devopsy.kinsta.cloud

Tag: Barracuda Networks

  • Barracuda Networks Survey: DevSecOps Is Hard

    Barracuda Networks Survey: DevSecOps Is Hard

    Organizations that have adopted DevSecOps processes may be making progress when it comes to improving cybersecurity, but it’s far from easy. A survey of 618 IT decision-makers conducted by Dimensional Research on behalf of Barracuda Networks, a provider of IT security software and appliances, finds half have adopted either DevOps, DevSecOps or a continuous integration/continuous development (CI/CD) platform. A full 93 percent of those IT decision-makers said they faced challenges integrating security into those practices.

    Top challenges cited include: Existing security technologies don’t integrate with application development environments (63 percent), application developers are not comfortable with security (48 percent), and security processes have not evolved (48 percent).

    Much of the frustration can be tied to reliance on firewalls that don’t feature application programming interfaces (APIs) or are natively integrated with a public cloud, said Tim Jefferson, vice president for public cloud at Barracuda Networks. Each cloud service provider has a unique environment that requires providers of IT security software to write code that natively integrates with that platform. IT organizations can’t simply cut and paste security controls created for on-premises IT environments mainly because the cloud provider has already implemented its own controls at the infrastructure level. The IT organizations need to develop their own controls for the application layer, each of which then must be layered on top of the controls put in place by the cloud service provider.

    In the absence of those capabilities, developers get frustrated because a firewall running on a virtual machine on a public cloud presents them with a graphical user interface (GUI) rather than an API. Developers in the age of the cloud are not going to engage with any technology that they can’t programmatically invoke via an API, Jefferson said.

    Not surprisingly then, the survey finds the most requested firewall capabilities requested are cloud-native integration (74 percent), ease of deployment and configuration by cloud developers (59 percent), ability to regulate traffic flows between on-premises IT environments and public clouds (56 percent) and distributed policy enforcement (53 percent).

    Because many IT professionals don’t have these capabilities many of them conclude on-premises IT environment are more secure than public clouds. More than half the respondents (56 percent) say on-premises cybersecurity is still superior to a public cloud. Clearly, there a lot of technical and emotional factors that go into those assessments, but regardless of the truth, perception remains reality.

    Regardless of the approach taken, however, organizations that deploy firewalls in the cloud are expecting to pay for those services on a consumption basis, which doesn’t always align with taking a firewall running on virtual machine and then deploying it on a public cloud.

    Jefferson said that as cybersecurity in the age of the cloud continues to mature, expectations are rising regarding the capabilities a firewall should be able to provide—especially when it comes to controlling the flow of traffic coming into and out of a public cloud.

    Obviously, anything to do with DevSecOps these days is still evolving. But whatever the cybersecurity future holds the relationship between on-premises and cloud security is far more nuanced than many appreciate.

    — Mike Vizard

  • Barracuda Networks Advances DevSecOps Agenda

    Barracuda Networks Advances DevSecOps Agenda

    Thanks to the rise of DevOps, a fundamental shift is now underway in terms of the amount of influence developers exercise across the enterprise. Rather than simply dumping code on IT operations teams, developers increasingly are being held accountable for applications end to end. As such, developers now often exercise a lot more influence over which software-defined infrastructure and security platforms will be employed as part of what is referred to as the “shift to the left.” These platforms all have in common a well-defined set of application programming interfaces (APIs) that makes them accessible to developers.

    Against that backdrop, Barracuda Networks announced its Barracuda NextGen Firewall can be configured via the IT automation framework developed by Puppet Labs. Previously, only the company’s Web Application Firewall was integrated with the Puppet framework.

    In addition, the Barracuda NextGen Firewall is now available as a metered billing service in the Amazon Web Services (AWS) Marketplace. That marks the company’s second metered billing service on AWS, after making a similar move with the Barracuda Web Application Firewall last year.

    Tim Jefferson, vice president of public cloud, says an increased focus on application security is driving an expansion of DevOps processes to now include DevSecOps driven by APIs rather than traditional user interfaces, which are not well-received.

