Recognize the unavoidable need for runtime security

No security strategy can guarantee absolute protection. Modern software complexity and dynamic threats mean some risks will evade detection (Figure 1). According to Dynatrace analysis, a significant portion of Fortune 500 companies remain vulnerable to known vulnerabilities, such as Spring4Shell.

Left-shifted tools often lack runtime context, making it hard to prioritize vulnerabilities by real-world impact. Runtime security bridges this gap by continuously monitoring production environments, detecting and mitigating threats in real time. This approach helps organizations adapt to emerging risks instead of relying on pre-deployment checks.

Dynatrace addresses this challenge by adding runtime context to left-shifted security findings, enabling environment-aware vulnerability prioritization. Dynatrace Application Security integrates seamlessly with third-party tools to ingest and enrich vulnerability data with runtime context. This context-rich prioritization reduces cognitive overload for teams across the SDLC.

The value of defense-in-depth in SDLC

A defense-in-depth approach layers multiple security controls across the SDLC to build resilient applications that can withstand sophisticated attacks. Rather than relying on a single security measure, defense-in-depth supports the strategy that if one layer misses a vulnerability, another will catch it.

This approach gains added relevance as modern development practices accelerate release cycles, often introducing new risks at every stage. By embedding security from the earliest phases of development through to production monitoring, teams can proactively identify, mitigate, and respond to threats before they escalate. Figure 2 illustrates this multi-layered approach, mapping out key capabilities across four critical SDLC phases: Development, Build, Deploy, and Observe (encompassing the commonly referred-to phases of runtime and monitoring).

Each phase contributes unique controls and processes to a strong overall security posture. This layered approach is essential for protecting sensitive data, maintaining customer trust and meeting regulatory requirements in an increasingly hostile cyber environment.

To understand how this works in practice, let’s look at an example of a cloud-native microservices application.

End-to-end scenario: How the Astronomy Shop application leverages runtime context

Consider  Astronomy Shop, an online retailer demo application built on containerized microservices such as frontend, product, cart, checkout, payment, order, and search — all deployed on Kubernetes. Astronomy Shop’s teams implement defense-in-depth across the SDLC phases to secure their application.

By leveraging runtime context, they validate and prioritize risks in production, ensuring that the most critical security issues are addressed first. Below is a walkthrough of how Astronomy Shop uses tools and Dynatrace capabilities throughout the SDLC to enhance security.

Effective security starts at the foundation: during development. This phase sets the tone for the entire security lifecycle.

Development phase: Build security from the ground up

Scenario: Developers commit code for services like product, cart, and checkout. Security scanning runs early, and threat modeling identifies sensitive paths (e.g., checkout and payment). Findings are triaged later using the runtime context to prioritize risks.

Sample tools:

• SonarQube for code quality and static application security testing (SAST), GitHub Advanced Security for dependency monitoring and software composition analysis (SCA).

The Dynatrace role:

• Ingests security findings from development tools via OpenPipeline’s security events ingest endpoint.
• Maps findings to the Semantic Dictionary in Grail™ for unified prioritization, analysis, and automation.
• Highlights critical and high alerts and deprioritizes non-executed code vulnerabilities while prioritizing medium issues exposed to sensitive data. This helps developers focus on vulnerabilities that pose real risks in production.

After development, the build phase is positioned to catch vulnerabilities before deployment.

Build phase: Strengthening security through automation and testing

Scenario: Astronomy Shop teams build and push container images to AWS ECR. Automated image scanning tools like AWS Inspector and Snyk Container assess vulnerabilities. Findings are enriched with runtime context to identify which issues truly impact production.

Sample tools:

• AWS Inspector for image scanning and Snyk for container scanning.
• Recommended approach: Artifact/container image scanning for OS and package vulnerabilities.

The Dynatrace role:

• Extends observability to the build phase for governance and security hygiene control.
• Adds runtime context to container scans, so developers know which vulnerabilities to prioritize. This simplifies decision making and reduces cognitive load.
• Automates security gates and workflows with tools like Site Reliability Guardian to ensure no critical vulnerabilities affect production.

And now, we move on to deployment, the critical moment when applications face real-world threats.

Deploy phase: Safeguard production with real-time oversight

Scenario: The Astronomy Shop team deploys services to Kubernetes using Helm or GitOps. Admission policies and baseline checks run, while cloud controls enforce guardrails and flag misconfigurations.

