Moving operations to the cloud allows companies to cost-effectively do business with a global customer base and workforce. However, cloud computing comes with additional security challenges that require tools to manage effectively. These tools offer visibility across a variety of cloud environments and help automate detection of vulnerabilities and configuration/compliance risks. Here we break down the six types of cloud security solutions that your business might utilize to improve your security posture.
Cloud Access Security Brokers (CASB)
Cloud Access Security Brokers allow security professionals to extend their enterprise security policies to their cloud applications. They stand between the cloud service provider and the user to monitor things like access to data, compliance with regulations, and malware detection. CASB address four fundamental pillars: data protection, threat protection, identity, and visibility.
Data Protection: One of the benefits of cloud computing is easier remote access to data, but that also introduces additional risks, including data traveling between cloud environments and threat actors gaining access to sensitive data undetected. CASB allow visibility into the movement of data in the cloud and provide data protection features such as encryption, tokenization, and access control.
Threat Protection: CASB can use behavior analytics to identify abnormal user behavior for early detection of a compromised account or insider threat. They can also help detect and prevent malware from being uploaded or shared across the cloud.
Compliance: You, as the cloud user, are responsible for ensuring that you comply with regulations such as PCI DSS. CASB help monitor for compliance and identify areas of risk that may need to be addressed.
Visibility: CASB were first developed for the purpose of gaining visibility into cloud usage, particularly unsanctioned use of SaaS applications or Shadow IT. Today, as businesses transition fully to the cloud and are allowing increased access to cloud applications through remote work and BYOD, visibility remains an important function of CASB. These solutions can help identify suspicious requests and make it easier to allow access to cloud services while limiting specific activities and user access within these broad applications.
Static Application Security Testing (SAST)
Static Application Security Testing tools scan source code, byte code, and binaries for security vulnerabilities such as SQL injection and help remediate these issues with the goal of having fewer vulnerabilities after an application is launched. The “static” in static application security testing refers to the fact that this scan is done without actually executing the code. This differs from DAST (Dynamic Application Security Testing), which is done while the application is running and therefore is done closer to the end of the development process. With cloud-based apps, it is essential to consider security vulnerabilities that may only be demonstrated at run-time and use DAST in combination with Static Application Security Testing.
Secure Access Service Edge (SASE)
Secure Access Service Edge is a newer approach to cloud security that reduces latency for remote users by inspecting and approving traffic at a closer enforcement point, as opposed to routing all traffic to a data center to be inspected and sent back. This is particularly beneficial as companies retain work-from-home policies in the wake of the COVID-19 pandemic but can be costly and work-intensive to stand up and maintain.
Cloud Security Posture Management (CSPM)
In a recent report, Gartner states that “through 2022, at least 95 percent of cloud security failures will be the customer’s fault.” Misconfiguration is one of the biggest problems that companies face when implementing a transition to the cloud. Cloud Security Posture Management tools help identify and prevent configuration mistakes and identify areas of non-compliance. These tools can be used for continuous monitoring after initial configuration as well, but teams need to plan carefully for effective implementation and cost.
Cloud Workload Protection Platforms (CWPP)
Cloud Workload Protection Platforms protect at the workload level. They have the ability to protect virtual machines (VMs), serverless workloads, and containers, helping to ensure security across public, private, or hybrid cloud environments, giving the user one centralized location for management of their workload security, regardless of the variety of cloud services used. CWPP are particularly beneficial for the rapid development cycle as it provides security assistance for applications developed using cloud workloads and can mitigate some of the security issues from rapid DevOps.
Cloud Infrastructure Entitlement Management (CIEM)
Cloud Infrastructure Entitlement Management tools help manage identity and access in the cloud by utilizing the least privilege principle. They help cloud users manage IAM across multiple cloud environments for one unified approach to identity.
If you’re overwhelmed by the volume of cloud security tools out there, don’t worry. As the cloud evolves and adoption increases, many vendors are combining these tool capabilities. According to Palo Alto’s 2022 State of Cloud Native Security Report, the number of organizations using six to ten security vendors went down by 19% from 2020 to 2021. Similarly, nearly three-quarters of respondents used ten or fewer security tools, indicating consolidation of the tool market.
Unsure which tools to use? RH-ISAC members can post RFIs in the CISO and Analyst communities to get recommendations from peers on the right tools for your tech stack. Another great resource is the Tech Marketplace which highlights some of the cloud security tool providers that RH-ISAC partners with. Learn more about RH-ISAC membership.
