TECHNOLOGY

3 big takeaways from the Snyk State of Cloud Security 2022 Report

Published

1 year ago

October 25, 2022

3 big takeaways from the Snyk State of Cloud Security 2022 Report

Cloud computing has created a bigger shift in the IT industry during the last 20 years than any other factor. With cloud technology, companies can build, deploy, and scale their applications faster than ever. However, cloud customers have been suffering a wide range of security events within the past year, with data breaches, data leaks, and intrusions into their environments among the most serious.

Snyk recently surveyed more than 400 cloud engineering and security professionals and leaders across various organisation types and industries. Created in partnership with Propeller Insights, the findings are summarised in the Snyk State of Cloud Security 2022 report. The report takes a deep dive into the risks and challenges they face, and where they’re successfully addressing those risks.

According to the State of Cloud Security 2022 Report, 80% of organisations suffered a serious incident within the last year, and 33% suffered a cloud data breach.The shift to developers building and running apps natively in the cloud is changing cloud security, according to insights. In the resulting report, Snyk’s cloud security researchers combined their analysis of the survey data with observations from their own experience. Here are the three big takeaways.

Cloud native applications cases bring new security challenges — and opportunities

The predominant cloud use case has been as a platform for hosting third-party applications or applications migrated out of their data centers. A quarter of Snyk’s survey respondents indicated that the primary use for cloud environments is developing and running applications natively in the cloud.

Teams using the cloud as a platform have produced a number of innovations, including Infrastructure as Code (IaC), the coding process developers use to build and manage cloud infrastructure alongside their applications.

Additionally, developers leveraging the cloud are making increasing use of cloud native approaches, such as containers and serverless “functions as a service” architectures.

These changes have implications for security. 41% of teams adopting cloud native approaches confirmed that doing so has increased their security complexity. Cloud native approaches also require teams to add additional security expertise and introduce additional security training. Cloud native also necessitates the adoption of new security tooling and methodologies, such as a “Shift Left” approach.

1666732526 56 3 big takeaways from the Snyk State of Cloud Security

But while building and running applications in the cloud brings new security challenges, teams using this approach are experiencing fewer serious security incidents. The next two big takeaways from the report help explain why.

Developers are taking ownership of cloud security

Who owns cloud security? Depending on who you ask, you’re likely to get a different answer. While IT owns cloud security in roughly half of all organisations, 42% of cloud engineers say that their team is primarily responsible for cloud security. However, only 19% of security professionals agree that engineering teams are doing that work.

This may be explained by the fact that cloud engineers are investing significant time and effort into cloud security tasks, and they’re often looking for ways to automate and streamline these processes. The adoption of infrastructure as code for deploying and managing cloud environments provides engineers with the opportunity to find and fix issues in development rather than post-deployment, when remediations require more time and resources.

Developers control the cloud computing infrastructure itself because the cloud is fully software-defined. When they build applications in the cloud, they’re also building the infrastructure for applications instead of buying a pile of infrastructure and adding apps. That is a coding process using Infrastructure as Code (IaC), and developers own that process.

Infrastructure as code security delivers a big ROI

IaC security is a huge win — not just for reducing the rate of misconfiguration, but for improving engineering team productivity and speed of deployments. Inefficient cloud security processes often become the rate-limiting factor for how fast teams can go in the cloud, and IaC security delivers significant improvements in speed and productivity.

The median reduction in the rate of misconfiguration in running cloud environments resulting from IaC security pre-deployment is 70%. While IaC security can’t prevent all runtime misconfigurations, a 70% drop is significant, and can lower the risk for organisations substantially.

That decrease in the number of misconfigurations also has a direct impact on cloud engineering productivity. Because these teams can reduce the amount of time they need to invest in managing and remediating problems, they can spend more time building and adding value to the organisation.

What effective cloud security teams are doing

A clear majority of cloud security and engineering professionals believe that the risk of a cloud data breach at their organisation will increase over the next year, with only 20% expecting risks to decrease.

Effective cloud security requires preventing misconfigurations and architectural design vulnerabilities that make cloud attacks possible. Success requires focusing on these five fundamental areas:

Know your environment. Maintain awareness of the configuration state of your cloud environment in full context with the applications it runs and the SDLC used to develop, deploy, and manage it.

Focus on prevention and secure design. Prevent the conditions that make cloud breaches possible, including resource misconfigurations and architectural design flaws. You can’t rely on the ability to detect and prevent attacks in progress.

Empower cloud developers to build and operate securely. When engineers develop secure infrastructure as code, they can avoid time-consuming remediations and rework later, while delivering secure infrastructure faster.

