The average company runs 464 custom applications; and more than 70% of these are business-critical. But while almost 50% of custom applications are in the public or hybrid cloud today, IT security is aware of only a third of them.
At the 8th Annual Cloud Security Alliance (CSA) Summit at RSA in San Francisco, Skyhigh Networks provided striking details around widespread migration of custom or internally developed applications from corporate datacenters to infrastructure-as-a-service (IaaS) platforms such as the Amazon Web Services (AWS) Cloud, Microsoft Azure and Google Cloud Platform. The security concerns, according to the company’s report on the subject, are myriad.
Most companies have developers writing custom code to improve engagement with employees, partners and customers: The average enterprise expects the number to grow 20.5% in the next 12 months, according to the report. Yet this is a new and rapidly growing area of shadow computing where the stakes are high for preventing security compromises: 72.7% of companies have a custom application that, if it were to experience downtime, would significantly impact the organization’s ability to operate.
“Custom applications are a core part of how our business operates, and moving these to the cloud provides IT an opportunity to ‘start fresh’ with the right visibility, controls and overall security, without getting in the way of business operations,” said Stephen Ward, CISO, TIAA. “Meeting our security requirements for our applications, as well as our IaaS environment, is absolutely critical to accomplishing our business goals for cloud and overall software programs.”
In 2017, IaaS adoption will reach a tipping point, because for the first time more custom applications will reside in public IaaS platforms than in corporate datacenters. Slightly more than half—60.9%—of custom applications remain in corporate datacenters today, and this number is expected to decline to 46.2% in the next 12 months as enterprises continue to migrate applications to public IaaS platforms. The two top reasons for moving to the cloud are scale and cost, and a majority (62.9%) of respondents believe public IaaS platforms are just as or more secure than their own datacenters.
“Data center consolidation is one of the fastest growing trends in IT today as enterprises move their custom application workloads to public cloud providers,” said Rajiv Gupta, CEO, Skyhigh Networks. “As they do so, they will have to overcome the security, compliance and governance challenges unique to cloud.”
And indeed, apps are vulnerable in the IaaS wilderness. Despite growing acceptance of public IaaS platforms, IT security departments face a host of new threats and challenges in the move to the cloud. Under cloud’s shared responsibility model, IaaS platforms secure the infrastructure, but the enterprise is accountable for securing the corporate data, which includes protecting against compromised login credentials, rogue administrators and regulatory violations. These challenges are made more urgent by the fact that 46% of business-critical custom applications are already in the public or hybrid cloud today and by the rapidly approaching deadline for complying with the EU General Data Protection Regulation (GDPR).
“These critical applications are increasingly being deployed in the public cloud,” said Nigel Hawthorn, Skyhigh’s chief European spokesperson. “While public cloud is usually more secure than the corporate datacenter for physical, patch and uptime security, the responsibility for higher-function security is still with the app developer and often being overlooked. Consequently, 64% of IT security professionals are ‘moderately’ or ‘very’ concerned about the security of their custom apps in the public cloud, revealing the demand for new technology that can help alleviate those fears.”
The report also found that recent high-profile cyberattacks have illustrated that corporate boards ultimately hold C-level executives responsible, and 29.1% of respondents believe the CIO and the CISO would lose their jobs in a catastrophic attack on a custom application.
Over half, 50.3%, believe the IT security manager responsible for the application would be fired. Application developers are considered the least likely to face termination and only 23.3% are concerned about application security, signaling that IT security must take the initiative for custom application and IaaS security.
“Securing sensitive data in the cloud is no longer the remit of one party, it’s a shared responsibility,” said Hawthorne. “The rapid adoption of IaaS deployments sees the role split between infrastructure providers and enterprises, while internally, businesses cannot expect IT to manage cloud security alone. There needs to be buy-in from all departments to ensure custom applications have cybersecurity imbedded from the start, and that employees continue to use them in ways that won’t put corporate data at risk.”