Cloud Security: Whose Job Is It?

Originally published by SkyHawk Security.

Written by Jennifer Gill.

 

There are several reasons why cloud security is so challenging, and the leading issue is roles and responsibilities. In the cloud there are three main groups that interact when securing the cloud: Cloud Security Team, Security Operations Center, and DevOps. These teams do not report to one another or manage one another so clear communication to enable collaboration is key. Additionally, command decision making and direction from responsible executives, like the CIO and/or CISO is essential as well.

 

Cloud Security Team

The Cloud Security Team has a cloud-only perspective of the configuration of the cloud and lacks the context of the asset exposed by the configuration. For example, a CNAPP finding might indicate a critical issue with a single asset exposed by toxic combination, so to the cloud security team it appears extremely vulnerable. The cloud security team may prioritize this as a top issue that DevOps team must address immediately.

The DevOps team has cloud context. DevOps sees the toxic combinations are there, but in an empty sandbox environment. This leads to a lot of back and forth between the two teams, wasting time and resources while security issues impacting crown jewel assets are ignored.

 

Security Operations Center

The Security Operations Center (SOC) is another group within the overall cloud security group that is responsible for addressing real-time threats and the daily alerts that come in. The SOC is typically overwhelmed with alerts across the entire business. For the cloud, it is very difficult to determine the relationship between the thousands of daily alerts, so security teams must manually determine whether the threat is real or not, and this takes tremendous amounts of time and effort. At the end of all of this, most of the time, there are no significant findings, and the SOC team has just wasted their time – this leads to real burnout.

 

Development Operations (Dev)

The DevOps team just wants to do their work. When I was at re: Invent, a developer came to our booth and mentioned that he was unhappy (not his exact words) with a popular CNAPP product.

“We get all these ‘alerts’ which are clearly labeled ‘sandbox’, why doesn’t the cloud security team understand these are not important! I have real deadlines that drive company revenue.”

This again leads to a lot of back and forth with all three teams wasting time explaining to one another why something is or is not important.

 

Lack of Context and Understanding

There are three teams that all have a role and there is no single view to show the teams how they need to work together to provide the context and understanding so each group understands how their work and role impacts the other.

Organizations should look for a preemptive cloud security platform that shows the relationship between a misconfiguration and the value of the asset that is exposed. This clear relationship helps the security team work with the DevOps team to understand why this fix is needed. An AI-based Purple Team shows, definitively, how the work each team is doing impacts the other. Cloud thread detection and response (CDR) gives the team the evidence they need to understand what is an actual alert and requires attention and makes recommendations on what action to take.