Back to Basics: A Fundamental Approach to Cloud Security
January 12, 2021

Om Moolchandani

College football coaches say it. Investment advisers emphasize it. Meditation practitioners live by it. The sentiment is so ingrained in the popular imagination that it gained cliché status a long time ago. But there's no question that even a hackneyed phrase can have true meaning — and perhaps it's time cloud security specialists embrace it.

The simple phrase here: "Let's go back to the fundamentals."

That's actually a high hill to climb in the world of cloud computing: The field virtually mandates a nonstop flow of new tools and capabilities. Each advance surely adds to the already-long list of benefits to be accrued by moving to the cloud, but many also create serious risks. This fundamental — there it is again — incongruity can undermine the entire potential of this vital discipline.

The latest Accurics research report, The State of DevSecOps, vividly highlights this ongoing issue. This report followed the previous edition by only a few months, yet in that short time there's been a slew of headline-grabbing incidents. Servers containing personal information from popular dating apps got hacked, fitness brands found their data privacy compromised, and customers' financial details from payment providers got exfiltrated.

But when we look past the headlines and go deep into the details, it becomes apparent this isn't only the work of sophisticated cybercriminals. Yes, there are plenty of those — but it's also clear that more mundane issues are to blame.

For example, the report details how misconfigured cloud storage services are commonplace in the vast majority of cloud deployments analyzed, around 93%. On an entirely related note, a majority of deployments also featured at least one network exposure that left a security group wide open. These seem like minor issues, but the reality is truly distressing — these two practices alone help account for more than 200 breaches exposing 30 billion records in just the past couple of years.

So how does this go so badly wrong? Why don't these problems get caught earlier?

Again, it goes back to the basics. Having best practices in place — every policy violation must be addressed immediately — is a no-brainer. But consider the volume: When there's an endless stream of alerts about such discrepancies, and many are likely minor, it's a very human impulse to disregard at least some of the warnings.

Here's an example: When multiple hardcoded private keys turn up, standard policies dictate that the risk from each is assessed individually. That's enormously time-consuming, which is why security specialists understandably focus more on keys actually being used, since these pose a more immediate risk. This is also typically a manual process, which gives attackers time to identify weak spots. Eventually, those unused and unexamined keys can become a gateway for the bad guys.

How serious is this problem? Accurics' research finds that nearly a half of all organizations have at least one hardcoded key with high privileges used to provision compute resources. A breach here flings open the doors to all associated resources.

Another fundamental flaw is that that 90% of organizations give users the freedom and authority to change the cloud native infrastructure in runtime. Again, flexibility is a vital component of cloud-driven operations, but this is where we find a clear connection to critical exposures. In sum, even as organizations devote considerable resources to multiple aspects of cloud security — with an emphasis on top-notch security when cloud native infrastructure is originally defined — a subsequent drift can lead to chaos.

There is a strong correlation between the top types of cloud infrastructure drifts and the risks that create serious exposures. This implies that even if organizations exercise strong security hygiene when cloud native infrastructure is initially defined, drifts in runtime will create exposures.

Again, the research here turns up damning numbers: Security groups created or modified in 100% of deployments, IAM policy changes in 82% of deployments, and so on.

Fundamental problems like these require fundamental solutions. Top of the list: Security must be codified into development pipelines and enforced throughout the lifecycle. The work isn't done when the policy is enforced across Infrastructure as Code and a secure baseline is created — there's too much happening after that. Going a level deeper, we clearly need an additional set of principles:

■ Policy as Code: Emerging types of misconfigurations must be countered with policy guardrails embedded throughout the development lifecycle.

■ Security as Code: High severity misconfigurations have to be addressed, swiftly and comprehensively — and that can only be achieved with enhanced threat modeling.

■ Drift as Code: Any resource and configuration change from the secure baseline must be detected and assessed for risk.

■ Remediation as Code: Automated detection with manual remediation is doomed to failure; the latter must be codified into the development pipeline.

The cloud builds on technological innovation and offers undeniable benefits. Moving forward, the tools and capabilities emerging each day must be matched with programmatic security to keep the infrastructure safe.

Om Moolchandani is Co-Founder, CTO and CISO of Accurics
Share this

Industry News

January 25, 2021

Progress announced the new release of Progress Kendo UI, a complete collection of JavaScript UI components.

January 25, 2021

CloudNatix announced the close of a $4.5M Seed round financing led by DNX Ventures, with the participation from a new investor Cota Capital and existing investors: Incubate Fund, Vela Partners and 468 Capital.

January 25, 2021

Quali announced $54 million in new funding, co-led by Greenfield Partners and JVP.

January 21, 2021

Platform9 released Platform9 Release 5.0, with a number of new features to provide operational efficiencies for its freedom, growth, and enterprise managed Kubernetes products.

January 21, 2021

Infragistics announced the release of Infragistics Ultimate 20.2, a complete UX and UI solution for  design and development teams  which is fully compatible with .NET 5, Microsoft’s latest  release of .NET development platform.

January 21, 2021

Couchbase Cloud is now available on Microsoft Azure.

January 20, 2021

Hitachi Vantara announced the availability of Hitachi Kubernetes Service, enabling customers to consistently and securely deploy, manage, monitor, and govern Kubernetes clusters across major cloud providers and on premises.

January 20, 2021

Internal announced the launch of an enterprise-ready app development platform for internal tools.

January 20, 2021

StackPulse announced a $20 million Series A led by GGV Capital.

January 19, 2021

GitLab announced GitLab Ultimate for IBM Cloud Paks, which is designed to help streamline team collaboration and increase team productivity with a comprehensive, easy-to-use DevOps platform.

January 19, 2021

Fugue announced new capabilities for bringing public cloud container resources into compliance and ensuring the continuous security of container runtime configurations.

January 19, 2021

Rookout announced new functionality that empowers software developers to debug other people’s code.

January 14, 2021

Oracle is making its popular APEX low-code development platform available as a managed cloud service that developers can use to build data-driven enterprise applications quickly and easily.

January 14, 2021

Parasoft announced its C/C++test update to support IAR Systems' build tools for Linux for Arm.

January 14, 2021

Harness raised $115 million in financing, reaching a valuation of $1.7 billion in just three years after launching from stealth.