Most CISOs worry cloud software flaws aren’t being caught

Traditional application security measures are broken

Around three-quarters (71%) of CISOs doubt that their code in the cloud is free from flaws before going into production, new research has found.

According to a worldwide survey of CISOs in large enterprises with over 1,000 employees, 89% of CISOs said microservices, containers, and Kubernetes have caused application security blind spots. The survey also found 97% of organizations don't have real-time visibility into runtime vulnerabilities in containerized production environments.

Pressures to make code live and not having the right tools and processes to ensure code is vulnerability-free for cloud-native apps have worsened these issues.

Over two-thirds of CISOs (68%) said the volume of alerts makes it very difficult to prioritize vulnerabilities based on risk and impact. On average, security teams need to react to 2,169 new alerts, but only 42% of potential application security vulnerabilities each month need action, as the rest are false positives.

Over one-in-four CISOs (28%) said application development teams sometimes bypass vulnerability scans to speed up delivery. Another three-quarters (74%) said traditional security controls, such as vulnerability scanners, are no longer fit for purpose in today's cloud-native world.

Bernd Greifeneder, founder and chief technology officer at Dynatrace, said the increased use of cloud-native architectures has "fundamentally broken traditional approaches to application security."

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

"This research confirms what we've long anticipated: manual vulnerability scans and impact assessments are no longer able to keep up with the pace of change in today's dynamic cloud environments and rapid innovation cycles," Greifeneder said.

"Risk assessment has become nearly impossible due to the growing number of internal and external service dependencies, runtime dynamics, continuous delivery, and polyglot software development, which uses an ever-growing number of third-party technologies. Already stretched teams are forced to choose between speed and security, exposing their organizations to unnecessary risk."

Over three-quarters of CISOs (77%) said the only way for security to keep up with modern cloud-native application environments is to replace manual deployment, configuration, and management with automated approaches.

"As organizations embrace DevSecOps, they also need to give their teams solutions that offer automatic, continuous, and real-time risk and impact analysis for every vulnerability, across both pre-production and production environments, and not based on point-in-time 'snapshots'," said Greifeneder. 

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
It’s time to bring Spotify Wrapped to the workplace
Data & insights

It’s time to bring Spotify Wrapped to the workplace

14 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021
Five things to consider before choosing an MFA solution
Security

Five things to consider before choosing an MFA solution

17 Dec 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022