Shift in key security decision-makers creates risks as firms migrate to microservices

Radware, the provider of cyber security and application delivery solutions, has released its 2019 State of Web Application Security Report which finds that, while organisations shift their applications to microservices environments, the responsibility for securing these environments shifts as well.

The rapid expansion of the Development Security Operations (DevSecOps) role has changed the way in which companies address their security posture with approximately 70% of survey* respondents stating that the CISO was not the top influencer in deciding on security software policy, tools and or implementation. This shift has likely exposed companies to a broader range of security risks and gaps in protection.

In fact, 90% of respondents reported data breaches within the past 12 months, while 53% of respondents in the study believe that cloud data or application data exposures resulted from misunderstandings of security responsibility with their cloud provider.

Senior information security executive David Monahan said: “The current movement to containers and microservices is fundamentally different in its offer for ease of deployment, creating the ability for continuous integrations and continuous development as well as improved application performance. Simultaneously, though, the move brings with it some intrinsic risks.”

Anna Convery-Pelletier, Radware’s chief marketing officer, added: “We’re at an inflection point culturally between the role of DevSecOps and the CISO. Our research shows that respondents, regardless of their title, feel that they have control over their security posture. Yet 90% of organisations still experienced lost data. This is a contradiction that speaks to the organisational differences between DevSecOps and traditional IT security roles. While the CISO’s organisation is faced with responsibility for keeping the organisation secure at all costs, the DevSecOps teams recognise that agility is critical to business operations. That being the case, they’re often forced to take a ‘good enough’ approach.”

Move to microservices

Organisations are adjusting roles and responsibilities to cope with both the agility and security requirements that accompany these new environments. More than 90% of respondents reported that their organisations have Development Operations (DevOps) or DevSecOps teams. These teams (ie DevSecOps and DevOps) are relatively new with only 21% of respondents reporting DevSecOps teams in place for longer than 24 months. More than half (58%) of organisations reported a ratio of between 1:6 and 1:10 DevSecOps to development personnel. When evaluating collaboration between DevOps and DevSecOps teams, 49% said the teams were working very closely, while 46% stated that they were managing to work together.

Trust in cloud security providers is falling. In 2018, 86% of respondents said they trusted their cloud providers’ level of security. One year later, that figure has dropped 14 points to 72%.

The report also shows that application attacks are a constant threat. The breadth of attacks respondents experienced daily included access violations, session/cookie poisoning, SQL injections, Denial of Service, protocol attacks, cross-site scripting, cross-site request forgery and API manipulations.

In addition to survey data, the report also includes trends from Radware’s Bot Manager customers’ traffic flow, which identified that 45% of Internet traffic comes from bots. The breakdown of bot traffic indicates that 17% of traffic is sourced from ‘good’ bots and 28% is malicious.

*Read the Radware State of Web Application Security Report in full here

**On behalf of Radware, Enterprise Management Associates conducted a global online survey in July that collected 278 responses from executives and senior IT professionals at companies with at least 250 million USD/EUR/GBP in revenue and a worldwide scope. About one-third of respondents hold an executive-level position (29%), another third of respondents are in senior management (27%) and a third are managers (32%). The remaining respondents were mostly individual contributors (10%). A variety of industries are represented in the survey, with the largest industry segments being technology products and financial services

About the Author
Brian Sims BA (Hons) Hon FSyI, Editor, Risk UK (Pro-Activ Publications) Beginning his career in professional journalism at The Builder Group in March 1992, Brian was appointed Editor of Security Management Today in November 2000 having spent eight years in engineering journalism across two titles: Building Services Journal and Light & Lighting. In 2005, Brian received the BSIA Chairman’s Award for Promoting The Security Industry and, a year later, the Skills for Security Special Award for an Outstanding Contribution to the Security Business Sector. In 2008, Brian was The Security Institute’s nomination for the Association of Security Consultants’ highly prestigious Imbert Prize and, in 2013, was a nominated finalist for the Institute's George van Schalkwyk Award. An Honorary Fellow of The Security Institute, Brian serves as a Judge for the BSIA’s Security Personnel of the Year Awards and the Securitas Good Customer Award. Between 2008 and 2014, Brian pioneered the use of digital media across the security sector, including webinars and Audio Shows. Brian’s actively involved in 50-plus security groups on LinkedIn and hosts the popular Risk UK Twitter site. Brian is a frequent speaker on the conference circuit. He has organised and chaired conference programmes for both IFSEC International and ASIS International and has been published in the national media. Brian was appointed Editor of Risk UK at Pro-Activ Publications in July 2014 and as Editor of The Paper (Pro-Activ Publications' dedicated business newspaper for security professionals) in September 2015. Brian was appointed Editor of Risk Xtra at Pro-Activ Publications in May 2018.

Related Posts