Shifting Left In Enterprise Cloud Security

As of 2022, 94% of enterprises use cloud services. Confidence in the cloud has grown over the last 12 to 18 months, with 35% of organizations having more than 50% of their workloads in the cloud. While businesses are quick to deploy cloud solutions at scale, we’re not seeing the same rapid adoption of preventative cybersecurity measures to keep this widened attack surface protected.

In fact, in today’s landscape of constantly evolving cyber threats, and the increased popularity of multi-cloud architectures, hackers have never had more ways into a company network or been in a better position to launch an effective attack
  
All it takes is one misstep to leave the door wide open. For example, this year, a misconfigured Microsoft server led to the data of 65,000 entities worldwide being put at risk. Naturally, this prompted conversations about what businesses can do to keep themselves secure. Especially around how businesses should “Shift Left”. Traditionally, security is implemented once development has been completed. This often raises concerns about vulnerabilities or misconfigurations that need addressing before applications go live.

This conflict between speed and safety can cause unnecessary friction, which could be avoided if security is built-in from day one.  
 
But, with 45% of businesses lacking qualified security experts it can be difficult to know where to start. Let’s look at the current state of play and how organizations can better secure their cloud environments.  

Common Cloud Challenges  

Cloud services offer a lot of benefits. They give organizations the freedom to scale up or down with ease; an advantage once reserved to the biggest companies with the deepest pockets. Now, you can set up cloud applications with nothing more than a credit card. However, that ease of deployment doesn’t make these environments any simpler to configure or secure, and often cloud security gets dismissed if it slows the process down. 
 
Another common problem I encounter when I speak to companies is that, despite the ‘Shift Left’ approach being a popular talking point, it isn’t being implemented across an entire organization. For example, one team may have automated scans built into the fabric of its DevOps practice, while other teams are manually checking change requests. This variation in processes could introduce a significant level of risk.

Bringing It All Together 

There needs to be consistency across an entire organization to produce a joined-up approach to cloud security which can be delivered through a consolidated security platform.  
 
There are a lot of benefits to using a consolidated platform that offers a single view of multiple risk areas across their cloud estate. If you can't see it, how are you going to secure it? A cloud account could have thousands of different assets within it, ranging from general object storage to mission-critical databases. If there is a misconfiguration or incorrect admin rights, a single policy might inadvertently give access privileges to a malicious user, which could have damaging consequences. 
 
It’s important to ensure that your tool of choice has an easy-to-use interface and offers a way to simply navigate the cloud environments it connects to. Layering a complicated product on top of an already complex cloud platform is only going to make the job harder. Look for solutions that give you the flexibility to implement both manual and automated fixes for issues that you encounter. If the tool can integrate with existing services and platforms you use, this will save you from overriding workflows that you have already invested time and effort into. 
 
It is also important to give employees, contractors, or consultants appropriate training on how to prevent breaches on your cloud network. However, with the right tools in place, you no longer have to rely heavily on your disperse workforce to be the first line of cyber defence.  

Getting Top to Bottom Buy-in On Security 

Presenting the data in a way that’s suitable for the intended audience is essential. Your C-suite aren’t going to care which version of an open-source module you’re using, or that your storage account in any given cloud platform has a misconfiguration of some obscure property. They want to know what risk that poses to the business and its ability to deliver to customers. Inversely, a DevOps engineer isn’t going to find a graphic that says ‘you have ten critical risks in your cloud’ something they can action and will need more in-depth information.

Building custom interfaces to your data is essential to getting a buy-in from the wider business. If the tool you’re interested in works for you from a technical level, but also has value at a management level, it’s going to be a lot easier to get approval of such a tool. 

Looking Ahead 

It is not a far stretch to suggest that we are in the midst of a cyber-pandemic. By 2025, forecasters anticipate that cyber crime is going to inflict $10.5 trillion worth of damage on an annual basis.

With such large losses at stake, companies need to invest in preventative measures to safeguard their cloud estates against cyberattacks.

By making sure that you have a set of well-defined guidelines for what is acceptable and what is at risk, you can deploy automated rules across sprawling networks and have confidence that your assets are safe, no matter where they are.   

Stuart Green is Cloud Security Architect at Check Point Software  

You Might Also Read: 

Pivoting Customers' Mindsets For Cloud Security:

 

« Simplicity In Complexity: The Key to Successful Threat Exposure Management
Navigating The Evolving Threat Landscape »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

SecDev

SecDev

SecDev is a consulting firm working at the intersection of geopolitical, digital, urban, energy and cyber risk.

Absolute Software

Absolute Software

Absolute provides persistent endpoint security and data risk management solutions for mobile devices - computers, tablets, and smartphones.

DataCore Software

DataCore Software

DataCore Software is a leader in Software-Defined Storage. Solutions offered include back up and disaster recovery.

Institute for Critical Infrastructure Technology (ICIT)

Institute for Critical Infrastructure Technology (ICIT)

ICIT is a leading cybersecurity think tank providing objective research, advisory, and education to legislative, commercial, and public-sector cybersecurity stakeholders.

Information-Technology Promotion Agency (IPA) - Japan

Information-Technology Promotion Agency (IPA) - Japan

IPA is an implementing agency in Japan with a role to address Information Security, IT Systems Reliability and IT Resource Development.

Exida

Exida

Exida is a leading product certification and knowledge company specializing in industrial automation system safety, security, and availability.

NESEC

NESEC

NESEC is a specialist in information security consulting services and solutions.

ReversingLabs

ReversingLabs

ReversingLabs develops cyber threat detection and mitigation tools that address the the latest directed attacks, advanced persistent threats and polymorphic malware.

Clearswift

Clearswift

Clearswift is trusted by businesses, governments and defense organizations globally for its Adaptive Cyber Security and Data Loss Prevention solutions.

KOVRR

KOVRR

Kovrr financially quantifies cyber risk on demand. Our technology enables decision makers to seamlessly drive actionable cyber risk management decisions.

ThreatGen

ThreatGen

ThreatGEN™ works with your team to improve your resiliency and industrial cybersecurity capabilities through an innovative and modernized approach to training and services.

Blueskytec (BST)

Blueskytec (BST)

Blueskytec has applied its experience of over three decades of working in the field of embedded systems and encryption to provide a scalable and appropriate technology for cyber-physical devices.

Defscope

Defscope

Defscope is an Azerbaijani company entirely focused on cybersecurity offering training, security consulting, and other professional services.

Motiv ICT Security

Motiv ICT Security

Motiv is the ICT security specialist that provides public and private sector organisations with IT security solutions and services to prevent cybercrime, data theft and data breaches.

Dion Training Solutions

Dion Training Solutions

Dion Training Solutions offer comprehensive training in areas such as project management, cybersecurity, agile methodologies, and IT service management.

Certcube Labs

Certcube Labs

Certcube Labs provide a broad range of services in the areas of Assessments, Development, Risk Advisory, Blockchain, Forensics Investigations, Managed Security Solutions, and IT Security Trainings.