It comes as no surprise to enterprises when an otherwise productive employee unknowingly opens the organization to risk or even causes a breach. The knee-jerk culpability typically gets attributed to the cloud provider, yet Gartner warns that through 2025, at least 99 percent of cloud security failures are the cutomer’s fault.
Gartner’s statement implies that enterprises, not cloud providers, need to develop an all-encompassing approach to cloud security – but even the word enterprise isn’t clear enough: Who in the enterprise? Which groups do what? Where do the various parts of this problem lie? Who coordinates security issues?
High-profile breaches have demonstrated the importance of adopting a cloud security posture management (CSPM) strategy that thoroughly monitors the cloud environment and automatically alerts employees and internal IT teams to configuration and compliance issues. This level of cloud security amounts to a shared responsibility model, in which companies and cloud vendors each do their part to protect data from outside perpetrators as well as inside threats from employees. Ideally, this model would result in a dramatic decrease in risk, threats and breaches, but challenges still exist when enterprises do not meet their part of the shared responsibility model.
Security teams can strengthen cloud environments from internal and external threats by incorporating CSPM strategies that can:
Consolidate the IT stack. Complications increase when organizations recognize that monitoring proper security posture and configurations across cloud assets not only includes SaaS applications but also IaaS, PaaS, container and serverless environments. Enterprises can make a wrong turn by thinking they need to implement yet another tool to add to their cloud stack – especially as cloud service providers continue to rapidly innovate, leading to faster updates and configurable options. This just adds a layer of complexity to have to buy, integrate and manage for IT where instead they can rely on a cloud provider that offers an all-inclusive platform and one source of truth across all cloud assets and ideally even to the devices which connect to the cloud.
Eliminate silos. IT leaders across organizations are also coping with applications and service offerings that encourage even more silos – each with its own configuration. Developers are often at the helm of these applications, who may not find themselves entirely focused on critical details like checking configurations, application admins may have access to both data and the crucial user access controls, users may have wide capabilities to decide how to collaborate and with who. This leads to not knowing where data resides and who may have access to this data. The outcome of not having a firm handle on where data lives and how it’s transported and managed can result in incredibly damaging breaches. Working with a cloud provider that offers a full-scale control platform can ensure these issues are caught and remediated as early in the lifecycle as possible.
Empower immediate action. Companies need employees who are advocates and instantly take action against misconfiguration and enterprises need solid strategies and processes to circumvent risky decisions before they become full threats. This includes continuous audits as cloud configurations change over time. Together with an all-encompassing cloud platform, enterprises can more easily detect anomalous behavior – whether from a well-meaning employee or external menace.
We know from experience that CSPM works. Gartner reports that through 2024, organizations implementing a CSPM offering and extending this into development will reduce cloud-related security incidents by 80 percent. This prediction shows that these vulnerabilities do not necessarily materialize because underlying cloud services are insecure. Cloud services today are typically more secure than the on-premises infrastructure of the past. These threats exist when enterprises do not realize the importance of the shared responsibility model – or further, do not keep up their end of the bargain as changes occur across the organization.
Nonetheless, enterprises will still need to keep the same level of flexibility and speed to best serve their customers. Employees don’t always consider security until their job becomes hindered – but it’s now top-of-mind for CIOs and IT teams. Enterprises that can fully grasp these strategies and those that incorporate a solid CSPM approach will experience comprehensive and consistent data security, threat protection, governance and compliance across all cloud assets.
Nigel Hawthorn, director, cloud business unit, McAfee