Sample tools:

• Kyverno for workload and cluster policies, AWS Security Hub for cloud security posture management (CSPM).

The Dynatrace role:

• Monitors deployment success and audits deployment operations by ingesting SDLC events.
• Enriches KSPM and cloud misconfiguration findings with runtime context to prioritize critical issues.
• Detects and addresses configuration issues with Dynatrace KSPM, ensuring continuous monitoring in Kubernetes and cloud environments.

Once deployed, applications should be actively monitored to detect and address emerging threats and potential signs of compromise.

Observe phase: Monitor production for threats

Scenario: The Astronomy Shop application is deployed to production and actively monitored. A new vulnerability is discovered in a library, and Dynatrace detects and locates the issue in real time. Malicious actors attempt to exploit the vulnerability, but the application remains secure due to proactive patching.

Sample tools:

• Dynatrace Runtime Application Protection (RAP), Runtime Vulnerability Analytics (RVA), Microsoft Defender for Cloud, Amazon GuardDuty, Microsoft Sentinel.

The Dynatrace role:

• Unifies third-party runtime detections and security signals into a single view for efficient processing.
• Provides deep runtime observability through OneAgent, extending visibility to process health, cloud, and infrastructure.
• Enables runtime security capabilities like RVA (Runtime Vulnerability Analytics), Security Posture Management (SPM), and Runtime Application Protection (RAP), serving as the final defense layer against threats.

Figure 3 highlights how Dynatrace integrates seamlessly across the SDLC, enhancing security with runtime context and enabling teams to prioritize and address the vulnerabilities that matter most.

Let’s examine practical scenarios where Dynatrace enhances left-shifted security findings with runtime context, enabling environment-aware prioritization.

Practical scenarios: Elevate security with runtime context

1. Prioritize SAST findings in code
   Static scanners often detect thousands of vulnerabilities, many of which are irrelevant in production. Runtime context enables teams to prioritize vulnerabilities based on actual risk. For instance, critical severity vulnerabilities in non-executed code could be deprioritized, while medium-severity vulnerabilities exposed to the internet and near sensitive data become high priorities.
2. Prioritize container scanner findings
   Container scans often flag numerous vulnerabilities. Runtime context helps determine whether these issues truly impact production. For example, a critical vulnerability in a library that is never executed in production can be deprioritized, while containers not deployed in production can be addressed later.
3. Prioritize KSPM findings on clusters
   Post-deployment, runtime context helps identify which security issues in workload cluster components or configurations impact production services. Critical vulnerabilities with no direct impact on production can be deprioritized, letting teams focus on what matters most.
4. Prioritize cloud alerts and compliance findings
   Continuous assessment of cloud environments and prioritization of misconfigurations with the application insights reduces the noise from cloud alerts and help to remediate the most important issues first.

Ready to strengthen your security in production?

Explore how Dynatrace can integrate seamlessly into your DevSecOps processes providing application-level insights to security findings across the SDLC for smarter prioritization.

The post Strengthen production security: Bridge SDLC best practices with runtime validation appeared first on Dynatrace news.

DevSecOps teams struggle to align with top executives on implementing key security measures and practices. This communication gap leaves companies blind to security risks, especially as AI-powered cyber-attacks become more common. Organizations are failing to fight cyberattacks properly because their teams cannot effectively communicate and collaborate.

In this year’s CISO report, “The state of application security in 2024”, Dynatrace investigated these communication gaps to discover how a combined focus on complete system visibility and security can improve teamwork and decrease vulnerability to cyber threats.

Cybersecurity is a board-level issue

This report touches on the fact that cybersecurity has become a critical C-suite and boardroom concern. Data breaches can cripple organizations, leading to hefty fines, shattered trust, and lost market share. New regulations hold leaders personally responsible for cybersecurity preparedness.

Ignoring cybersecurity is no longer an option. While executives are involved in cybersecurity discussions, their focus often centers on meeting regulations and well-known threats like phishing or ransomware. This leaves a gap in understanding the hidden dangers, like weaknesses in application security, which can have a significant impact on day-to-day operations.

In this year’s CISO report, dive into exploring CISOs and the challenges they face in educating leadership about cybersecurity risks. The report reveals how a combined observability and security approach can be their key to engaging the C-suite and ultimately strengthening the organization’s overall cybersecurity posture.

