Hybrid Cloud Success Depends on Bridging the Gap Between Security and DevOps
September 17, 2018

Ron Lifton
NETSCOUT

As businesses everywhere undergo a digital transformation, the hybrid cloud has become a key component of success. Organizations around the world are moving applications and services workloads to the cloud, and reaping the benefits of lowered CAPEX, OPEX, and quicker time to market with new services as a result.

The role of DevOps in capitalizing on these benefits has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud. However, as the deployment pipeline continues to gather speed, so too does the risk of potentially harmful flaws and vulnerabilities that go unnoticed until it’s too late.

One perspective of what enterprises are facing today can be found in the 2018 NETSCOUT Threat Intelligence Report covering the latest trends and activities from nation-state advanced persistent threat (APT) groups, crimeware operations and Distributed Denial of Service (DDoS) attack campaigns. The report makes clear that threat actors are increasingly leveraging internet-scale threats, such as NotPetya, for targeted, highly selective campaigns. In addition, APT groups have expanded their scope. State-sponsored activity has developed to the point where campaigns and frameworks are discovered regularly for a broad tier of nations and therefore the applications developed by DevSecOps need to eliminate susceptibility to vulnerabilities such as buffer overflows, back doors, and Trojans.

What can an enterprise do as hybrid cloud and multi-cloud change the IT landscape and create greater exposure to cyber security threats?

It is impossible for existing defenses to stop every attack or eliminate every vulnerability. To begin with, tools may lack in-depth monitoring and forensics analysis for true identification of threats, or to understand risks to digital assets, intellectual property and personal/ business information. The depth of monitoring and forensics is highly dependent on data used by these tools. Visibility may be constrained by syslog or NetFlow data and the cost to overcome blind spots can be prohibitive.

Enterprises also face substantial business risk when they can’t fix what they don’t see. These include loss of revenue, reputation, availability of services to customers and employees, trade secret theft, and falling out of regulatory compliance.

To better protect against cyber threats and innovate with confidence, DevOps teams must evolve into full-fledged DevSecOps teams, and obtain unobstructed end-to-end visibility across the entire service delivery infrastructure.

One way to get there is through continuous monitoring of wire data (IP traffic flows) and turning it into smart data at its point of collection, optimized for analytics at the highest possible speed and quality. Unlike log data, which needs to be collated and analyzed before it can be acted upon, smart data involves analyzing every IP packet that traverses the network during a development cycle and beyond, in real time, and uses that information to deliver meaningful and actionable insights, which create a common situational awareness for the entire team. By providing relevant actionable and intelligent datasets on events as they happen, smart data enables all teams — from developers to operations, security, QA and everyone in between — to work closely together as parameters continue to evolve throughout the development process and traffic flows from and to data centers, clouds and network edge.

Enterprises need solutions to protect against DDoS attacks that threaten availability and continuous monitoring to guard against advanced threats that infiltrate networks to steal critical business assets. Analyzing data after a breach will help troubleshoot problems but knowing about flaws in an application in real time will allow developers, operations, and security teams to deal with any issues with greater agility. When combined with automation, this process will help to create more secure applications and will, in turn, save time and money plus reduce risk.

Ron Lifton is Senior Enterprise Solutions Manager at NETSCOUT
Share this

Industry News

October 17, 2019

Acquia announced the availability of its new Developer Studio, a suite of tools designed to improve the productivity of Drupal developers.

October 17, 2019

Talend announced Talend Cloud is now available on Microsoft Azure, offering a secure and scalable Integration Platform-as-a-Service for collecting, transforming and cleaning data.

With embedded data quality and native integration performance, Talend Cloud on Microsoft Azure delivers the trusted data companies need to make real-time business decisions, accelerate advanced analytics, and meet regulatory compliance requirements.

October 17, 2019

Cognizant entered into an agreement to acquire Contino, a privately-held technology consulting firm.

October 16, 2019

Red Hat announced Red Hat OpenShift 4.2, the latest version of Red Hat’s enterprise Kubernetes platform designed to deliver a more powerful developer experience.

October 16, 2019

Gluware announced Gluware Automation v3.6, which extends the platform API capabilities including integrations with the Mist and Ansible platforms and introduces lifecycle management and infrastructure integration enhancements.

October 16, 2019

XebiaLabs announced that Wipro has renewed and extended its partnership with XebiaLabs as their Strategic Enterprise DevOps Partner across the globe.

October 15, 2019

Puppet announced enhancements to its current product portfolio and the public beta of a new project focused on providing a simplified continuous deployment workflow.

October 15, 2019

DBmaestro expanded its database automation platform to enable CI/CD and release automation for MySQL, MariaDB and Amazon RDS with DBmaestro DevOps Platform v2019.4.

October 15, 2019

Radware announced the launch of Radware Kubernetes Web Application Firewall (WAF), a comprehensive and highly scalable application security solution for Kubernetes-based environments.

October 10, 2019

CloudBees launched a new partner program that expands ISV partners’ ability to align with CloudBees offerings and the global Jenkins community.

October 08, 2019

Nureva announced a key update to the Jira Software integration with Span Workspace, Nureva’s cloud-based digital canvas for visual planning and collaboration.

October 08, 2019

Fugue announced support for Open Policy Agent (OPA), an open source general-purpose policy engine and language for cloud infrastructure.

October 03, 2019

Redgate announced the launch of SQL Compare v14, the latest version of its industry standard tool for quickly and accurately comparing and deploying SQL Server databases.

October 03, 2019

Harness announced the release of Continuous Insights, a new capability of its CD platform that enables organizations to see clearly into software delivery performance across their engineering and development teams without needing to manually collect, correlate, and report metrics that might take days or weeks.

October 03, 2019

OutSystems and Workato announced a partnership aimed at allowing organizations to rapidly realize innovation, time to value, productivity, and mission-critical objectives through readily available application connectors.