devopsy.kinsta.cloud

Tag: ESG

  • Survey Surfaces Observability Challenges in the Cloud Era

    Survey Surfaces Observability Challenges in the Cloud Era

    A recent cloud observability survey found nearly two-thirds (64%) of respondents reported the adoption of public clouds has made it more difficult to achieve observability. Nearly half of respondents (48%) said they now consider providing real-time insights into application/infrastructure environments to be a top priority.

    The survey polled 357 IT professionals and was conducted by Enterprise Strategy Group (ESG) on behalf of Yotascale, a provider of cost optimization tools for cloud computing environments.

    Yotascale CEO Asim Razzaq said that attaining and maintaining observability becomes more challenging with each new cloud platform adopted. The survey found that 71% of organizations now rely on more than three cloud infrastructure providers.

    A full 84% of survey respondents also noted that tracking costs and cloud cost allocation is burdensome and time-consuming, and 61% admitted they lacked sufficient visibility into which teams own what cloud resources. Nearly a quarter (24%) are considering making changes to their monitoring and observability practices as infrastructure costs rise.

    Observability has always been a core DevOps tenet, but achieving and maintaining it is challenging. Most DevOps teams today aspire to be able to maintain some level of continuous monitoring. However, as it becomes easier and less costly to instrument applications, interest is rising in observability platforms that simplify the investigation of anomalies indicative of an issue that could disrupt an application environment. As that shift occurs, more organizations will seek to correlate events with costs as part of an effort to rein in the costs of IT, said Razzaq.

    In the immediate aftermath of the COVID-19 pandemic, the number of workloads being deployed on public clouds increased sharply. In theory, many organizations signed enterprise licenses that reduce cloud costs if they consistently consume a certain level of infrastructure resources. In practice, however, individual developer teams are showing a preference for one cloud platform over another based on the attributes of their workloads. As a result, however, it becomes more challenging to not only consistently observe diverse platforms but also to control costs.

    It’s still early days as far as the adoption of observability platforms is concerned, but it’s apparent that as application environments become more complex the plethora of monitoring tools that DevOps teams rely on will need to be streamlined. It’s not uncommon for DevOps teams to have multiple monitoring tools that surface a set of pre-defined but often conflicting metrics. Observability platforms unify logs, metrics and traces in a way that makes it simpler to launch queries to identify the root cause of an issue.

    The rate at which DevOps teams will embrace observability will naturally vary. In 2022, the biggest obstacle might not be the technology as much as it is simply understanding what queries can help DevOps teams better understand the root cause of an IT issue before there is a major disruption. In the long term, it’s expected that machine learning algorithms will leverage the data collected by observability platforms to automatically identify issues that might lead to a disruption long before it actually occurs. Regardless of approach, however, the ability to manage complex IT environments in the months and years ahead will continue to steadily improve.

  • ESG Survey Sees Long DevSecOps Road Ahead

    ESG Survey Sees Long DevSecOps Road Ahead

    A study published by Enterprise Strategy Group (ESG) in collaboration with Data Theorem, a provider of tools for securing application programming interfaces (APIs) and mobile applications, finds that while a lot of progress has been made in terms of adopting DevSecOps, most organizations still have a very long road ahead before they can claim DevSecOps practices have been implemented consistently across the organization.

    Based on a survey of 371 IT and cybersecurity professionals at organizations in North America, the ESG study finds 55% of respondents have incorporated security into their DevOps processes, with another 22% planning to do so and 20% still in the evaluation stage. However, the study makes it clear that adoption of DevSecOps is still uneven at best. Only 33% are involving cybersecurity teams at the start of the application development process. And 39% of respondents report that members of their cybersecurity team are involved with more than half of cloud-native application projects today—a number that is projected to jump to 78% in the next two years.

    The survey also notes only 8% of respondents are securing 75% or more of their cloud-native applications with DevSecOps practices today. Within two years, however, 68% of respondents expect to be securing 75% or more of their cloud-native applications using DevSecOps practices.

    Doug Cahill, a senior analyst and group director at ESG, said the study makes it clear cybersecurity increasingly is being baked into applications rather than bolted on. The challenge now is finding a way to accomplish that goal at unprecedented levels of scale, he said.

    The platforms on which applications are being built and deployed are more diverse than ever. Organizations are running workloads on virtual machines (34%), bare-metal servers (28%), containers (23%) and serverless computing frameworks (15%), according to the survey results. Only 10% are running more than 50% of those workloads on a public cloud, but that amount is forecasted to jump to 30% in two years.

