Cloud Infrastructure Governance Has Room for Significant Improvement in 2018
February 08, 2018

Josh Stella

The calendar may read 2018, but paper-based checklists and other manual practices for infrastructure governance still rule, according to the recent State of Cloud Infrastructure Governance survey of more than 300 IT professionals, commissioned by Fugue.

While not necessarily surprising, the slowness of enterprise IT departments to embrace automated, cloud-native solutions for the cloud infrastructure challenges they face has resulted in IT infrastructure that is often ungoverned and insecure. And this is despite the fact that the cloud can be more secure as traditional data centers.

The Current State of Cloud Infrastructure Governance Is Poor

The main finding of the survey reveals that the current state of cloud infrastructure governance at enterprise organizations is poor: in spite of an ever-increasing number of security breaches, 62 percent of the survey respondents rely on manual reviews before infrastructure is provisioned, and 42 percent have no cloud infrastructure governance processes in place. So, it wasn't at all surprising that the survey further revealed that 28 percent of IT professionals aren't confident their cloud infrastructure is secure. In addition, 31 percent of application developers either don’t understand infrastructure risk or don’t know what to do to mitigate it.

Digging a little deeper into the "why" of these statistics, the number one reason IT professionals say their organizations haven't fully implemented infrastructure governance is that compliance and security slow down innovation (55 percent).

Another 44 percent say they struggle to keep track of all the infrastructure they have running, and an equal number struggle to identify and respond to infrastructure risks. More than a third (39 percent) cite the lack of collaboration between security, compliance and IT.

Some Sobering Compliance and Security Breach Statistics

Compliance issues and operations go hand-in-hand with infrastructure governance. According to the survey, 60 percent of respondents rely on manual remediation for policy violations and configuration drift, and 17 percent don’t validate compliance before infrastructure is provisioned.

This overall failure to have automated, cloud-native infrastructure governance in place has real consequences. IT departments can't be sure they're in compliance, and that brings with it significant risk, particularly if they're operating under a compliance regime like HIPAA, PCI or NIST 800-53. A reliance on manual reviews also brings the risk of human error and unacceptably long Mean Times to Remediation.

Moving to security issues, the survey showed that, when data breaches occur, the C-suite is considered responsible. Specifically, when asked who should be held accountable when a data breach occurs, nearly half (47 percent) of IT professionals said the CEO, followed by the CIO (32 percent); VP of Cloud (31 percent); CTO (23 percent); and Cloud Architect (22 percent).

Infrastructure Governance Will Improve in 2018 via Governance Automation

Only time will tell what 2018 has in store for the state of IT infrastructure governance. Based on the 2017 survey results, and what I hear in the industry, I'm confident that we're going to see more high-profile data breaches related to misconfigured cloud infrastructure. But we'll also see more focus on automated, cloud-native approaches to the problem. Enterprises will start to realize that their traditional tools and methods for compliance, security and cost controls simply don't work well in the cloud. They're inadequate in addressing the risks. They don't scale well. They slow down innovation. They waste money and resources.

The good news is that the things that make cloud governance so challenging, such as the rapid change and the nature of API-driven, software-defined infrastructure, also represent the opportunity to radically improve infrastructure governance. This is all possible today.

What's the Solution?

Optimized infrastructure governance is attainable but not with manual reviews and remediation, which are slow and prone to error. They also don’t scale. Only fully automated, cloud-native solutions can keep up with the pace of change that is outstripping human ability to govern IT infrastructure and operations in a fast, secure and compliant way.

Josh Stella is CTO of Fugue
Share this

Industry News

December 11, 2019

Bonitasoft announced that the Bonita platform is now available with advanced low-code features that permit better collaboration between citizen developers and professional developers.

December 11, 2019 announced WebAssembly Hub, a service for building, sharing, discovering and deploying WebAssembly (Wasm) extensions for Envoy Proxy-based service meshes.

December 11, 2019

Datawire unveiled the new Ambassador Edge Stack 1.0, an integrated edge solution that empowers developer teams to rapidly configure the edge services required to build, deliver and scale their applications running in Kubernetes.

December 10, 2019

Redgate Software launched its fourth annual State of Database DevOps Survey.

December 10, 2019

Compuware has signed a definitive agreement to acquire the assets of INNOVATION Data Processing, a provider of enterprise data protection, business continuance and storage resource management solutions serving the mainframe market.

December 10, 2019

Dynatrace announced its Autonomous Cloud Enablement (ACE) Practice to accelerate DevOps’ movement to autonomous cloud operations.

December 09, 2019

NS1, announced the expansion of its suite of integrations to include Kubernetes, Consul, Avi Networks (VMWare NSX), NGINX, and HAProxy.

December 09, 2019

CloudBees announced an extension of its partnership with Google. As a Google Cloud Run launch partner, CloudBees will offer developers more flexibility in their deployment of containerized applications.

December 09, 2019

EPAM Systems has expanded its crowdtesting software solutions to enable user story testing.

December 05, 2019

Parasoft announced the newest release of Parasoft C/C++test, the unified C and C++ development testing solution for enterprise and embedded applications.

December 05, 2019

Datadog announced Security Monitoring, a new product that enables real-time threat detection across the entire stack and deeper collaboration between security, developers, and operations teams.

December 05, 2019

Pulumi announced the availability of Pulumi Crosswalk for Kubernetes, an open source collection of frameworks, tools and user guides that help developers and operators work better together delivering production workloads using Kubernetes.

December 04, 2019

CloudBees announced a Preview Program for CloudBees CI/CD powered by Jenkins X, a Software as a Service (SaaS) continuous integration and continuous delivery solution running on Google Cloud Platform.

December 04, 2019

Rancher Labs announced the general availability of K3s, their lightweight, certified Kubernetes distribution purpose built for small footprint workloads, along with the beta release of Rio, their new application deployment engine for Kubernetes that delivers a fully integrated deployment experience from operations to pipeline.

December 04, 2019

WhiteSource announced a new integration with Codefresh, the Kubernetes-native CI/CD solution.