Security by Design practices and challenges  faced by organisations in an Agile Public Cloud  world

Background: Public Cloud usage is becoming mainstream with organisations increasing their dependence on Cloud technologies to build their digital platforms and services. Organisations are expected to spend over half a Trillion US dollars by 2023 in Cloud services spanning across workloads and types of businesses from large enterprises to small and medium sized businesses. As organisations transform to becoming more digital, there is an increasing need for speed to stay competitive in the market. This has led to them to adopt Agile methodologies to develop their digital platforms and solutions. These platforms and solutions make up a critical part of cyberspace and need to be secured. Adopting Cloud technologies and Agile methodology requires cultural and behavioural changes within organizations, including but not limited to how decisions are made, how risks are assessed, and most importantly skilling and readiness of employees. Objectives: The aim of the study is to observe security...Show moreBackground: Public Cloud usage is becoming mainstream with organisations increasing their dependence on Cloud technologies to build their digital platforms and services. Organisations are expected to spend over half a Trillion US dollars by 2023 in Cloud services spanning across workloads and types of businesses from large enterprises to small and medium sized businesses. As organisations transform to becoming more digital, there is an increasing need for speed to stay competitive in the market. This has led to them to adopt Agile methodologies to develop their digital platforms and solutions. These platforms and solutions make up a critical part of cyberspace and need to be secured. Adopting Cloud technologies and Agile methodology requires cultural and behavioural changes within organizations, including but not limited to how decisions are made, how risks are assessed, and most importantly skilling and readiness of employees. Objectives: The aim of the study is to observe security by design (SbD) practices from experts and practitioners, who build Cloud based solutions using Agile delivery methodologies. Furthermore, we seek to explore the challenges they face implementing SbD practices when building Cloud based solutions. Method: We use a qualitative approach using semi-structured interviews of 16 practitioners as our primary data collection method. We analyse the results of the interviews using a codebook created to identify themes, practices and challenges. Discussions: The fast paced and changing Cloud environment presents some contradictions, with opportunities and challenges that influence SbD practices. From our discussions with interview participants, we observed nine practices, and four other factors that influences these practices. Furthermore, we observed various challenges they faced across (i) Cloud operating model, (ii) people and organisation, (iii) process and methods, (iv) threat landscape and, (v) tools and technologies. Organisations look to proactively move security related activities early in their engineering cycles. This is often referred to as “shifting left”. Ability to effectively “shift left” depends on driving the right accountabilities, investing in automation, addressing the security skills gap, and creating a security mindset within the organisation.Show less

Leiden University Student Repository

Documents

In Collections

Security by Design practices and challenges faced by organisations in an Agile Public Cloud world