Back to Basics: A Fundamental Approach to Cloud Security
January 12, 2021

Om Moolchandani

College football coaches say it. Investment advisers emphasize it. Meditation practitioners live by it. The sentiment is so ingrained in the popular imagination that it gained cliché status a long time ago. But there's no question that even a hackneyed phrase can have true meaning — and perhaps it's time cloud security specialists embrace it.

The simple phrase here: "Let's go back to the fundamentals."

That's actually a high hill to climb in the world of cloud computing: The field virtually mandates a nonstop flow of new tools and capabilities. Each advance surely adds to the already-long list of benefits to be accrued by moving to the cloud, but many also create serious risks. This fundamental — there it is again — incongruity can undermine the entire potential of this vital discipline.

The latest Accurics research report, The State of DevSecOps, vividly highlights this ongoing issue. This report followed the previous edition by only a few months, yet in that short time there's been a slew of headline-grabbing incidents. Servers containing personal information from popular dating apps got hacked, fitness brands found their data privacy compromised, and customers' financial details from payment providers got exfiltrated.

But when we look past the headlines and go deep into the details, it becomes apparent this isn't only the work of sophisticated cybercriminals. Yes, there are plenty of those — but it's also clear that more mundane issues are to blame.

For example, the report details how misconfigured cloud storage services are commonplace in the vast majority of cloud deployments analyzed, around 93%. On an entirely related note, a majority of deployments also featured at least one network exposure that left a security group wide open. These seem like minor issues, but the reality is truly distressing — these two practices alone help account for more than 200 breaches exposing 30 billion records in just the past couple of years.

So how does this go so badly wrong? Why don't these problems get caught earlier?

Again, it goes back to the basics. Having best practices in place — every policy violation must be addressed immediately — is a no-brainer. But consider the volume: When there's an endless stream of alerts about such discrepancies, and many are likely minor, it's a very human impulse to disregard at least some of the warnings.

Here's an example: When multiple hardcoded private keys turn up, standard policies dictate that the risk from each is assessed individually. That's enormously time-consuming, which is why security specialists understandably focus more on keys actually being used, since these pose a more immediate risk. This is also typically a manual process, which gives attackers time to identify weak spots. Eventually, those unused and unexamined keys can become a gateway for the bad guys.

How serious is this problem? Accurics' research finds that nearly a half of all organizations have at least one hardcoded key with high privileges used to provision compute resources. A breach here flings open the doors to all associated resources.

Another fundamental flaw is that that 90% of organizations give users the freedom and authority to change the cloud native infrastructure in runtime. Again, flexibility is a vital component of cloud-driven operations, but this is where we find a clear connection to critical exposures. In sum, even as organizations devote considerable resources to multiple aspects of cloud security — with an emphasis on top-notch security when cloud native infrastructure is originally defined — a subsequent drift can lead to chaos.

There is a strong correlation between the top types of cloud infrastructure drifts and the risks that create serious exposures. This implies that even if organizations exercise strong security hygiene when cloud native infrastructure is initially defined, drifts in runtime will create exposures.

Again, the research here turns up damning numbers: Security groups created or modified in 100% of deployments, IAM policy changes in 82% of deployments, and so on.

Fundamental problems like these require fundamental solutions. Top of the list: Security must be codified into development pipelines and enforced throughout the lifecycle. The work isn't done when the policy is enforced across Infrastructure as Code and a secure baseline is created — there's too much happening after that. Going a level deeper, we clearly need an additional set of principles:

■ Policy as Code: Emerging types of misconfigurations must be countered with policy guardrails embedded throughout the development lifecycle.

■ Security as Code: High severity misconfigurations have to be addressed, swiftly and comprehensively — and that can only be achieved with enhanced threat modeling.

■ Drift as Code: Any resource and configuration change from the secure baseline must be detected and assessed for risk.

■ Remediation as Code: Automated detection with manual remediation is doomed to failure; the latter must be codified into the development pipeline.

The cloud builds on technological innovation and offers undeniable benefits. Moving forward, the tools and capabilities emerging each day must be matched with programmatic security to keep the infrastructure safe.

Om Moolchandani is Co-Founder, CTO and CISO of Accurics
Share this

Industry News

August 15, 2022

Gadget announced Connections, a major new feature that gives app developers access to building blocks that enable them to build and scale ecommerce apps in a fraction of the time, at a fraction of the cost.

August 15, 2022

Opsera is on the Salesforce AppExchange to help enterprise customers shorten software delivery cycles, improve pipeline quality and security, lower operations costs and better align software delivery to business outcomes.

August 15, 2022

Virtusa Corporation earned the DevOps with GitHub on Microsoft Azure advanced specialization, a validation of a services partner's deep knowledge, extensive experience and proven success in implementing secure software development practices applying DevOps principles and using Azure and GitHub solutions.

August 15, 2022

Companies looking to reduce their cloud costs with automated optimization can now easily procure CAST AI via Google Cloud Marketplace using their existing committed spend.

August 11, 2022

Granulate, an Intel Company, announced the upcoming launch of its latest free cost-reduction solution, gMaestro, a continuous workload and pod rightsizing tool for Kubernetes cost optimization.

August 11, 2022

Rezilion announced the availability of MI-X, a newly created open-source tool developed by Rezilion's vulnerability research team.

August 11, 2022

Contrast Security announced its enhanced application programming interface (API) security capabilities within the Contrast Secure Code Platform.

August 10, 2022

Mirantis made it even easier to integrate Mirantis Container Cloud into developer workflows and provide developers and operators with easy access and visibility into the Kubernetes clusters with the Mirantis Container Cloud Lens Extension announced today.

August 10, 2022

ArmorCode announced an integration with Traceable AI which will bring its data into the ArmorCode platform and improve Application Security Posture from code to cloud.

August 10, 2022

Quali unveiled enhanced features for its Torque platform to unify infrastructure orchestration and governance.

August 09, 2022

Veracode announced the enhancement of its Continuous Software Security Platform with substantial improvements to its integrated developer experience.

August 09, 2022

Normalyze announced General Availability for its Freemium offering, a self-serve, free platform that democratizes data discovery and classification in all three public clouds, Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

August 09, 2022

Traceable AI announced enhanced capabilities to address more specific types of API attacks, including API abuse and misuse, fraud and malicious API bots, all of which contribute to serious data security and compliance challenges within organizations today.

August 08, 2022

Contrast Security announced that software composition analysis (SCA) is now available for free in CodeSec.

CodeSec offers free application security testing and SCA in a single, developer-friendly interface.

The new SCA feature will enable developers to easily identify vulnerable third-party libraries quickly and accurately, getting secure code moving in minutes.

August 08, 2022

CloudBees announced Anuj Kapur as President and CEO.