Mitigating Architectural Risk

As organizations migrate and extend their applications to cloud-native infrastructures, they are introducing risk. According to F5’s State of Application Strategy Report, 88% of organizations continue to manage a mix of modern and legacy applications. The reality is that many enterprises have an application catalog that spans generations of architectures. To secure these legacy and modern apps across hybrid and multi-cloud environments, organizations constantly deploy and tune numerous security controls. Since applications are only as secure as the infrastructure on which they run, security needs to be extended across the entire architectural stack, from apps and APIs to the underlying cloud-native infrastructure.

Traditional security controls are not designed to protect dynamic and highly distributed architectures. Organizations lack the visibility and control to identify a variety of security threats that may surface from a single coordinated attack campaign. Businesses look to their cloud infrastructure providers to close the gap, but different cloud providers have varying responsibility models, security postures, and cloud-native tools. Furthermore, moving apps to the cloud does not remove risks and may not even reduce complexity. In reality, the risk surface for a heterogenous environment that spans the data center and multiple cloud providers will most likely expand as cloud-native infrastructure often lacks sufficient observability and security—creating significant blind spots and opportunities for attackers that can lead to downtime, outage, and security incidents due to inconsistent security postures.

Inevitably, vulnerability exploits will continue as bad actors innovate their attack arsenals and playbooks. The expansive threat surface cannot be completely mitigated with a single tool, even a web application firewall (WAF). Complex software supply chains, open-source software proliferation, and automation via CI/CD pipelines will introduce unforeseen risk, making early detection and remediation critical for effectively protecting web apps and APIs.

For example, the infamous log4j2 vulnerability can be exploited in a variety of ways, making remediation difficult, especially when potential exposure spans components across multiple clouds. In order to improve speed to remediation, indicators of vulnerability and integration between the front door (apps), windows (APIs), and foundation (infrastructure) of the digital house is required. Expanding web app and API protection (WAAP) to secure cloud-native infrastructure and workloads helps to contain threats by detecting vulnerable components and potentially malicious behavior in real time—delivering critical insights to security controls such as a WAF—where policy can be updated to protect critical application services. The log4j2 vulnerability serves as a warning to security leaders about the risk of untenable complexity and the devastating exploits yet to come, but it is also an opportunity for organizations to revisit their security postures and employ a comprehensive security strategy that includes robust infrastructure protection.

Successfully operating and securing applications as they are modernized requires comprehensive observability across the entire architecture, which is increasingly decentralized and distributed, for a comprehensive view of threats at both the application level and infrastructure level.