Nearly 9 out of 10 companies worldwide experienced at least one security breach incident in the Kubernetes environment last year, according to a Red Hat report[1]. In two out of three enterprises (67%), concerns related to container security caused a delay in application deployment. Meanwhile, although the emphasis on ensuring security throughout the development and maintenance cycle of applications is gaining importance, companies still use DevSecOps practices less frequently than they should.
In 2024, the Kubernetes platform, based on open-source software and also known as K8s, celebrates its 10th anniversary. This tool for containerizing applications quickly became an example of a solution revolutionizing the approach to managing IT infrastructure, scaling systems, and developing applications designed to run in cloud environments from the outset.
Despite the rising popularity of Kubernetes, many companies remain cautious about this solution. Two out of five (42%) respondents name ensuring security as the main challenge when deploying containers and the K8s platform. Companies fear incidents resulting from access breaches, security flaws, or incorrect configurations, which can occur at any stage of the application lifecycle.
This concern is justified given that a staggering 89% of those surveyed by Red Hat experienced at least one security incident related to Kubernetes within the last year. Not all of them were already running applications. Serious security flaws causing problems were detected at the construction and deployment stages of IT tools in 44% of companies. Two out of five entities (40%) identified faulty configurations in container or Kubernetes environments, while 26% did not pass a security audit.
Almost half of respondents (46%) noted that a security breach led to customer loss or reduced revenue in their companies. In nearly one out of three cases (30%), the incidents ended in a lawsuit or a fine being imposed on the enterprise, and 26% of entities had to let employee go. However, financial penalties and loss of employees are not the only consequences companies face in the event of a security incident. At stake is also the loss of trust from customers and partners, a negative public image, and even a decline in market position vis-à-vis competitors.
In every second surveyed company (50%), the responsibility for protecting Kubernetes is shared among different operational teams such as ITOps, DevOps, or DevSecOps, while in 16% of companies, it rests with the developer. Only in one out of three companies (34%) is there a dedicated team responsible for container and Kubernetes security. According to four out of ten respondents (42%), their company does not attach due importance to effectively resisting threats to the security of container environments, including insufficient investment in container protection (highlighted by 19% of respondents). This translates into a lower sense of trust in the solutions used by employees and also affects the speed of deploying new IT tools. Over two thirds of companies (67%) admit that they have slowed down or delayed the application development process due to growing security concerns.
The Red Hat report also reveals that DevSecOps practices are becoming increasingly common. Currently, 42% of enterprises state that they have implemented advanced DevSecOps, integrating and automating security processes at all phases of an application’s life cycle. Another 48% of companies are at an early stage of implementing these practices. This is a 9 percentage point increase compared to last year, indicating a growing understanding of the importance of collaboration between development, operational, and security teams.
When asked about the greatest risks related to IT security, companies mention code errors (36%), improper protection of sensitive data (34%), weak network security (32%), and malicious software (32%). These challenges reveal a need for companies to develop a comprehensive protection strategy that will allow faster identification of security gaps and better protection of container environments from cyber threats. The good news is that two out of three companies (66%) are already undertaking initiatives aimed at minimising threats. These include removing unused components, increasing control over granting permissions, and patching security configuration errors.
More information about the survey findings and security tips can be found in the report at: www.redhat.com/en/resources/state-kubernetes-security-report-2024
Wojciech Furmankiewicz, Director of Red Hat for Technology and Solutions in the Central and Eastern Europe region
About the report:
The “The State of Kubernetes Security for 2024” study was carried out by the research firm Illuminas on behalf of Red Hat. The aim of the survey was to provide information about the specific security threats that companies using Kubernetes environments face and to identify steps being taken to mitigate them. It also analysed the types and frequency of security incidents. Data was collected in December 2023 and January 2024 via online and telephone interviews with respondents from the USA, UK, and English-speaking countries in the Asia-Pacific region (APAC). The survey included 600 DevOps specialists, engineers, and security experts.
[1] Red Hat Report “The State of Kubernetes Security 2024”. Access: The State of Kubernetes Security Report: 2024 Edition (redhat.com).
Source: https://managerplus.pl/89-firm-doswiadczylo-incydentu-naruszenia-bezpieczenstwa-kubernetes-w-2023-r-24150
