Companies struggle to deploy security for custom applications

As more and more companies migrate their application workloads from their datacenters to infrastructure-as-a-service (IaaS) platforms such as the Amazon Web Services (AWS) Cloud, Microsoft Azure and Google Cloud Platform, IT pros are worried about the security of the apps, company data, and their jobs.

It doesn’t help that while almost 50 percent of custom applications are in the public or hybrid cloud today, companies’ IT security professionals are only aware of 38.4 percent of them, according to a recent report by Skyhigh Networks, unveiled at RSA Conference 2017.

Based on a broad survey of software development, IT administration, IT security, operations and devops professionals across the Americas, EMEA and Asia Pacific, the report also revealed that:

• Every company is a software company. Every company has developers writing custom code to improve engagement with employees, partners and customers. The average enterprise runs 464 custom applications and expects the number to grow 20.5 percent in the next 12 months. Yet IT security is aware of only 38.4 percent – a new and rapidly growing area of shadow computing. The stakes are high for preventing security compromises: 72.7 percent of companies have a custom application that, if it were to experience downtime, would significantly impact the organisation’s ability to operate.
• At the brink of the cloud tipping point. Cloud adoption is accelerating with the growth of software-as-a-service (SaaS) running at 10x the growth rate of IT in general and the growth rate of IaaS at 20x that of IT in general. In 2017, IaaS adoption will reach a tipping point because for the first time more custom applications will reside in public IaaS platforms than in corporate datacenters. Slightly more than half – 60.9 percent – of custom applications remain in corporate datacenters today, and this number is expected to decline to 46.2 percent in the next 12 months as enterprises continue to migrate applications to public IaaS platforms. The two top reasons for moving to the cloud are scale and cost, and a majority (62.9 percent) of respondents believe public IaaS platforms are just as or more secure than their own datacenters.
• Apps vulnerable in the IaaS wilderness. Despite growing acceptance of public IaaS platforms, IT security departments face a host of new threats and challenges in the move to the cloud. Under cloud’s shared responsibility model, IaaS platforms secure the infrastructure but the enterprise is accountable for securing the corporate data, which includes protecting against compromised login credentials, rogue administrators and regulatory violations. These challenges are made more urgent by the fact that 46 percent of business-critical custom applications are already in the public or hybrid cloud today and by the rapidly approaching deadline for complying with the EU General Data Protection Regulation (GDPR).
• C-Suite jobs on the line. Companies currently lack the expertise and tools to effectively deploy security for custom applications; 64.0 percent of respondents are moderately or very concerned about the security of custom applications deployed on a public IaaS platform. Recent high-profile cyber attacks have illustrated that corporate boards ultimately hold c-level executives responsible, and 29.1 percent of respondents believe the CIO and the CISO would lose their jobs in a catastrophic attack on a custom application. Over half, 50.3 percent, believe the IT security manager responsible for the application would be fired. Application developers are considered the least likely to face termination and only 23.3 are concerned about application security, signaling that IT security must take the initiative for custom application and IaaS security.

“While public cloud is usually more secure than the corporate datacentre for physical, patch and uptime security, the responsibility for higher-function security is still with the app developer and often being overlooked,” said Nigel Hawthorn, Skyhigh’s chief European spokesperson.

“Securing sensitive data in the cloud is no longer the remit of one party, it’s a shared responsibility. The rapid adoption of IaaS deployments sees the role split between infrastructure providers and enterprises, while internally, businesses cannot expect IT to manage cloud security alone. There needs to be buy-in from all departments to ensure custom applications have cybersecurity imbedded from the start, and that employees continue to use them in ways that won’t put corporate data at risk.”

“The results of this survey provide an unfiltered view into the challenges companies and their IT security leadership are facing because of the exponential growth in cloud usage,” said Jim Reavis, CEO, Cloud Security Alliance. “From custom applications to the infrastructure to the teams tasked with managing it all, we’re seeing a major evolution in how security needs to be more a focal point when it comes to planning for the increasingly complex needs of business.”