Global ratings agency Standard and Poor’s (S&P) sent a sobering message to the Asia-Pacific business community in September to start factoring financial institutions’ responses to cyberattacks into their creditworthiness.
Simply put, S&P could downgrade a bank’s credit rating if it fails to meet its cybersecurity responsibilities.
Data breaches and ransomware are on the rise in the region, with high-profile cyberattacks making daily headlines.
In Australia, the country’s second largest telecommunications operator has been hacked in recent months. The personal data of nearly 10 million customers has been compromised and the incident is expected to cost the carrier at least A$140 million. In Singapore, ransomware cases have increased by 54% between 2020 and 2021 and just a few weeks ago the island state’s Cyber Security Agency convened an inter-agency ransomware task force to tackle against these threats.
Securing modern software systems is very difficult and these endless cyberattacks require a rapid change of mindset. Applications consist of thousands of components that have critical security risks and vulnerabilities leading to data loss, IP address theft and reputational damage. Unfortunately, most vendors have built security mechanisms for security professionals, not developers.
As a result, engineers are conditioned to outsource responsibility for security flows to the security team, shifting the burden of identifying vulnerabilities.
What engineers need are sufficient signals with controls and policies in place so that they cannot merge code unless defined security thresholds are met. This would integrate security into the development process.
Observability is uniquely positioned to provide visibility into the complexities of a modern system architecture and help identify an actionable path to resolving issues. Traditionally, there were four gold signals of observability: response time, throughput, error rate, and saturation. What is notoriously lacking is security.
Here are three key tips on how to successfully integrate security into the development process, which can help protect business reputation, close security gaps, and ultimately protect customer data. :
1. Make safety a golden sign
Security vulnerabilities in an organization’s infrastructure and software can have far-reaching consequences. By measuring security posture as a core component of the organization’s observability platform, engineers can effectively break down data and team silos, and avoid security blind spots present in IT environments. production and non-production today.
These extra steps can seem overwhelming for engineering teams, but it means issues can be caught in pre-production environments, not after they’ve been deployed to production. After all, if the software runtime environment does not meet security thresholds in pre-production environments, there is no good reason to allow deployments to go into production.
2. Integrate security tools for better visibility
Engineers will struggle to make informed decisions about their security posture without having the full picture. By integrating and correlating security signals from third-party security tools into the observability platform, engineers will have visibility into security issues from a single platform. This allows teams to consolidate and prioritize remediation efforts in real time, and gives them visibility and contextual security analysis across the entire software stack that identifies real vulnerabilities deployed across all environments.
Organizations should use observability platforms that allow engineers to easily aggregate existing security signals from other vendors’ security tools into a central view, so engineers can address vulnerabilities at any stage of the software development lifecycle using a single source of truth.
3. Encourage cross-team collaboration for an optimal security posture
Identifying and remediating vulnerabilities before they impact the business requires collaboration across teams. By removing departmental barriers between security and engineering, teams can successfully track and report security vulnerabilities at the organizational, team, application, or individual component level.
Vulnerabilities can be automatically correlated with software architecture to assess the surface area exposed by the vulnerability. This can help them quickly prioritize the most critical risks, creating developer work items that prioritize security over other initiatives.
A unified experience
The combination of security and observability allows teams to stay ahead of security issues and focus on innovation rather than risk. By correlating security signals from infrastructure and software execution in the observability platform, engineers can track security posture and dependencies on the software stack live. It’s time to cut the noise and reduce friction between developers and security teams by integrating security signals into the developer experience.
Comments are closed.