    Jefferson says those REST APIs are critical for any security company that wants to stay relevant as organizations start to manage multiple development pipelines that are tied into a common continuous integration/continuous development (CI/CD) pipeline. In that context, Jefferson says it’s no longer sufficient for IT security companies to make their offerings available as a virtual appliance. Security tools such as firewalls need to be just another cloud-native application that can be orchestrated as part of a CI/CD process, he says.

    What’s more, DevOps teams have made it clear they want to be able to consume anything deployed on a public cloud in the same manner they consume compute and storage resources. That requirement is driving companies such as Barracuda Networks to add a metered billing option because many organizations in the age of the cloud don’t want to pay for a firewall unless it’s actually in use, says Jefferson.

    It’s too early to say precisely how DevOps and DevSecOps are transforming the way IT products and services are acquired and invoked. In the case of Barracuda Networks, for example, the company is taking the rise of DevOps as opportunity to expand its portfolio of products first to include data protection by acquiring Intronis and then, more recently, compliance and archiving tools by acquiring Sonian.

    Naturally, not every IT organization is equally far down the DevOps and DevSecOps path. But the various walls that have isolated various segments of IT are finally starting to come down at an increasingly rapid pace across the enterprise.

    — Mike Vizard

  • Barracuda Networks Enhances API to Advance DevSecOps

    Barracuda Networks Enhances API to Advance DevSecOps

    Recognizing that DevOps teams deploying applications in the cloud need a more sophisticated approach to security, Barracuda Networks at the Microsoft Inspire 2017 conference unveiled an enhanced REST API for its Web Application Firewall (WAF), in addition to providing integration with the IT automation framework developed by Puppet Labs.

    At the same time, Barracuda Networks revealed that it has integrated all of it firewall offerings with the Microsoft Operations Management Services running on the Microsoft Azure Cloud. Finally, Barracuda Networks announced it is now including a software-defined wide area network (SD-WAN) capability with the Barracuda NextGen Firewall platform.

    Tim Jefferson, vice president of cloud for Barracuda Networks, says the REST API the company is exposing in its WAF enables IT organizations to better manage security within the context of larger DevOps environment. As part of that effort, Jefferson says, Barracuda Networks also plans to integrate its WAF offering with other IT automation frameworks.

    Jefferson says many IT organizations are discovering that public clouds are more secure than on-premises environments because of the level of security and instrumentation that cloud service providers now routinely include. For example, cloud service providers make it easier to track unusual API calls that might indicate an IT security breach or even an attack in progress. Those capabilities, says Jefferson, make it easier for vendors such as Barracuda Networks to provide more visibility into what’s occurring in a public cloud than what’s generally feasible on-premises.

    However, each cloud service provider has its own unique network stack that requires security tools to be optimized for each platform, says Jefferson. Because of that issue, most IT organizations have not had the security wherewithal needed to rise beyond adopting more than one public cloud service in their production environments, he says.

    In general, Jefferson says, developers are not likely to consume security technologies on a public cloud that can’t be invoked via an API. Because of that issue, many IT organizations are discovering that the security platforms they have employed on-premises simply can’t be lifted into the cloud. That issue, he says, creates a level of friction inside the organization that inevitably hampers usage of cloud platforms more than any other challenge an IT organization faces. Cloud applications require a DevSecOps approach that developers will view as a natural extension of existing DevOps processes, says Jefferson.

    To achieve that goal, organizations need to make it easier for developers to secure their applications and invite IT security experts inside their organization to participate in, for example, scrum teams that collaboration build, deploy and manage applications. In fact, Jefferson notes most DevOps teams don’t even want to talk to a vendor’s sales representative; they prefer to be able to download code that they can test and deploy on their own before committing to buying a license.

    It’s still relatively early in terms of appreciating the impact DevSecOps will have on improving IT security. But one thing is clear: IT security vendors that don’t make it simple for developers to invoke the capabilities they provide soon will be left behind.

    — Mike Vizard