    Not surprisingly, the biggest cybersecurity challenges those organizations face is consistently managing cybersecurity across multiple platforms (43%), the cost and complexity of implementing cybersecurity controls across those platforms (35%) and lack of understanding of the threat vectors cloud-native applications face (35%).

    In terms of container security concerns, aligning controls with deployment models (32%) and verifying images in registries meet compliance requirements (32%) were cited as the top two issues. In terms of serverless computing, application programming interface (API) vulnerabilities (32%) were the most cited. As far as budget allocations are concerned, vulnerability scanning of registry-resident container images (26%) narrowly beat out API vulnerabilities tools (25%).

    Half of respondents also said they expect their organization will consolidate controls by leveraging suites and platforms procured from a smaller set of vendors or even a single vendor. Nearly three-quarters (73%) said they believe that their organization uses too many specialized products to secure cloud-native applications properly. Nevertheless, 59% said they prefer disparate point controls to achieve more functionality even if it means using multiple controls for different compute types/locations.

    The most important attributes of products used to secure cloud-native apps identified by survey respondents included a rich set of pre-deployment capabilities, runtime capabilities and support across a mix of server workload types, with flexible deployment options.

    The biggest issue, however, may be just the way these organizations are currently structured. The survey finds 82% of respondents have different teams assigned to secure cloud-native apps. Among those respondents, half plan to merge these responsibilities in the future, while 32% intend to keep them separate.

    Put it all together and it’s apparent there’s a long way to go before DevSecOps nirvana might be achieved. The good news is most organizations have a least started the journey.

    — Mike Vizard

  • DevSecOps Becomes a Higher Cloud-Native Priority

    DevSecOps Becomes a Higher Cloud-Native Priority

    At the Cloud Native Security Summit, Enterprise Strategy Group (ESG) today revealed the results of a survey of 600 senior IT leaders that finds organizations are looking at DevSecOps as a way to address the complexities of managing and securing cloud-native applications.

    According to the survey results, 43% of respondents said their biggest challenge with cloud-native applications is maintaining consistency across disparate infrastructures. As a result, the same number of respondents said DevSecOps automation as their highest cloud security priority.

    Commissioned by Capsule8, Obsidian and Signal Sciences, the survey also finds 90% of respondents are concerned about not having visibility into misconfigured cloud services, server workloads, network security or privileged accounts. Another 83% are worried about the misuse of privileged accounts by insiders.

    Two-thirds (66%) say IT is more complex than it was two years ago, with more than a third (35%) citing the need to manage multiple cybersecurity controls as a major source of that complexity.

    Doug Cahill, a senior analyst and group director at ESG, said it’s clear that as organizations embrace best DevOps practices to build and deploy cloud-native applications, those processes now are being extended to include security controls as part of the quality assurance process. Rather than bolting on security, Cahill said, more organizations are building cybersecurity controls into their software from the ground up.

    Capsule8 CEO John Viega noted much of that shift is being driven by necessity. When applications were deployed mainly in on-premises IT environments, it was easier to secure the environment by deploying appliances. Now organizations need to secure applications on infrastructure they don’t control as part of a shared responsibility model that often spans multiple cloud service providers. The cloud may be more agile and less expensive, but Viega noted it’s not uncommon for hundreds of cloud accounts to have been set up by individuals in the same organization, each with very different levels of cybersecurity expertise.

    Obsidian Security CTO Ben Johnson added the rate at which cloud-native applications are being deployed and updated is overwhelming the ability of cybersecurity teams to keep pace. In fact, many organizations are still underestimating the scope of the cloud-native cybersecurity challenge they face.

    Finally, Hala Al-Adwan, vice president of technology for Signal Sciences, observed as organizations embrace DevSecOps, cybersecurity professionals still will play a key role in terms of their consulting expertise. However, responsibility for implementing cybersecurity will continue to shift left toward DevOps teams. The challenge those teams will face is the need to replace legacy cybersecurity infrastructure designed for cybersecurity administrators with programmable tools that fit neatly within a continuous integration/continuous deployment environment, said Al-Adwan.

    It’s not clear precisely when a desire to embrace DevSecOps will result in more secure applications. In theory, cloud-native applications should be a lot more secure than legacy monolithic applications. However, the degree to which higher levels of security will motivate organizations to replace monolithic applications remains to be seen.

    In the meantime, cultural issues associated with embracing DevSecOps will abound. There are simply not enough cybersecurity professionals available to participate in every application development scrum session. The real issue now is finding a way to embed that knowledge into an application development process operating at industrial scale.

    — Mike Vizard