By Godson Umejiego, Senior Correspondent, USA

Aqua Security, the leading pure-play cloud native security provider, has issued new research that shows that nearly 70per cent of chief information security officers (CISOs) believe open source security solutions provide a faster way to secure their environments. Likewise, 78 per cent of CISOs believe open source solutions provide them with access to the best and most current innovations in cloud security, and more than 60 per cent actively prefer to work with vendors who build open source projects.

The report is based on a survey, commissioned by Aqua, of 100 US-based CISOs at Fortune 1000 or larger companies representing a cross-section of industries. Its purpose was to evaluate security decision makers’ understanding and perspectives regarding cloud native security and the use of open source software (OSS).

“Perceptions of open source software are evolving. What was once seen as potential risk is now seen as an enabler for both security and business,” said CISO at Aqua Security, Paul Calatayud. “This is particularly relevant for cloud native environments, which benefit from the rapid innovation and agility that are common within the OSS community. These characteristics support CISO interest in working with vendors who are actively supporting OSS projects.”

Perspectives on Cloud Native Security

The survey also evaluated CISO perspectives on risks and security approaches for software security and cloud native environments. According to the report, 87 per cent of the respondents agree that securing the full application lifecycle — including infrastructure, application code and workloads — is critical, and 84 per cent agree that automated security checks across the software supply chain can actually accelerate software delivery.

More than two-thirds of CISOs agree that the easiest first step to securing production workloads is to begin with an inventory and assessment of the entire environment (68%). Using a single source of truth for cloud security is favored by 69 per cent of the CISOs, who value it for cutting down on friction between different teams in application development.

Among other findings, the study shows that 88 per cent of CISOs prioritize both active protection and visibility for workloads as necessary to reduce business risk. In fact, 9 out of 10 believe that active protection is a critical element of cloud native security.

“Visibility without active protection is not sufficient to keep cloud native environments secure, which is why Gartner includes it as a key capability of Cloud native Application Protection Platforms,” Calatayud said. “Security teams need the ability to efficiently detect and follow up on risks across their complex, distributed application portfolios, which is why we see most CISOs consider active protection as a nonnegotiable for cloud native security.”

When it comes to the security benefits that open source provides, 78 per cent of CISOs believe it provides them with access to the best and most current cloud security innovations, while over 60 per cent actively prefer to work with vendors who build open source projects.

“Perceptions of open source software are evolving. What was once seen as potential risk is now seen as an enabler for both security and business,” said Calatayud.

“This is particularly relevant for cloud-native environments, which benefit from the rapid innovation and agility that are common within the OSS community.

“These characteristics support CISO interest in working with vendors who are actively supporting OSS projects.”

Cloud-native security approaches

Aqua Security’s study also explored perspectives on risks and security approaches for software security and cloud-native environments, finding that 87 per cent of CISOs agree that securing the full application lifecycle — including infrastructure, application code and workloads — is critical.

Meanwhile, 84 per cent said that automated security checks across the software supply chain can accelerate software delivery.

When considering the easiest first step to securing production workloads, 68 per cent cited starting with an inventory and assessment of the entire environment.

Using a single source of truth for cloud security is favored by 69 per cent of the CISOs, who value this for cutting down on friction between different teams in application development.

Calatayud added: “Visibility without active protection is not sufficient to keep cloud native environments secure, which is why Gartner includes it as a key capability of Cloud Native Application Protection Platforms.

“Security teams need the ability to efficiently detect and follow up on risks across their complex, distributed application portfolios, which is why we see most CISOs consider active protection as a nonnegotiable for cloud-native security.”