Align and automate with policy as code (PaC): If your security policies are expressed only in human language, they might as well not exist at all. With PaC, you can express policies in a language other programs can use to validate correctness, and you’ll align all stakeholders to operate under a single source of trust on security policy.

Measure what matters: identify what matters the most, be it reducing the rate of misconfiguration, speeding up approval processes, or improving team productivity. Security teams should establish security baselines, set goals, measure progress, and be ready to demonstrate the security of their cloud environment at any time.

Following these five steps enables security and engineering teams to work together to operationalise cloud security, which reduces risk, accelerates innovation, and improves team productivity.

Related Topics:Big Cloud Report Security Snyk State Takeaways

Up Next

Benefits of Web 3.0 in Business Models

Don't Miss

why expired machine identities represent a growing business risk

Click to comment

You must be logged in to post a comment Login

TECHNOLOGY

Next-gen chips, Amazon Q, and speedy S3

Published

5 months ago

December 1, 2023

Max

AWS re:Invent, which has been taking place from November 27 and runs to December 1, has had its usual plethora of announcements: a total of 21 at time of print.

Perhaps not surprisingly, given the huge potential impact of generative AI – ChatGPT officially turns one year old today – a lot of focus has been on the AI side for AWS’ announcements, including a major partnership inked with NVIDIA across infrastructure, software, and services.

Yet there has been plenty more announced at the Las Vegas jamboree besides. Here, CloudTech rounds up the best of the rest:

Next-generation chips

This was the other major AI-focused announcement at re:Invent: the launch of two new chips, AWS Graviton4 and AWS Trainium2, for training and running AI and machine learning (ML) models, among other customer workloads. Graviton4 shapes up against its predecessor with 30% better compute performance, 50% more cores and 75% more memory bandwidth, while Trainium2 delivers up to four times faster training than before and will be able to be deployed in EC2 UltraClusters of up to 100,000 chips.

The EC2 UltraClusters are designed to ‘deliver the highest performance, most energy efficient AI model training infrastructure in the cloud’, as AWS puts it. With it, customers will be able to train large language models in ‘a fraction of the time’, as well as double energy efficiency.

As ever, AWS offers customers who are already utilising these tools. Databricks, Epic and SAP are among the companies cited as using the new AWS-designed chips.

Zero-ETL integrations

AWS announced new Amazon Aurora PostgreSQL, Amazon DynamoDB, and Amazon Relational Database Services (Amazon RDS) for MySQL integrations with Amazon Redshift, AWS’ cloud data warehouse. The zero-ETL integrations – eliminating the need to build ETL (extract, transform, load) data pipelines – make it easier to connect and analyse transactional data across various relational and non-relational databases in Amazon Redshift.

A simple example of how zero-ETL functions can be seen is in a hypothetical company which stores transactional data – time of transaction, items bought, where the transaction occurred – in a relational database, but use another analytics tool to analyse data in a non-relational database. To connect it all up, companies would previously have to construct ETL data pipelines which are a time and money sink.

The latest integrations “build on AWS’s zero-ETL foundation… so customers can quickly and easily connect all of their data, no matter where it lives,” the company said.

Amazon S3 Express One Zone

AWS announced the general availability of Amazon S3 Express One Zone, a new storage class purpose-built for customers’ most frequently-accessed data. Data access speed is up to 10 times faster and request costs up to 50% lower than standard S3. Companies can also opt to collocate their Amazon S3 Express One Zone data in the same availability zone as their compute resources.

Companies and partners who are using Amazon S3 Express One Zone include ChaosSearch, Cloudera, and Pinterest.

Amazon Q

A new product, and an interesting pivot, again with generative AI at its core. Amazon Q was announced as a ‘new type of generative AI-powered assistant’ which can be tailored to a customer’s business. “Customers can get fast, relevant answers to pressing questions, generate content, and take actions – all informed by a customer’s information repositories, code, and enterprise systems,” AWS added. The service also can assist companies building on AWS, as well as companies using AWS applications for business intelligence, contact centres, and supply chain management.

Customers cited as early adopters include Accenture, BMW and Wunderkind.

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. Explore other upcoming enterprise technology events and webinars powered by TechForge here.

TECHNOLOGY

HCLTech and Cisco create collaborative hybrid workplaces

Published

5 months ago

November 29, 2023

Max

Digital comms specialist Cisco and global tech firm HCLTech have teamed up to launch Meeting-Rooms-as-a-Service (MRaaS).

Available on a subscription model, this solution modernises legacy meeting rooms and enables users to join meetings from any meeting solution provider using Webex devices.