Security leaders must replace technical jargon with precise messages about business risk

In today’s digital landscape, relentless attackers hunt for weaknesses to steal data. While C-suite awareness is rising, CISOs need better ways to communicate cyber threats and build a shared security culture. Many organizations are falling short of bringing security to the forefront of boardroom discussions. For example, only 65% of organizations regularly require CISOs to report to the CEO and board on their cybersecurity risk and compliance posture. 

While C-suite leaders are increasingly interested in cybersecurity, a technical knowledge gap often creates a disconnect. 83% of CISOs say their board of directors and CEO need to understand their security posture better so they can assess business risk and compliance requirements. 

Executives’ priorities may differ from the IT team’s and CISOs, leading to inconsistencies. To bridge this gap, CISOs need to elevate the cybersecurity conversation. Instead of focusing on technical details, they should translate threats into business risks the C-suite can understand. 70% of C-suite executives say security teams often talk in technical terms without providing business context and believe the CISO is responsible for bridging the gap.

Application security is an Achilles’ heel

Cloud applications are a major target for cyber attackers, with 72% of organizations suffering a related security incident in the past two years. This alarming trend has propelled application security to the forefront of risk management for both IT and business leaders.

CISOs haven’t identified a dependable method to providing the board with clear information and insight into their organization’s application security risk posture and weaknesses. In fact, the 2024 CISO Report found that 87% of CISOs say application security is a blind spot at the CEO and board level.

This leaves executives in the dark about potential threats, making it hard for them to make informed decisions to protect the company from disruptions, financial losses, and damaged reputation. 82% of CISOs say they urgently need to increase the visibility of their CEO and board into application security risk to enable more informed decisions to strengthen defenses.

The SolarWinds and MOVEit attacks brought to light a major weakness in the security industry: dependence on third-party software. Many organizations are now rethinking how they manage cyber risk from third-party vendors.

In fact, 50% of CISOs have not yet brought third-party software bills of materials (SBOMs) into their organization’s risk management practices. 

Just knowing a third-party vulnerability exists isn’t enough. Security teams need to move fast to understand the following:

• How widespread is the issue in our systems?
• How serious is the business risk?
• Has it been exploited, and if so, what damage has it caused?

Additionally, it’s vital to share the learned insight with C-suite leaders and board members.

Automation across the DevSecOps lifecycle is central to risk management

As technology races forward, organizationss are turning to automation throughout the software development process (DevOps) to minimize security risks and meet regulations. According to the 2024 CISO Report, 71% of CISOs say DevSecOps automation is critical to ensuring reasonable measures have been taken to minimize application security risk.

To truly speed up innovation, companies need robust DevSecOps automation. But, only 11% of CISOs say their organization has mature DevSecOps automation practices.

DevSecOps automation streamlines development and security checks, catching vulnerabilities early and reducing human error. However, many organizations are still in the early stages, hindered by fragmented processes. Breaking down these silos is key to unlocking the full potential of DevSecOps automation.

Traditional tools and practices have limited value in the cloud-native, AI-driven threat landscape

Cloud complexity is breaking traditional security tools. Log-based security information and event management (SIEM) and extended detection and response (XDR) just cannot handle today’s dynamic cloud environments. This leaves security teams blind, unable to provide the data-driven insights CEOs and boards need to understand their cyber risk. 

The rise of AI is a double-edged sword. It fuels innovation for developers, but also arms attackers with tools to craft faster, more potent exploits. There is a 52% risk of cybercriminals using AI to create new vulnerability exploits faster and execute them on a wider scale. To stay ahead in this dynamic threat landscape, organizations urgently need to modernize their security practices.

79% of CISOs say vulnerability management and threat detection, investigation, and response can no longer be siloed processes. It’s vital now more than ever to have a single system that automates DevSecOps, uses AI to analyze massive data sets, and gives teams the end-to-end visibility they need to keep applications and data safe.

The 2024 CISO Report: How Dynatrace unites security and business leaders

Dynatrace® Application Security, built into the Dynatrace® platform, keeps your cloud-native applications, containers, and Kubernetes deployments safe. Here’s how:

• Developers: Dynatrace automatically detects vulnerabilities in running applications, so teams can fix real problems and not waste time on false alarms.
• Security teams: The platform continuously scans for threats and automatically blocks attacks in real-time, giving teams peace of mind.
• C-suite: By combining observability and security data, the platform eliminates blind spots and provides confidence that applications are secure.

This report is based on a global survey of 1,300 CISOs and ten interviews with CEOs and CFOs in enterprises with over 1,000 employees. It was commissioned by Dynatrace and conducted by Coleman Parkes between March and April 2024. 

