IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Most CISOs worry cloud software flaws aren’t being caught

Traditional application security measures are broken

Around three-quarters (71%) of CISOs doubt that their code in the cloud is free from flaws before going into production, new research has found.

According to a worldwide survey of CISOs in large enterprises with over 1,000 employees, 89% of CISOs said microservices, containers, and Kubernetes have caused application security blind spots. The survey also found 97% of organizations don't have real-time visibility into runtime vulnerabilities in containerized production environments.

Pressures to make code live and not having the right tools and processes to ensure code is vulnerability-free for cloud-native apps have worsened these issues.

Over two-thirds of CISOs (68%) said the volume of alerts makes it very difficult to prioritize vulnerabilities based on risk and impact. On average, security teams need to react to 2,169 new alerts, but only 42% of potential application security vulnerabilities each month need action, as the rest are false positives.

Over one-in-four CISOs (28%) said application development teams sometimes bypass vulnerability scans to speed up delivery. Another three-quarters (74%) said traditional security controls, such as vulnerability scanners, are no longer fit for purpose in today's cloud-native world.

Bernd Greifeneder, founder and chief technology officer at Dynatrace, said the increased use of cloud-native architectures has "fundamentally broken traditional approaches to application security."

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

"This research confirms what we've long anticipated: manual vulnerability scans and impact assessments are no longer able to keep up with the pace of change in today's dynamic cloud environments and rapid innovation cycles," Greifeneder said.

"Risk assessment has become nearly impossible due to the growing number of internal and external service dependencies, runtime dynamics, continuous delivery, and polyglot software development, which uses an ever-growing number of third-party technologies. Already stretched teams are forced to choose between speed and security, exposing their organizations to unnecessary risk."

Over three-quarters of CISOs (77%) said the only way for security to keep up with modern cloud-native application environments is to replace manual deployment, configuration, and management with automated approaches.

"As organizations embrace DevSecOps, they also need to give their teams solutions that offer automatic, continuous, and real-time risk and impact analysis for every vulnerability, across both pre-production and production environments, and not based on point-in-time 'snapshots'," said Greifeneder. 

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Delivering a hybrid cloud architecture
Whitepaper

Delivering a hybrid cloud architecture

27 Jun 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022

Most Popular

Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022