5 mins to read
You can’t protect what you can’t see. Organizations making a move to the public cloud or that are already in the cloud face visibility challenges. Visibility is everything when it comes to cloud security strategy. In an ideal environment, end-to-end visibility across multi-cloud grants teams the contextual knowledge necessary to manage risk effectively.
According to a recent survey of 200 IT and security professionals, two-thirds do not have cloud visibility confidence. For example, the Cloud Security Alliance (CSA) listed cloud usage visibility in its “Top Threats to Cloud Computing. According to CSA, visibility-related risk leads to a lack of governance, awareness, and security, resulting in cloud security data breaches.
Cloud Visibility Challenges
Is your company currently struggling to see what identities have access to data in your cloud? If so, you are not alone. Enterprises everywhere lack visibility leading to risk. Here are the top challenges:
Challenge 1: Ensuring the Security of People and Non-people Identities
Cloud security teams face visibility challenges in identities (e.g., what and where are the identities, people and non-people) and their effective permissions. For example, cloud architectures have hundreds of resources running at any one time, with people and countless non-people identities accessing them. Ensuring the cloud security of all these identities poses a unique challenge.
Identities can assume a role with specific permissions. First, they then use that role’s rights to assume another role, leading to excessive permissions that violate least privilege. Secondly, with the ephemeral nature of the cloud, the abuse can be completely concealed from monitoring services with intermittent auditing timeframes. Lastly, what complicates matters more is that privileged identities can switch roles as required, producing temporary permission chains of escalated privilege that are left unchecked.
Solution: Continuous Effective Permission monitoring
Security teams are relying on identity management built with the concept of ‘one (human) user, one identity.’ This type of management can’t see new kinds of cloud-specific privilege abuses. The ability to continuously monitor effective permissions is needed. An identity’s potential access paths are not linear, but part of a web of interlocking roles, privilege escalation capabilities, permissions, trust relationships, and user groups. A graphing function that provides detailed visibility into every identity is the only way to ensure least privilege enforcement.
Challenge 2: Ensuring Data Security
Teams must track a staggering amount of data accessed throughout multi-cloud environments. As a result, at any given moment, identities are accessing thousands of data stores. All this data access without end-to-end visibility across multi-cloud leads to hidden risk.
Traditional data protection tools lack contextual understanding of data, such as sensitivity or PII. You might have sensitive PII data sitting in a misconfigured AWS S3 bucket, for example, which isn’t labeled. Without contextual visibility into your data, you won’t know it’s sitting there unprotected.
Even if you know where your sensitive data is, cloud security teams face the challenge of understanding where it went. Data can reside and move across multi-cloud environments. However, teams will find it challenging to continuously monitor the data without a standardized, singular view of data movement.
Challenge 3: Overcoming Complexity
Above all, cloud by nature is complex. Compute spins up and spins down in a matter of minutes, even seconds. Therefore, the ephemeral nature of the cloud makes it even harder to continuously monitor resources with complete visibility.
That is to say, cloud complexity adds up when developers rapidly accelerate production schedules without forethought into the complexity introduced. Stakeholders often want to speed up development that adds identities and resources with innumerable endpoints. Their understanding is that the cloud provides infinite scalability. But they mistake cloud as the ultimate solution to always keep assets safe, which is not the case.
Unfortunately, cloud complexity continues to grow. Security teams need a streamlined way to view how identities access resources when identity is the perimeter.
Challenge 4: Different Security Models Across CSPs
Each provider’s cloud security model is handled differently with no standardization. Their cloud security models do not address third-party data stores. CSPs often require the use of low-level tools where just one misconfiguration can lead to disastrous outcomes. Cloud provider security tools won’t track data once it leaves their cloud, resulting in visibility gaps.
Gaining Visibility in Multi-Cloud
Your ability to gain visibility in the public cloud hinges on gaining access to the data needed from the clouds. IT professionals can do this with a cloud security platform solution that covers cloud resources.
Sonrai Security Can Help
Sonrai Dig provides complete visibility across your multi-cloud, which is a big win when you’re dealing with hundreds-to-thousands of accounts. Understanding that identities and data can jump through multi-cloud, Sonrai Dig provides normalized views across multi-cloud and controls of cloud identity and access to data.
Identity Security
Sonrai Dig discovers, normalizes, and displays all findings across AWS Accounts, Azure Subscriptions, and GCP Projects on a graph. The graph exposes all identities and provides detailed visibility into every role, privilege, permission, trust relationship, and group. This gives teams an understanding of their effective permissions. Sonrai delivers visibility into identity chains. You can see the identity, groups to which they belong, policies, and trust relationships. You can understand how their permissions can increase access. With this understanding, teams have an actionable roadmap to achieve least privilege and stay there.
Data Security
With Sonrai Dig, teams can discover and continuously monitor data stores, graphically mapping what data exists, where it exists (including sensitive “crown jewel” data), what has access to it, what happened to it, and where it went. Teams can lock down the structured and unstructured data and continuously monitor it with deep-dive capabilities across multi-cloud.
Teams can identify sensitive data, such as PII, and classify it as such. With the data classified, they can determine what is already locked down, what needs to be locked down and take steps to reduce the risk.
Intelligent Cloud Security Posture Management (CSPM)
Sonrai Dig’s Intelligent CSPM delivers teams complete visibility, including contextual knowledge of their environments. Sonrai’s CSPM uncovers every resource and ensures that teams have configured their multi-cloud securely. Therefore, the platform provides detection for when drift occurs, which is a deviation from the established security baseline. Sonrai Dig alerts teams of Drift for immediate review and remediation.
Out-of-the-box, our platform has frameworks at your fingertips. For internal governance controls (NIST CSF, ISO 27001), established regulatory frameworks (HIPAA, PCI-DSS, SOC 2), and laws (EU GDPR), drastically reducing the heavy lifting needed to implement these frameworks.
Governance Automation
Sonrai Dig provides intelligent workflows and automated remediation capabilities, aligning with a shift-left approach to security. Teams can address risk at the speed and complexity of multi-cloud, catching issues before they become bigger problems.
Through our “swimlane” approach, teams can send the right issue to the team responsible at the right time. Only the teams can see the tickets, reducing alert fatigue. In older approaches, a single team was responsible for a continuous backlog onslaught of issue tickets to triage and remediate. An overwhelming process, which would often lead to missed alerts.
Sonrai also integrates with your CI/CD pipeline to truly understand risk throughout your multi-cloud. Certainly, if there is a risk that you don’t have visibility into, Sonrai Dig will find it. Sonrai can automatically escalate the issue by alerting responsible teams or auto-remediate. Also, teams can also leverage Sonrai’s built-in prevention bots. Sonrai Dig addresses each of the security pillars of security mentioned in this article. Are you ready to discover how Sonrai Security can help with visibility and cloud security management? Schedule a demo today.
Read the latest news and insights
06.23.2020
Understand and better manage your organizations sensitive...
