as deployments evolve and mature.
A platform model provides immediate and continuous visibility into the dependencies between the core application and its open-source components. This enables developers to write more secure code by limiting vulnerabilities from unsecure third-party libraries. Protecting applications during runtime gives coverage for vulnerabilities missed in lower-level environments. This capability gives organizations and teams the flexibility to address and strategize security enhancements without data being exploited.
Instrumentation embeds security testing within the application code, enabling it to be independent of the cloud infrastructure(s) it is housed in. This means that developers, security team members, and CloudOps teams can easily manage and monitor their application security posture across distributed systems from one source of truth. This testing can be deployed throughout the SDLC, fulfilling a cloud customer’s part of the shared responsibility model.
##
To hear more about cloud native topics, join the Cloud Native Computing Foundation and cloud native community at KubeCon+CloudNativeCon North America 2021 – October 11-15, 2021
ABOUT THE AUTHOR
Nikesh Shah Sr. Director, Strategic Alliances, Contrast Security
As Sr. Director of Business Development and Strategic Alliances, Nikesh is responsible for Contrast Security’s alliance strategy and relationships with several cloud providers, devops & security software vendors, and global system integrators. Nikesh has 19 years of enterprise and open-source software industry experience in the following technical domains – analytics, business intelligence, cloud, CRM, data, developer productivity and tooling, IT operations, middleware, platform-as-a-service, and security. He has held various GTM leadership roles with companies such as Atlassian, VMware, IBM, and Oracle. He holds a BS in Business Administration from the Leeds School of Business at the University of Colorado, Boulder and an Executive Management Certificate from the Stanford Graduate School of Business.
