Companies are shifting applications and workloads to the cloud -- and the benefits are clear. Cloud services offer faster services, better collaboration, and are more cost-efficient. Switching to the cloud also gives organizations more flexibility and greater scalability for the future. Perhaps most importantly, however, is automation's ability to help security teams reduce the mean time to remediate (MTTR) vulnerabilities
Without a proper automation framework in place, however, the odds are stacked against cloud security teams to remediate vulnerabilities quickly before attackers can exploit them.
In study after study, organizations report that their security operations centers are understaffed and overwhelmed. High staffing requirements and a lack of skilled staff topped the list of challenges facing Security Operation Centers in a 2022 survey conducted by SANS. In another survey of IT professionals, nearly 6 in 10 respondents reported receiving an average of 500 public cloud security alerts every day, the equivalent of 21 alerts per hour.
The reliance on manual remediation processes means analysts must sift through a firehose of information that includes not just low-level vulnerabilities and false positives, but also hidden and critically vulnerable assets that put their organization at serious risk of an attack. Not surprisingly, the average MTTR for vulnerabilities at most companies hovers between 57 and 64 days, according to Edgeware’s 2022 report which included over 40,000 web application and API assessments and 3 million network endpoint assessments.
How automation bolsters cloud security and morale
While automation is no panacea on its own, there’s proof that – when done correctly – it can deliver major benefits to efficiency, accuracy, and staff morale.
Automated cloud security software can help organizations address skills shortages by reducing the number of new employees necessary to manage effective security protocols. Modern automated security platforms are able to process large volumes of data quickly and produce accurate, consistent outputs. Patch deployment can also be managed quite effectively with an automated tool.
When automation does much of the legwork, security teams are able to focus on critical needs of the organization's infrastructure. For example, some vulnerabilities may not have an immediate resolution, and instead require a workaround. With an automated tool taking care of simple (but time-consuming) tasks, security employees can ensure that a workaround gets put into place before a threat actor wins an exploit. In this manner, automation reduces MTTR on two fronts: by deploying accessible patches as they are released, and by giving security professionals more time to focus on more complicated tasks.
Considerations for introducing cloud security automation
For organizations exploring automation as an option, it’s worth considering how it could impact existing processes and personnel – and what it takes to introduce it effectively. Here are a few pointers to keep in mind:
#1: Assess the SOC to identify suitable areas for automation. Organizations should think strategically about what should and shouldn’t be automated. For example, cloud security posture management (CSPM) and cloud workload protection (CWP) are sensible targets for automation because their operation hinges on defining and enforcing security rules and configurations for different cloud environments and workloads. Threat hunting or penetration testing, on the other hand, are less suitable for automation as they emphasize investigative skills and hypothesis testing that humans are uniquely suited for.
#2: Leadership should position automation as an enabler. The last thing security teams want is another distraction or, worse, the suspicion that their job might be on the chopping block. CISOs should make communication a priority as they introduce automation, framing it as an enabler that can eliminate the drudge work while granting staff more time to focus on critical vulnerabilities.
#3: Consider no-code automation to make security more accessible. More software vendors are recognizing the difficulties of recruiting and retaining technical staff in such a competitive industry. To that end, no-code security automation is gaining in popularity for how it makes cloud security management more accessible to the non-technical user. Qualys Flow, for example, is a no-code automated workflow creation tool that translates security events, data, and actions into nodes which users can shift and redefine as needed, depending on their security aims. No knowledge of code is needed.
#4: Platform approach is recommended. It’s recommended that organizations integrate automation using a platform approach. The cloud is a powerful tool for scaling operations to meet business demands, but that can introduce unnecessary complexity if organizations pursue cloud initiatives in piecemeal fashion. Instead, consider integrating cloud security automation tools into a single platform so that SOC staff have shared visibility and context for interpreting any and all network activity.