The post 2024 CISO Report: The state of application security appeared first on Dynatrace news.

Security blind spots pose a significant threat to an effective DevSecOps strategy and leave organizations vulnerable to attack—in some cases when applications are already live.

In December 2021, the emergence of the Log4Shell zero-day vulnerability demonstrated the potential impact of vulnerabilities in runtime. An effective DevSecOps strategy helps organizations identify vulnerabilities throughout the software development lifecycle (SDLC) to ensure the integrity of software in development and of runtime applications.

Integrating security too late in the SDLC, expanding cloud access, and delayed security testing are just a few examples of security roadblocks to effective DevSecOps.

In a recent session at Dynatrace Perform 2022, Andreas Berger, senior principal project product manager of application security at Dynatrace, and Christian Schwarzbauer, application security product architect, dissected the importance of integrated runtime security and system observability in detecting, identifying, and addressing these blind spots across organizations.

Three key runtime security questions for DevSecOps

To be effective, Berger argues, modern application security requires speed and precision. “This is the core of what all security solutions should provide,” he says. Solutions must keep pace with the quickly changing apps in cloud-native environments. “Security solutions should highlight what really matters without flooding everyone with false alerts.”

Ultimately, security solutions should help organizations answer three key questions:

• Are we vulnerable?
• Where and how are we affected?
• What is the impact?

Prioritizing alerts in the face of runtime security blind spots

For finding and addressing runtime application security blind spots, a security solution should help you prioritize your efforts. But what does alert prioritization look like in practice?

With Dynatrace Application Security, prioritizing starts with its automatic and intelligent observability platform. Automatic discovery and instrumentation allow businesses to evaluate their entire environment in seconds, discover actionable information, and tap into real-time tracking on all affected processes.

The challenge? Given the depth and breadth of DevSecOps-driven tracking, the number of reported security vulnerabilities is often substantial. So substantial that organizations are often unsure where to focus their efforts.

Berger lays out the following ways Dynatrace helps organizations to prioritize their security vulnerability risks:

• Prioritize individual areas of interest. By combining the full coverage of Dynatrace analysis with extensive search functions, DevSecOps teams can quickly filter vulnerabilities by areas of interest to narrow response focus and address specific issues immediately.
• Prioritize vulnerabilities using automated risk assessment. Automated risk assessment, meanwhile, helps organizations identify vulnerable functions tied to a specific security risk that are currently in operation, exposed to the internet, or designated as sensitive data assets. This automated assessment reports an organization’s overall risk on a scale of 1 to 10 and the number and type of vulnerable functions in use.
• Prioritize issues by vulnerable component. Dynatrace can also prioritize issues by vulnerable components—such as log4j-core or tomcat-enabled-core—that influence multiple processes or functions. The Dynatrace platform shows how many critical vulnerabilities teams can address by upgrading each of these components. This prioritization enables teams to focus their efforts for maximum impact.

Moving DevSecOps beyond continuous WAF maintenance

It’s one thing to detect issues before they happen, but what about handling attacks as they occur?

“While web application firewalls (WAFs) remain the de facto standard for app protection, they are not without their drawbacks,” Schwarzbauer notes. In particular, firewalls could potentially reject authorized resource requests if they are misconfigured.

Schwarzbauer adds another potential drawback. “No matter how strong a WAF is, attackers will eventually find a way inside the network.”

As a result, teams need to continually maintain and manage WAFs to keep evolving risks in check.

Runtime application security from Dynatrace makes it possible for IT teams to keep pace with attacks as they occur. While also identifying potential threats, their location, and the vulnerabilities they exploit, Dynatrace provides information about the entire attack path. This visibility includes the source IP to entry point, vulnerability type, and eventual database backend target.

Additionally, each stage of the security process specifies the code location and function used by attackers to gain entry. Armed with this information, businesses organizations are better equipped to improve security across the entire DevSecOps pipeline.

Clearing up security blind spots for good

Simply put, by pairing runtime security with system observability, businesses are better prepared to detect, deflect, and defeat emerging security threats.

To learn more about the role of runtime application security and system observability in delivering on DevSecOps objectives, check out the full session, Address Log4Shell with ease: Why integrated runtime security and observability is key for DevSecOps.

The post How runtime security helps DevSecOps teams eliminate security blind spots appeared first on Dynatrace news.