Co-founder and CTO at OpsCompass, focused on building the future of Cloud Security Posture Management (CSPM).
It’s time to boost your cloud security — because it may not be as good as you think.
My company’s recent report reveals that nearly all cloud professionals feel confident in their cloud security, believe that they have good visibility into their cloud environment, and that they’re able to keep track of its changes. Yet over half also report that they’ve witnessed a breach in their security, and over a third report, they wouldn’t be surprised if they heard a major security failure had occurred — meaning that cloud professionals might not be as confident as they believe themselves to be.
Do cloud professionals simply accept security breaches as a way of being, despite their best efforts? Or are they focusing on the wrong aspects of cloud security altogether and not realizing it?
Cloud is growing, and security needs to keep up, too. If you’re looking for better ways to secure your cloud or find the entire cloud environment too complex to even know where to begin, here’s some guidance for making 2021 the year of better cloud security.
Cloud Security Goals For 2021
Cloud professionals are looking to focus on specific things in the near future to address their security posture and how their team manages it, according to the report. They include:
Improving real-time monitoring. Clouds can’t be secured by simply inspecting logs, much like on-premise data centers once were. They require continuous monitoring of the configuration state of all assets to ensure compliance, and organizations know they need to make that a priority.
Becoming more proactive and less reactive. Security should obviously start long before a breach happens, yet too often, organizations don’t start thinking about security until after the damage is done. Cloud professionals want to be more proactive with their security so they can anticipate what’s coming rather than seeing what just hit them.
Increase automation. Some jobs can only be done manually, but monitoring all assets in the cloud, supporting new resource types, and determining remediation plans by hand is an impossible task. Organizations know that they need more automation and want to find ways to do it.
Reducing overall complexity. With the number of assets and applications, the ever-evolving landscape, the multiple pipelines, and all those who interact with it, cloud environments are complex things. Organizations want to find ways to reduce complexity and streamline their approach to security.
Organizations looking to address these concerns may look at implementing a CSPM solution, which can provide an at-a-glance view of the entire cloud environment, automated monitoring, alerts, and remediation, and can streamline security into a single dashboard.
How To Implement A CSPM
CSPM tools are great solutions, but you need to know what you’re trying to solve first. If your organization hasn’t internalized why it even wants a CSPM, the success of its adoption will be fraught. A CSPM solution, on its own, without a strategy, won’t help a lot, so it’s important that you implement it the right way. It’s so important that CSO Online cites a lack of cloud security strategy as third in their top cloud security threats. Spend time identifying what issues you need to address, who will own the solution, and how you’ll integrate it into your cloud operations before you look at tooling.
Next, get the team on board and involved with the implementation of a CSPM. Cloud security doesn’t just belong to a dedicated security team, and as we’re seeing security focus shift to the left, from runtime to development, so make sure DevOps teams and even leadership are part of the planning process and make CSPM part of your core cloud operations. A new report by the Cloud Security Alliance found that most organizations are confused over which team should own cloud security — you don’t want your organization to mismanage cloud security too.
If the major concerns for organizations are managing security baselines, data leakage, and configuration drift, then make sure to identify both industry and company standards to define your baseline so you can immediately see where you’re drifting.
Now it’s time to find a CSPM solution that addresses your cloud needs. You want to look for a tool that offers:
• Visibility across all of your multi- or hybrid-cloud environments.
• Inventory and classification of assets.
• Detect changes as they happen.
• Provide context for changes.
• The status of your compliance and the ability to resolve compliance issues automatically.
• Ability to quantify your security posture.
Finally, CSPM doesn’t entirely remove the need of having people who understand the cloud — it allows personnel to accomplish more with limited experience, but training is still required for success and scale. Even the most experienced teams train on cloud security vulnerabilities and establish and update processes that will allow cloud security to scale as your organizational cloud footprint grows.
Predictions For the Future
CSPM isn’t just responsive security monitoring — it’s workload protection as well. As cloud APIs evolve and include more rich information about workloads, so will CSPMs. As cloud platforms and services gain deeper functionality, CSPM tools are going to be able to provide deeper and broader insights and will be able to identify new types of configuration problems.
CSPM tools will continue their shift left to the DevOps team, and with their ability to generate and retrieve more information, CSPM solutions will become much more integrated into cloud operations than in the past. They’ll be able to scan for compliance before deployment, and the information provided about the whole cloud application environment can help with SRE activities as well.
Finally, a new report on “Cloud Security Posture Management Market” shows that CSPM tools and offerings are going to increase going forward, spurred on by the increase in cloud-based tools adoption during the Covid-19 pandemic.
