Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/26/2019
05:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cloud-Native Applications: Shift to Serverless is Underway

A new report explores changes in cloud-native applications and complexities involved with securing them.

As businesses transition to technology as a service, production workloads will continue moving to public cloud platforms and server types are expected to shift from virtual machines (VMs) and bare metal to containers and serverless platforms. The growing complexity is expected to complicate security.

Enterprise Strategy Group (ESG) analysts polled 371 IT and security professionals in the United States and Canada to create "Security for DevOps – Enterprise Survey Report," published today. All come from businesses mature in their use of public cloud services and containers, and all were responsible for evaluating, buying, and managing cloud security products and services.

Cloud-native applications are, and will continue to be, made up of heterogeneous microservices deployed across hybrid clouds, the report states. But while most organizations' current server types lean toward VMs and bare metal, their choices are predicted to shift to containers and serverless platforms within the next two years, researchers report.

When ESG conducted a similar study in 2017, it didn't ask about serverless functions "because it was just too early," says Doug Cahill, ESG senior analyst and group practice director for cybersecurity. This year, researchers found 34% of respondents use serverless "extensively," 18% use serverless on a limited basis, 16% plan to start using serverless within the next 12–24 months, and 28% are currently evaluating serverless. Only 3% don't have plans to use it.

"Organizations already deploying cloud-native applications are starting to strongly adopt serverless function calls," Cahill explains. "We also asked about the use of application containers, and that adoption has continued to grow over the last few years." The drivers for serverless function adoption include improved security (73%), network-based tech to secure against attacks (66%), security functionality embedded in source code containing serverless function calls (64%), and faster time-to-market when developing new applications (57%).

There are security concerns. API vulnerabilities (32%) are the top worry when considering serverless functions, followed by "exposure of secrets" (26%), API calls that result in unencrypted data transfer (22%), escalated privileges (11%), and use of unapproved APIs (9%).

While he is surprised so many businesses are using serverless, Cahill is not surprised at the overall mix of server types used in production. There is "still a really heterogeneous mix," he points out: 35% of respondents plan to use a mix of VMs, containers, and/or serverless.

The problem is, this mix of technologies compounds cloud security challenges. Cloud-native applications make it harder to protect hybrid and multicloud environments, researchers say.

Consistency is the biggest challenge. Forty-three percent of respondents are worried about maintaining consistency across their data centers and public cloud environments where cloud-native applications are deployed. Many believe existing security tools don't support cloud-native applications, so businesses often use multiple point tools managed by separate teams.

Nearly three-quarters (73%) of respondents say their organization uses too many specialized tools to secure cloud-native applications. This drives cost and complexity as organizations typically assign separate teams to use separate controls for separate environments.

"I think what we'll see is the convergence of cloud security point tools over time … and also the convergence of API security tools," notes Cahill. He hypothesizes there could be a single API security product to provide coverage across a range of programming languages and APIs.

Securing DevOps: A Shift in Mindset
DevSecOps is emerging as the primary means of protecting cloud-native applications. More than half (55%) of respondents have incorporated security into DevOps, and 22% plan to do so. Twenty percent are evaluating security use cases that can be built into the DevOps process.

However, only 8% of organizations are currently securing 75% or more of their cloud-native applications using DevSecOps practices. Researchers anticipate that number will grow to hit 68% within two years as DevOps teams create repeatable and scalable DevOps integrations. As more applications are secured with this methodology, the need for automation will increase.

Cahill points to a need to rethink the people, process, and technology behind development in order for this to work. With respect to the first two, "we need organizational alignment on making security share responsibility across all members of a product chain," he explains. While security has traditionally been "bolted on" toward the end of development, "it's really hard to bolt on security when you're doing continuous integration and continuous delivery (CI/CD)."

The two groups are historically different. DevOps is all about speed; security all about caution. DevOps thinks security will slow progress; security thinks DevOps is "running with scissors."

If you can integrate security with tools for CI/CD, Cahill says, you can securely move at the speed of DevOps. The move to include security in development is slow: While 52% of businesses involve the security team in protecting cloud-native apps before they push to production, many do so reactively: after an incident, for funding, or due to concerns around data stored in the cloud. One-third include security from the start of the development process.

In addition to involving security with the product team, Cahill points to another people-related challenge: ensuring both sides, but especially security, understand the attack types and methods adversaries are using. "What is different about apps that make them susceptible to threats?" he says. Once security professionals understand the points of vulnerability in APIs and serverless functions, they can better work with the dev team to secure them, he explains.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Why Clouds Keep Leaking Data."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprise
Assessing Cybersecurity Risk in Today's Enterprise
Security leaders are struggling to understand their organizations risk exposure. While many are confident in their security strategies and processes, theyre also more concerned than ever about getting breached. Download this report today and get insights on how today's enterprises assess and perceive the risks they face in 2019!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18862
PUBLISHED: 2019-11-11
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
CVE-2019-18853
PUBLISHED: 2019-11-11
ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.
CVE-2019-18854
PUBLISHED: 2019-11-11
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
CVE-2019-18855
PUBLISHED: 2019-11-11
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
CVE-2019-18856
PUBLISHED: 2019-11-11
A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled.