Red Hat's 2023 Kubernetes Security Report is now available release , focusing on the specific security risks faced by organizations in cloud native development; It includes the risks faced by its software supply chain, and how to reduce these risks to protect its applications and IT environment. Based on a survey of 600 DevOps, engineering and security professionals around the world, the report reveals some of the most common security challenges faced by organizations in the process of cloud native adoption and their impact on business. And provides application development and security teams with best practices and guidelines that can reduce their security risks.
Some noteworthy findings include:
Mismatch between investment and adoption
The adoption rate continued to grow, but the security investment did not grow at the same time; Safety is still one of the biggest problems in container adoption. 38% of the respondents said that the security issues were not paid enough attention or the security investment was insufficient, an increase of 7% compared with 2022.
Red Hat believes that cloud native solutions need cloud native security solutions, and these solutions can (and should) usually include the DevSecOps method. The IT team needs to focus on selecting and implementing security tools that provide feedback and barriers in the CI/CD application pipeline and infrastructure pipeline. It is recommended that organizations invest in cloud native tools with built-in security to bridge the gap between investment and adoption, rather than using them as add-on components.
Security issues hamper business outcomes
For security reasons, 67% of respondents had to Delay or slow down The adoption of cloud native. More than half of the respondents have experienced software supply chain problems related to cloud native and container development in the past 12 months.
Worse still, Cloud native security event It may cause serious business impact. 21% of the respondents said that the security incident led to the dismissal of employees, and 25% of the respondents said that the organization was fined. In addition to obvious employee impact, it may also lead to the loss of valuable talents, knowledge and experience from the entire IT organization. 37% of respondents believe that the loss of revenue/customer is caused by the container and Kubernetes security incidents.
By prioritizing security in the early stages of the cloud native strategy, organizations can protect business assets, meet regulatory requirements, promote business continuity, maintain customer trust, and reduce the cost of fixing security problems.
Concerns about software supply chain security
The focus on software supply chain security has never been higher. Sonatype reports that In the past three years, the average annual growth rate of software supply chain attacks has reached an astonishing 742%. The three issues most concerned by survey respondents are vulnerable application components (32%), insufficient access control (30%) and lack of software bill of materials (SBOM) or source (29%).
The bad news is, More than half of the respondents have experienced almost all the problems found in the survey. Among them, vulnerable application components and CI/CD pipeline weaknesses are the two most mentioned problems. However, many organizations are adopting a comprehensive DevSecOps approach to better protect their software supply chain 。 Nearly half of the respondents have advanced DevSecOps plan. Another 39% understand the value of DevSecOps and are in the early stage of adoption.
In addition, by focusing on the security of software components and dependencies early in the software development life cycle, and using DevSecOps practices to automatically integrate security at each stage, organizations can transform from inconsistent manual processes to consistent, repeatable automated operations.
More details can be found at Download full report 。
