How DevSecOps can mitigate the cyber risks of emerging technologies [Q&A]

The technology world never stands still for very long and as new technologies emerge so too do new threats. With things like quantum computing on the verge of becoming mainstream it's important to understand their security implications.

We spoke to Archie Agarwal, founder and CEO of ThreatModeler to discuss how DevSecOps can help to identify and mitigate these new threats to cloud services.

BN: Cybersecurity has evolved to address the unique needs of the cloud. How do methods for securing the cloud differ from those for securing legacy architectures?

AA: In today's world, it's rare to find an application that doesn't exist in the cloud. However, cloud cybersecurity involves more external threats than on-premises cybersecurity. Additionally, everything is virtual and dynamic in the cloud, making it challenging to protect against threats. The constant changes make cloud infrastructures susceptible to various vulnerabilities, with misconfigurations being the primary culprit. Integrating checks into the CI/CD process for misconfiguration risks can significantly reduce the risk of breaches and data loss in cloud environments.

BN: What are some important factors that development and security teams should consider when designing cloud applications?

AA: There is a common misconception that security in the cloud is entirely handled by the Cloud Service Provider (CSP). Developers and security teams need to keep in mind that CSPs use a shared responsibility model where the CSP is responsible for security 'of the cloud,' while the customer is responsible for security 'in the cloud.' CSPs take responsibility for the infrastructure, such as hardware and software, while customers are responsible for things that use the infrastructure, like customer data, applications, access management, configurations, and encryption.

Developers also must consider that everything in the cloud is self-service. Since there is less interaction with IT teams, developers have more independence in the cloud -- which also means greater responsibility. Developers can easily make impactful changes in their cloud applications. However, quick changes can lead to a higher risk of unnoticed vulnerabilities. When designing cloud applications, development and security teams must put policies and processes in place to govern changes.

BN: What are the emerging threats that companies should consider when designing and developing their cloud architectures?

AA: The cloud provides more avenues for bad actors to cause issues than legacy architecture. When designing and developing cloud architectures, companies need to consider many unexpected threats. One of these is insider threats, where employees may unintentionally or deliberately compromise sensitive data or systems. Companies must also be aware of the risks associated with working with third-party vendors and partners, including the risk of data breaches or other security breaches that could compromise sensitive data.

Companies must also consider the risks of emerging technologies. For example, as companies increasingly incorporate AI into their systems, they must be aware of the potential for AI-generated threats, including deepfakes, AI-enabled phishing attacks, and other forms of cybercrime that leverage AI. Another example stems from the ongoing advancements in quantum computing. Companies must be prepared for the possibility of quantum computing attacks, which could potentially break many of the encryption schemes that are commonly used to protect sensitive data.

In order to be prepared for these kinds of attacks, companies should consider implementing tools in the design phase that will automatically uncover these vulnerabilities in their cloud architectures. Threat modeling tools in the cloud provide a comprehensive analysis of a company's cloud architecture. When adopted at the design phase and implemented as a process, not a one-time project, companies can continuously monitor their cloud architecture for any changes in real-time, and produce actionable responses and controls to defend it.

BN: Why does the emergence of quantum computing pose a threat to cloud architectures?

AA: The impact of quantum computers on application security is so profound that it will require every application developer to rethink their approach to encryption and security. According to CNET, cracking an RSA-2048 bit encryption key would take a classical computer around 300 trillion years, but a quantum computer with 4099 stable qubits could accomplish the same task in just ten seconds.

There is evidence that vast amounts of encrypted data is being stolen with plans to decrypt it once a quantum computer with enough power is created -- 'Store Now, Decrypt Later' (SNDL). Organizations need to quickly adopt technologies that can prevent this and ensure they are quantum ready by design.

BN: Does the same apply to AI?

AA: The advancement of AI in itself does not pose a threat to cloud architecture. However, AI can be used by hackers to advance their attacks. Not only can they use it to create new, malicious code, but they can also use AI to create more sophisticated and realistic phishing campaigns.

Additionally, AI requires a substantial amount of personal information for both vendors and customers. It is vital that organizations adopting AI applications integrate strict data protection and compliance policies to ensure their data and their customers' data is protected.

BN: How do these threats impact the key factors that development and security teams should consider when developing cloud applications?

AA: To ensure protection and repel attacks, organizations must build and maintain architectures that are resilient to millions of new variants of potential threats that could affect the organization. As technology continues to advance, attackers will continue to adapt and find new ways to use it. Adopting secure-by-design principles for cloud and application development is the only way to mitigate the security gaps and vulnerabilities created by emerging technologies and ensure data is protected.

BN: How can companies future-proof their cloud architectures against these emerging threats?

AA: Companies can future-proof their cloud architectures against emerging threats by shifting security left in the development process through strategic proactivity. To shift security left means to implement security measures during the entire development lifecycle, rather than at the end of the cycle.

DevSecOps enables us to bring the concept of strategic proactivity to enterprise security. DevSecOps is a software development approach that integrates security into the software development process. This process enables teams to ensure their applications and cloud architectures are secure-by-design rather than relying on post-development testing that can leave architectures exposed to unconsidered threats.

BN: Why is 'secure-by-design' a better approach than having robust runtime security and advanced alerting capabilities?

AA: As threats become more and more advanced, it is important to implement security measures as early in the software development life cycle (SDLC) as possible. The 'secure-by-design' approach makes security an integral part of the software development process, rather than an afterthought.

According to a study by IBM, compared to the design phase, fixing a software defect costs 100x more in the maintenance phase and 15x more in the testing phase. However, secure-by-design goes beyond shifting security left. It also focuses on limiting the damage of any successful intrusion. In this day and age, it should be assumed that a breach is a matter of if not when. Secure-by-design ensures that applications and architectures are built in such a way that the blast radius of a successful intrusion is limited to the smallest area possible by cutting off avenues for lateral movement and privilege escalation.

Image credit: alexskopje/depositphotos.com