The MRaaS solution helps enterprises simplify the design, implementation and maintenance of integrated meeting rooms, enabling seamless collaboration for their globally distributed hybrid workforces.

Rakshit Ghura, senior VP and Global head of digital workplace services, HCLTech, said: “MRaaS combines our consulting and managed services expertise with Cisco’s proficiency in Webex devices to change the way employees conceptualise, organise and interact in a collaborative environment for a modern hybrid work model.

“The common vision of our partnership is to elevate the collaboration experience at work and drive productivity through modern meeting rooms.”

Alexandra Zagury, VP of partner managed and as-a-Service Sales at Cisco, said: “Our partnership with HCLTech helps our clients transform their offices through cost-effective managed services that support the ongoing evolution of workspaces.

“As we reimagine the modern office, we are making it easier to support collaboration and productivity among workers, whether they are in the office or elsewhere.”

Cisco’s Webex collaboration devices harness the power of artificial intelligence to offer intuitive, seamless collaboration experiences, enabling meeting rooms with smart features such as meeting zones, intelligent people framing, optimised attendee audio and background noise removal, among others.

Tags: Cisco, collaboration, HCLTech, Hybrid, meetings

TECHNOLOGY

Canonical releases low-touch private cloud MicroCloud

Published

5 months ago

November 28, 2023

Max

Canonical has announced the general availability of MicroCloud, a low-touch, open source cloud solution. MicroCloud is part of Canonical’s growing cloud infrastructure portfolio.

It is purpose-built for scalable clusters and edge deployments for all types of enterprises. It is designed with simplicity, security and automation in mind, minimising the time and effort to both deploy and maintain it. Conveniently, enterprise support for MicroCloud is offered as part of Canonical’s Ubuntu Pro subscription, with several support tiers available, and priced per node.

MicroClouds are optimised for repeatable and reliable remote deployments. A single command initiates the orchestration and clustering of various components with minimal involvement by the user, resulting in a fully functional cloud within minutes. This simplified deployment process significantly reduces the barrier to entry, putting a production-grade cloud at everyone’s fingertips.

Juan Manuel Ventura, head of architectures & technologies at Spindox, said: “Cloud computing is not only about technology, it’s the beating heart of any modern industrial transformation, driving agility and innovation. Our mission is to provide our customers with the most effective ways to innovate and bring value; having a complexity-free cloud infrastructure is one important piece of that puzzle. With MicroCloud, the focus shifts away from struggling with cloud operations to solving real business challenges” says

In addition to seamless deployment, MicroCloud prioritises security and ease of maintenance. All MicroCloud components are built with strict confinement for increased security, with over-the-air transactional updates that preserve data and roll back on errors automatically. Upgrades to newer versions are handled automatically and without downtime, with the mechanisms to hold or schedule them as needed.

With this approach, MicroCloud caters to both on-premise clouds but also edge deployments at remote locations, allowing organisations to use the same infrastructure primitives and services wherever they are needed. It is suitable for business-in-branch office locations or industrial use inside a factory, as well as distributed locations where the focus is on replicability and unattended operations.

Cedric Gegout, VP of product at Canonical, said: “As data becomes more distributed, the infrastructure has to follow. Cloud computing is now distributed, spanning across data centres, far and near edge computing appliances. MicroCloud is our answer to that.

“By packaging known infrastructure primitives in a portable and unattended way, we are delivering a simpler, more prescriptive cloud experience that makes zero-ops a reality for many Industries.“

MicroCloud’s lightweight architecture makes it usable on both commodity and high-end hardware, with several ways to further reduce its footprint depending on your workload needs. In addition to the standard Ubuntu Server or Desktop, MicroClouds can be run on Ubuntu Core – a lightweight OS optimised for the edge. With Ubuntu Core, MicroClouds are a perfect solution for far-edge locations with limited computing capabilities. Users can choose to run their workloads using Kubernetes or via system containers. System containers based on LXD behave similarly to traditional VMs but consume fewer resources while providing bare-metal performance.

Coupled with Canonical’s Ubuntu Pro + Support subscription, MicroCloud users can benefit from an enterprise-grade open source cloud solution that is fully supported and with better economics. An Ubuntu Pro subscription offers security maintenance for the broadest collection of open-source software available from a single vendor today. It covers over 30k packages with a consistent security maintenance commitment, and additional features such as kernel livepatch, systems management at scale, certified compliance and hardening profiles enabling easy adoption for enterprises. With per-node pricing and no hidden fees, customers can rest assured that their environment is secure and supported without the expensive price tag typically associated with cloud solutions.

Tags: automation, Canonical, MicroCloud, private cloud