Most CISOs worry cloud software flaws aren’t being caught

Traditional application security measures are broken

Around three-quarters (71%) of CISOs doubt that their code in the cloud is free from flaws before going into production, new research has found.

According to a worldwide survey of CISOs in large enterprises with over 1,000 employees, 89% of CISOs said microservices, containers, and Kubernetes have caused application security blind spots. The survey also found 97% of organizations don't have real-time visibility into runtime vulnerabilities in containerized production environments.

Pressures to make code live and not having the right tools and processes to ensure code is vulnerability-free for cloud-native apps have worsened these issues.

Over two-thirds of CISOs (68%) said the volume of alerts makes it very difficult to prioritize vulnerabilities based on risk and impact. On average, security teams need to react to 2,169 new alerts, but only 42% of potential application security vulnerabilities each month need action, as the rest are false positives.

Over one-in-four CISOs (28%) said application development teams sometimes bypass vulnerability scans to speed up delivery. Another three-quarters (74%) said traditional security controls, such as vulnerability scanners, are no longer fit for purpose in today's cloud-native world.

Bernd Greifeneder, founder and chief technology officer at Dynatrace, said the increased use of cloud-native architectures has "fundamentally broken traditional approaches to application security."

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeWatch now

"This research confirms what we've long anticipated: manual vulnerability scans and impact assessments are no longer able to keep up with the pace of change in today's dynamic cloud environments and rapid innovation cycles," Greifeneder said.

"Risk assessment has become nearly impossible due to the growing number of internal and external service dependencies, runtime dynamics, continuous delivery, and polyglot software development, which uses an ever-growing number of third-party technologies. Already stretched teams are forced to choose between speed and security, exposing their organizations to unnecessary risk."

Over three-quarters of CISOs (77%) said the only way for security to keep up with modern cloud-native application environments is to replace manual deployment, configuration, and management with automated approaches.

"As organizations embrace DevSecOps, they also need to give their teams solutions that offer automatic, continuous, and real-time risk and impact analysis for every vulnerability, across both pre-production and production environments, and not based on point-in-time 'snapshots'," said Greifeneder. 

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021
Microsoft brings passwordless security to consumer accounts
Microsoft Windows

Microsoft brings passwordless security to consumer accounts

16 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Apple patches zero-day flaw abused by infamous NSO exploit
exploits

Apple patches zero-day flaw abused by infamous NSO exploit

14 Sep 2021
Hackers develop Linux port of Cobalt Strike for new attacks
Security

Hackers develop Linux port of Cobalt Strike for new attacks

14 Sep 2021