Back to Basics: A Fundamental Approach to Cloud Security
January 12, 2021

Om Moolchandani

College football coaches say it. Investment advisers emphasize it. Meditation practitioners live by it. The sentiment is so ingrained in the popular imagination that it gained cliché status a long time ago. But there's no question that even a hackneyed phrase can have true meaning — and perhaps it's time cloud security specialists embrace it.

The simple phrase here: "Let's go back to the fundamentals."

That's actually a high hill to climb in the world of cloud computing: The field virtually mandates a nonstop flow of new tools and capabilities. Each advance surely adds to the already-long list of benefits to be accrued by moving to the cloud, but many also create serious risks. This fundamental — there it is again — incongruity can undermine the entire potential of this vital discipline.

The latest Accurics research report, The State of DevSecOps, vividly highlights this ongoing issue. This report followed the previous edition by only a few months, yet in that short time there's been a slew of headline-grabbing incidents. Servers containing personal information from popular dating apps got hacked, fitness brands found their data privacy compromised, and customers' financial details from payment providers got exfiltrated.

But when we look past the headlines and go deep into the details, it becomes apparent this isn't only the work of sophisticated cybercriminals. Yes, there are plenty of those — but it's also clear that more mundane issues are to blame.

For example, the report details how misconfigured cloud storage services are commonplace in the vast majority of cloud deployments analyzed, around 93%. On an entirely related note, a majority of deployments also featured at least one network exposure that left a security group wide open. These seem like minor issues, but the reality is truly distressing — these two practices alone help account for more than 200 breaches exposing 30 billion records in just the past couple of years.

So how does this go so badly wrong? Why don't these problems get caught earlier?

Again, it goes back to the basics. Having best practices in place — every policy violation must be addressed immediately — is a no-brainer. But consider the volume: When there's an endless stream of alerts about such discrepancies, and many are likely minor, it's a very human impulse to disregard at least some of the warnings.

Here's an example: When multiple hardcoded private keys turn up, standard policies dictate that the risk from each is assessed individually. That's enormously time-consuming, which is why security specialists understandably focus more on keys actually being used, since these pose a more immediate risk. This is also typically a manual process, which gives attackers time to identify weak spots. Eventually, those unused and unexamined keys can become a gateway for the bad guys.

How serious is this problem? Accurics' research finds that nearly a half of all organizations have at least one hardcoded key with high privileges used to provision compute resources. A breach here flings open the doors to all associated resources.

Another fundamental flaw is that that 90% of organizations give users the freedom and authority to change the cloud native infrastructure in runtime. Again, flexibility is a vital component of cloud-driven operations, but this is where we find a clear connection to critical exposures. In sum, even as organizations devote considerable resources to multiple aspects of cloud security — with an emphasis on top-notch security when cloud native infrastructure is originally defined — a subsequent drift can lead to chaos.

There is a strong correlation between the top types of cloud infrastructure drifts and the risks that create serious exposures. This implies that even if organizations exercise strong security hygiene when cloud native infrastructure is initially defined, drifts in runtime will create exposures.

Again, the research here turns up damning numbers: Security groups created or modified in 100% of deployments, IAM policy changes in 82% of deployments, and so on.

Fundamental problems like these require fundamental solutions. Top of the list: Security must be codified into development pipelines and enforced throughout the lifecycle. The work isn't done when the policy is enforced across Infrastructure as Code and a secure baseline is created — there's too much happening after that. Going a level deeper, we clearly need an additional set of principles:

■ Policy as Code: Emerging types of misconfigurations must be countered with policy guardrails embedded throughout the development lifecycle.

■ Security as Code: High severity misconfigurations have to be addressed, swiftly and comprehensively — and that can only be achieved with enhanced threat modeling.

■ Drift as Code: Any resource and configuration change from the secure baseline must be detected and assessed for risk.

■ Remediation as Code: Automated detection with manual remediation is doomed to failure; the latter must be codified into the development pipeline.

The cloud builds on technological innovation and offers undeniable benefits. Moving forward, the tools and capabilities emerging each day must be matched with programmatic security to keep the infrastructure safe.

Om Moolchandani is Co-Founder, CTO and CISO of Accurics
Share this

Industry News

July 26, 2021

Parallel Agile announced a new version of CodeBot, a low-code MERN stack application generator.

July 26, 2021

Appian unveiled its new Appian Japan regional office.

July 26, 2021

CloudTruth raised $5.25 million in seed funding led by Glasswing Ventures and Gutbrain Ventures, with additional funding from Stage 1 Ventures and York IE.

July 22, 2021

Postman successfully obtained the System and Organization Controls (SOC) 2 Type 2 and SOC 3 Type 2 reports for the Postman API platform, meeting critical industry standards relative to the Trust Services Criteria for security, availability, and confidentiality.

July 21, 2021 announced its new Professional Agile Leadership – Evidence-Based Management (PAL-EBM) training course.

July 21, 2021

BMC announced several new innovations and integrations within the BMC Automated Mainframe Intelligence (BMC AMI) and BMC Compuware portfolios designed to improve threat detection and response and expand access to mainstream DevOps tools to modernize mainframe applications and increase developer productivity.

July 21, 2021

CognitiveScale announced the release of Cortex Fabric Version 6—a new, low code developer platform for automation, augmentation and transformation of knowledge work and digital experiences.

July 20, 2021

JFrog announced the closing of the previously reported acquisition of product security company Vdoo.

July 20, 2021

Wind River has introduced its latest release of Wind River Studio.

July 20, 2021

Sysdig announced intent to acquire Apolicy.

July 19, 2021

Red Hat announced Red Hat Advanced Cluster Management for Kubernetes 2.3, the latest version of the company’s enterprise-grade Kubernetes management offering.

July 15, 2021

Platform9 announced the launch of Platform9 Managed KubeVirt.

July 15, 2021

ShiftLeft announced general availability of ShiftLeft Educate, a solution that delivers highly-effective security training for developers within the developer workflow.

July 15, 2021

Appfire announced the acquisition of Spartez Software.

July 14, 2021

Contrast Security announced its integration with Secure Code Warrior to deliver security contextual micro-learning modules to enhance developers' skills to easily fix vulnerabilities without the need of a security team.