Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The adoption of cloud software in organizations continues to grow. In 2020, the combined end-user spending on cloud services totaled $270 billion, according to Gartner. By 2022, projections indicate that this total will rise to a staggering $397.5 billion. In fact, according to Arcserve, there will be over 100 zettabytes of data stored in the cloud by 2025. To give you some perspective, a zettabyte is equivalent to a billion terabytes. But are cloud services superior to an on-premises solution?

Despite the increase in cloud adoption, many organizations are still hesitant to move their confidential and highly sensitive data to the cloud. It’s not uncommon for companies to have concerns about being able to maintain the privacy, integrity, and security of their data when they migrate to the cloud or leverage cloud services. This is especially true for organizations that operate in highly regulated industries, such as healthcare, financial services, insurance, and the public sector.

Architecturally speaking, cloud-native applications are broken down into smaller components that are highly dynamic, distributed, and ephemeral. Because each of these components is communicating with other components inside or outside the cluster, this architecture introduces new attack vectors that are difficult to protect against using a traditional perimeter-based approach.

In our previous blog breaking down The 5 Fundamentals of Cloud Security, we looked at the value of prevention and secure design. Mapping resource relationships and enforcing security guardrails throughout development helps greatly reduce an available attack surface. But who will enforce these guardrails when your security team is busy with other work? This should be where developers are able to step in. So let’s look at another vital element in cloud security: empowering developers.

Developing and testing a frontend feature can be difficult, especially when the backend it depends on is not ready. This dependency on a backend API often slows down the development process. In scenarios like this, developing a mock API can save you a lot of time by allowing you to develop your feature independent of the backend, and make it easier to test and identify scenarios where your API might fail before it is ready.

The JFrog Security Research team released the findings of a recent investigation wherein they uncovered thousands of publicly exposed, active API tokens. This was accomplished while the team tested the new Secrets Detection feature in the company’s JFrog Advanced Security solution, part of JFrog Xray.