Posted on Leave a comment

Why (CPSM) Cloud Security Posture Management solution is recommended for risk management leaders?

Home » Insight » Why (CPSM) Cloud Security Posture Management solution is recommended for risk management leaders?

Why (CPSM) Cloud Security Posture Management solution is recommended for risk management leaders?

While Leading cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform have all developed resources, such as APIs and robust logging, to help businesses monitor data traffic and cloud network activity. However, the onus is still on the organization to provide both the instrumentation and the expertise needed to spot threats. The 2019 Capital One data breach, which leaked sensitive personal information from more than 100 million credit card applications, is a prime example of a security operations failure. In this breach, the alleged perpetrator managed to breach AWS S3 storage buckets through a multi-step, targeted attack. The root cause of the breach was a misconfiguration in the Capital One AWS infrastructure. It allowed a hacker to gain access and, to its detriment, Capital One was unable to identify and mitigate the risk in time. A cloud services provider does have some responsibility to secure the cloud, but that responsibility ends after it ensures its own infrastructure and applications are secure. That means cloud resources aren’t automatically protected against cyberthreats. Misconfiguration means that the public cloud server instances, such as storage and compute, are configured in such a way that they are vulnerable to breaches. For example, the National Security Agency recently had an embarrassing moment when someone was able to access secure documents from its Amazon S3 instance with just a browser.

It was a classic example of misconfiguration, defeating the default configurations that are secure be default. It is recommended that security and risk management leaders invest in CSPM (cloud security posture management) processes and tools to avoid misconfigurations that can lead to data leakage. Although it is a relatively new class of tools, this recommendation comes with reason; CSPM allows for just what its name implies: the management of cloud security (i.e. misconfiguration handling).

CPSM solution should find AND fix both inadvertent misconfigurations and malicious attackers from violating security best practices and potentially exposing critical cloud resources.

WHY (CPSM) CLOUD SECURITY POSTURE MANAGEMENT SOLUTION IS RECOMMENDED FOR RISK MANAGEMENT LEADERS?

While Leading cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform have all developed resources, such as APIs and robust logging, to help businesses monitor data traffic and cloud network activity. However, the onus is still on the organization to provide both the instrumentation and the expertise needed to spot threats. The 2019 Capital One data breach, which leaked sensitive personal information from more than 100 million credit card applications, is a prime example of a security operations failure. In this breach, the alleged perpetrator managed to breach AWS S3 storage buckets through a multi-step, targeted attack. The root cause of the breach was a misconfiguration in the Capital One AWS infrastructure. It allowed a hacker to gain access and, to its detriment, Capital One was unable to identify and mitigate the risk in time. A cloud services provider does have some responsibility to secure the cloud, but that responsibility ends after it ensures its own infrastructure and applications are secure. That means cloud resources aren’t automatically protected against cyberthreats. Misconfiguration means that the public cloud server instances, such as storage and compute, are configured in such a way that they are vulnerable to breaches. For example, the National Security Agency recently had an embarrassing moment when someone was able to access secure documents from its Amazon S3 instance with just a browser.

Building Cloud Security Excellence

Building Cloud Security Excellence We spend a lot of time talking to cloud security professionals, basically trying to figure out the best ways to get

DevSecOps – Communication Breakdown

DevSecOps – Communication Breakdown It’s so apropos because better communication could help avoid the majority of problems — at work and in life. Alas, a

SUBSCRIBE TO OUR NEWSLETTER​
Leave a Reply

Your email address will not be published.