Wednesday, 20th November 2019
Logo

The move to microservices makes for new security challenges

Radware has released its 2019 State of Web Application Security Report. Radware found that while organisations shift their applications to microservices environments, the responsibility for securing these environments shifts as well.

The rapid expansion of the Development Security Operations (DevSecOps) role has changed how companies address their security posture with approximately 70% of survey respondents stating that the CISO was not the top influencer in deciding on security software policy, tools and or implementation. This shift has likely exposed companies to a broader range of security risks and gaps in protection.

In fact, 90% of respondents reported data breaches within the past 12 months, and 53% of respondents believe that cloud data or application data exposures resulted from misunderstandings of security responsibility with their cloud provider.

David Monahan, former Managing Research Director, Security and Risk Management for EMA said, “The current movement to containers and microservices is fundamentally different in its offer for ease of deployment, creating the ability for continuous integrations and continuous development (CICD) and improved application performance. Simultaneously, it brings some intrinsic risks.”

We are at an inflection point culturally between the role of DevSecOps and the CISO,” said Anna Convery-Pelletier, Radware’s Chief Marketing Officer. “Our research shows that respondents— regardless of title— feel that they have control over their security posture. Yet 90% of organisations still experienced lost data. This is a contradiction that speaks to the organisational differences between DevSecOps and traditional IT security roles. While the CISO’s organiaation is faced with responsibility for keeping the organisation secure at all costs, the DevSecOps teams recognise that agility is critical to business operations, and so they are often forced to take a ‘good enough’ approach.”

Move to MicroServices

Organisations are adjusting roles and responsibilities to cope with both the agility and security requirements that accompany these new environments. More than 90% of respondents reported that their organisations have Development Operations (DevOps) or DevSecOps teams. These teams [DevSecOps + DevOps] are relatively new with only 21% of respondents reporting DevSecOps teams in place for longer than 24 months. More than half (58%) of organisations reported a ratio of between 1:6 and 1:10 DevSecOps to development personnel. When evaluating collaboration between DevOps and DevSecOps teams, 49% said the teams were working very closely while 46% said they were managing to work together.

Trust in cloud security providers is falling. In 2018, 86% of respondents said they trusted their cloud providers’ level of security. One year later, that figure has dropped 14 points to 72%.

Application Attacks Prevail

The report shows that application attacks are a constant threat. The breadth of attacks respondents experienced daily included access violations, session/cookie poisoning, SQL injections, denial of service, protocol attacks, cross-site scripting, cross-site request forgery, and API manipulations.

In addition to survey data, the report also includes trends from Radware’s Bot Manager customers’ traffic flow, which identified that 45% of internet traffic comes from bots. The breakdown of bot traffic indicates that 17% of traffic is sourced from ‘good’ bots, and 28% is malicious.

Two thirds (67%) of businesses say that driving collaboration between security and IT ops teams is a...
Upated report on unsecured PACS servers shows problem has escalated in the last 60 days.
Leading industry association project 3.7% industry growth in 2020; identifies 10 trends to watch in...
Neustar research on cyber threats and trends reveals continued increase in small-scale DDoS attacks,...
For modern organisations, digital transformation is increasingly the only game in town. CIOs are tur...
Datrium has released findings from its industry report on the State of Enterprise Data Resiliency an...
CybSafe invites cyber security professionals to contribute to new academic research into the impact...
FireMon has released its 2019 State of the Firewall report, the annual benchmark of current issues i...