La seguridad de la aplicación está cambiando. Como resultado, los equipos de DevOps son cada vez más responsables de la seguridad. Si bien la experiencia de DevOps en los procesos del ciclo de vida del desarrollo les permite introducir eficazmente los requisitos de seguridad en las primeras etapas del ciclo de vida del software, estos equipos pueden no tener los recursos para anticiparse a las amenazas, ni la amplitud de conocimientos suficientes para aplicar las diversas soluciones y políticas de seguridad necesarias para proteger las aplicaciones modernas.
Native cloud security services provide DevOps and business unit developers platform-specific options that work well for many application requirements. However, as organizations increasingly adopt multi-cloud solutions, the costs of these native services begin to outweigh the benefits. Where a few security services sufficed on a single cloud platform, many security services are needed to provide the same protection on two or more cloud platforms. Each platform has their own identity management requirements, security policies, APIs, and managerial procedures, reducing overall efficiency. Increasing operational efficiency and security is a top priority for enterprise digital transformation initiatives and enterprise leadership objectives.
The implementation and management complexity associated with native security services is the first significant source of operational inefficiency. The difficulties associated with managing all of the components of multiple native security services can have serious negative consequences for a business. Security gaps in misconfigurations were exploited in 66% of attacks (either through attackers exploiting a flaw in the web application firewall to access account credentials or attackers taking advantage of a misconfigured resource). DevOps engineers are tasked with identifying the fastest possible time to market. Reducing the overhead associated with maintaining and understanding security policies across multiple cloud providers can allow DevOps teams to better focus their attention and resources on that goal.
El cambio a otro proveedor que pueda implementar una política de seguridad consistente en todas las aplicaciones en un entorno multinube puede reducir significativamente la cantidad de gastos de implementación de seguridad que recae sobre los equipos de DevOps. El uso de este tipo de servicio puede reducir la frecuencia con la que las malas configuraciones de seguridad son empujadas a los entornos de producción. Simplifica la integración de políticas y configuraciones en los conductos de CI/CD proporcionando a los equipos de DevOps un conjunto de herramientas de automatización que pueden utilizarse para la estandarización, lo que a su vez permite integrar los servicios de seguridad en las cadenas de herramientas de automatización empresarial existentes.
Low cloud infrastructure security visibility is another source of reduced operational efficiency that comes with the use of native security services. Although organizations benefit from faster deployment when using native services, 36% of survey respondents admit that these native services do not provide adequate visibility into cloud security infrastructure. While DevOps teams increasingly take on deployment and management for application security, enterprise security oversight, and reporting are still SecOps responsibilities. Distributed and native cloud security services mean that security reporting and analytics will also be distributed and cloud-specific by default. The distributed nature of the analytics obfuscates the security landscape of the system as a whole. As a result, SecOps teams might only be able to give isolated, provider-specific recommendations. Using common security services implemented through a standardized multi-cloud security vendor ensures that the same security policies are shared across all applications. This allows SecOps to make recommendations based from shared security analytics in a way that benefits the entire system.
The need to adopt a multi-cloud security strategy that ensures compliance across different cloud providers is another source of operational inefficiency with native security services. DevOps teams are required to comply with both internal and industry security requirements. Historically, centralized InfoSec teams help establish and audit security controls across applications, particularly in organizations like healthcare and financial services that work with sensitive or protected personal information. With the leftward shift in application security, DevOps is now as responsible for maintaining alignment with enterprise security requirements as SecOps. It is difficult to maintain enterprise security requirements when native security policies are unique to a specific cloud provider, whether that provider is AWS, Azure, or Google Cloud. Audits are also rendered less efficient. Deploying common, multi-cloud security policies reduces the time spent auditing security configurations. The inclusion of visibility solutions can allow an organization to create a one-stop shop that reduces compliance testing complexity and improves cross-team collaboration.
Los cambios en las convenciones de desarrollo de aplicaciones han aumentado las responsabilidades relacionadas con la seguridad que recaen en el ámbito de DevOps. Como resultado, es más preciso referirse a estos equipos como DevSecOps y reconocerlo como parte del modelo operacional de seguridad de SecOps. El uso continuo de políticas de seguridad nativas y específicas del proveedor añade una importante sobrecarga administrativa, eliminando gran parte del beneficio del modelo DevOps. La estandarización en torno a una solución de seguridad empresarial multinube aumenta la eficiencia operativa y crea oportunidades para conectar con nuevos socios estratégicos de seguridad, reduciendo el potencial de pérdida de eficiencia operativa al pasar a un entorno multinube.