Frictionless Protection of Applications In A Cloud Motion World

The increase in cloud adoption is driving the need for agile application security. According to Radware’s The State of Web Application and API Protection report, 70% of web applications now run in cloud environments, while 76% of organizations have accelerated their plans to migrate to the cloud in the past two years.

Most organizations are dealing with hybrid environments – where their applications are deployed across public clouds, private clouds, and physical data centers. Based on our research, 47% of organizations that deploy applications in the cloud do so over more than one cloud environment. However, cloud migration and application deployment are dynamic processes spanning over years – hybrid environments are never really static. Securing hybrid environments is a growing challenge because new apps are constantly being created, and old apps are modernized or going through a “lift and shift” to the cloud.

The Challenges of Securing Hybrid Environments

• Emerging threat vectors: Hackers constantly improve their techniques, thinking of new ways to attack organizations and circumvent existing protections. This exposes applications to new attacks, which cannot be mitigated with traditional or existing defenses.
• Wider threat surfaces: In the past, organizations had direct control over the application’s back-end infrastructure, leaving only the customer-facing side of the application exposed externally. However, in a cloud environment, both the application surface and the application infrastructure are exposed. Meaning both must be protected.
• Agile software development and DevOps culture: In many cases, the main driver of migration to cloud environments is the desire for more agility and flexibility in application development. As a result, much more attention is usually given to fast deployment in cloud environments, leaving security as a second priority. In other words, applications hosted in the cloud frequently change but must be secured in a frictionless manner that will not become an obstacle to agility.
• Multi-cloud deployments: Finally, many organizations deploy not just a single cloud environment, but several such environments in tandem, further complicating the task of cloud security, as organizations are now required to protect their assets with a consistent level of security – multiple cloud platforms, each with its capabilities, APIs, management, and reporting.
• Ownership by non-security stakeholders: Although security staff is commonly tasked with protecting cloud environments, they frequently have no authority over the choice or management of cloud environments. According to Radware’s research, 92% of organizations stated decisions about cloud platforms are made by stakeholders other than security staff.[Like this post? Subscribe now to get the latest Radware content in your inbox weekly plus exclusive access to Radware’s Premium Content.]

What is Needed For Frictionless Security

Your security strategy must start with visibility, control, and address application security holistically, consistently, regardless of where their applications are hosted and where they move.

With so many fast-moving parts – it’s a task that requires more than security experts. People and expertise alone cannot fully address this challenge. For a sound security strategy in a fast-changing environment, you need application protection that is the following:

1. Comprehensive: Provides extensive protection which covers all the critical threat vectors for application security.
   1. Automated: Automatic protection, which arms your teams with advanced algorithms to focus them on real threats and offload manual tasks that can be automated.
   1. Frictionless: Integrated as much as possible with the development cycle and does not interfere with business processes. It needs to be adaptive to change with the frequent changes to applications and the underlying deployment platform. Frictionless also means that the security applied is agnostic to the cloud environment and can be maintained throughout the cloud motion regardless of the pace of migration and the final destination cloud of the app.
   1. Consistent: Uniform, state-of-the-art security for all apps everywhere. This enables the same level of holistic protection agnostic to where the apps are (private/public clouds).
   1. Trustworthy: Partner with those who can take full responsibility and support you with the security expertise to implement your strategy.

[You may also like: [Understanding the Next Security Control Points: Applications and Workloads: IDC Report]