Hybrid Cloud Success Depends on Bridging the Gap Between Security and DevOps
September 17, 2018

Ron Lifton
NETSCOUT

As businesses everywhere undergo a digital transformation, the hybrid cloud has become a key component of success. Organizations around the world are moving applications and services workloads to the cloud, and reaping the benefits of lowered CAPEX, OPEX, and quicker time to market with new services as a result.

The role of DevOps in capitalizing on these benefits has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud. However, as the deployment pipeline continues to gather speed, so too does the risk of potentially harmful flaws and vulnerabilities that go unnoticed until it’s too late.

One perspective of what enterprises are facing today can be found in the 2018 NETSCOUT Threat Intelligence Report covering the latest trends and activities from nation-state advanced persistent threat (APT) groups, crimeware operations and Distributed Denial of Service (DDoS) attack campaigns. The report makes clear that threat actors are increasingly leveraging internet-scale threats, such as NotPetya, for targeted, highly selective campaigns. In addition, APT groups have expanded their scope. State-sponsored activity has developed to the point where campaigns and frameworks are discovered regularly for a broad tier of nations and therefore the applications developed by DevSecOps need to eliminate susceptibility to vulnerabilities such as buffer overflows, back doors, and Trojans.

What can an enterprise do as hybrid cloud and multi-cloud change the IT landscape and create greater exposure to cyber security threats?

It is impossible for existing defenses to stop every attack or eliminate every vulnerability. To begin with, tools may lack in-depth monitoring and forensics analysis for true identification of threats, or to understand risks to digital assets, intellectual property and personal/ business information. The depth of monitoring and forensics is highly dependent on data used by these tools. Visibility may be constrained by syslog or NetFlow data and the cost to overcome blind spots can be prohibitive.

Enterprises also face substantial business risk when they can’t fix what they don’t see. These include loss of revenue, reputation, availability of services to customers and employees, trade secret theft, and falling out of regulatory compliance.

To better protect against cyber threats and innovate with confidence, DevOps teams must evolve into full-fledged DevSecOps teams, and obtain unobstructed end-to-end visibility across the entire service delivery infrastructure.

One way to get there is through continuous monitoring of wire data (IP traffic flows) and turning it into smart data at its point of collection, optimized for analytics at the highest possible speed and quality. Unlike log data, which needs to be collated and analyzed before it can be acted upon, smart data involves analyzing every IP packet that traverses the network during a development cycle and beyond, in real time, and uses that information to deliver meaningful and actionable insights, which create a common situational awareness for the entire team. By providing relevant actionable and intelligent datasets on events as they happen, smart data enables all teams — from developers to operations, security, QA and everyone in between — to work closely together as parameters continue to evolve throughout the development process and traffic flows from and to data centers, clouds and network edge.

Enterprises need solutions to protect against DDoS attacks that threaten availability and continuous monitoring to guard against advanced threats that infiltrate networks to steal critical business assets. Analyzing data after a breach will help troubleshoot problems but knowing about flaws in an application in real time will allow developers, operations, and security teams to deal with any issues with greater agility. When combined with automation, this process will help to create more secure applications and will, in turn, save time and money plus reduce risk.

Ron Lifton is Senior Enterprise Solutions Manager at NETSCOUT
Share this

Industry News

October 29, 2020

Cisco announced new software-delivered solutions designed to simplify IT operations across on-premise data centers and multicloud environments.

October 29, 2020

Bugsnag announced availability of user stability analytics, which will help developers gain a clearer understanding of how application errors are impacting the user experience and other key performance indicators (KPIs) for the business, as well as offer insights on whether to fix bugs or build new features.

October 29, 2020

HAProxy Technologies announced an open-source release of a VMware Open Virtual Appliance (OVA) virtual machine image of the HAProxy load balancer for vSphere, which HAProxy Technologies will maintain on GitHub.

October 28, 2020

Progress announced a number of new innovations designed to facilitate adoption and at-scale deployment of Chef offerings for both new and experienced users of the DevSecOps portfolio.

October 28, 2020

StackRox announced the release of KubeLinter, its new open source static analysis tool to identify misconfigurations in Kubernetes deployments.

October 28, 2020

Vercel announced Next.js 10 featuring a number of new capabilities that accelerate frontend developers’ ability to enrich end users’ web experiences globally.

October 27, 2020

ThinkTank has released a suite of applications designed to keep distributed agile teams aligned and engaged, regardless of physical location.

October 27, 2020

Cloudify, a Service Orchestration and Automation Platform, announced its latest 5.1 product release which aims to take one step further to permanently remove silos and roadblocks that are consistently associated with migration to the public cloud.

October 27, 2020

WhiteSource announced its new native integration for Microsoft Azure DevOps services.

October 26, 2020

NetApp unveiled a new serverless and storageless solution for containers from Spot by NetApp, a new autonomous hybrid cloud volume platform, and cloud-based virtual desktop solutions.

October 26, 2020

GeneXus released GeneXus 17, a new version of its platform that empowers enterprises to create and evolve new applications at unprecedented speed.

October 26, 2020

Alcide announced the company’s security solutions are now integrated with AWS Security Hub, sending real-time threat intelligence and compliance information to Amazon Web Services (AWS) for easy consumption by Security and DevSecOps teams.

October 22, 2020

Puppet announced Puppet Comply, a new product built to work with Puppet Enterprise aimed at assessing, remediating, and enforcing infrastructure configuration compliance policies at scale across traditional and cloud environments.

October 22, 2020

Harness announced two new modules: Continuous Integration Enterprise and Continuous Features.

October 22, 2020

Render announced automatic preview environments which are essential for rapid and collaborative development of modern applications.