Hybrid cloud security preparedness
First let’s talk public cloud adoption
Approximately what percent of your applications run on public cloud infrastructure today?
Approximately what percent of your applications will run on public cloud infrastructure 24 months from now?
How many different public cloud infrastructure providers does your organization use?
1
2
3
4
5+
What are the biggest challenges your organization faces with regards to public cloud infrastructure security? (Check all that apply)
An increase in the threat landscape (i.e., malware volume, sophistication, targeted attacks, etc.)
My organization lacks the right level of security skills/staff
Lack of visibility
An increase in the amount of cloud usage at our organization
Ineffective security tools
Insufficient budget
Difficulty remaining compliant with industry regulations efficiently
Difficulty responding to security incidents and breaches
We don’t have any challenges
Hybrid cloud security preparedness
Next let’s discuss containers
Containerization is an increasingly popular application-level virtualization technology that is accelerating due to increased infrastructure efficiency, application portability, and increased developer empowerment.
Do you operate containerized production applications today?
Yes
No, but we will within the next year
No and we won’t within the next year
Hybrid cloud security preparedness
Next, let’s talk about collaboration
When we discuss cloud-native applications, we mean apps your organization builds from the ground up to run on cloud infrastructure.
When does your cybersecurity team typically get involved with securing your internally-developed applications (whether traditional or cloud-native)?
From the beginning of the software development process
Before we deploy the application to production
When we start to store sensitive data with the application
After a cybersecurity incident
When funding is required to procure cybersecurity products and services
To what extent does your organization plan to shift security “left” and incorporate security processes and controls within the development and build stages of the application lifecycle (i.e., DevSecOps)?
We have shifted security “left” extensively
We have shifted security “left” in a limited fashion
We plan to shift security “left” into development processes
We are evaluating shifting security “left” into development processes
We have not yet discussed how security fits with our development processes
Hybrid cloud security preparedness
What issues have you encountered so far?
When we discuss cloud-native applications, we mean apps your organization builds from the ground up to run on cloud infrastructure.
What cloud-native security challenges worry you most?
Our existing security tools do not support cloud-native environments
Lack of clarity on the shared responsibility security model
Our app development and operations teams do not involve our cybersecurity team enough
Lack of visibility into public cloud
Lack of understanding of the threat model for our cloud-native applications
Maintaining secure configurations based on industry best practices (e.g. CIS benchmarks)
Use of many separate cybersecurity controls increases cost and complexity
Maintaining security consistency across hybrid environments
Lack of staff with skills in cloud-native security
None of these
In the last 12 months has your organization detected any of the following application or service misconfigurations among your internally-developed applications?
Open management ports
Disabled logging leading to the lack of audit trails of account, user, and system activity
Misconfigured security group permitting traffic to/from restricted IP addresses
Lack of multi-factor authentication for access
Virtual machines and/or containers running as root
Externally facing web servers not protected with a firewall and/or load balancer
Overly permissive user accounts
Overly permissive service accounts
Externally facing server workloads
Default or no password for access to management consoles
No issues detected
Hybrid cloud security preparedness
Finally, let’s talk about what’s next for your organization
Assessment and benchmark
research powered by ESG
ESG, a division of TechTarget, is an IT analyst, research, validation, and strategy firm that provides market intelligence and actionable insight to the global IT community.
© 2021 TECHTARGET, INC. ESG, A DIVISION OF TECHTARGET, SUITE 1-150, 275 GROVE STREET, NEWTON, MA 02466 | 508.482.0188