How the Cloud Is Shifting CISO Priorities

The challenges facing chief information security officers (CISOs) have evolved dramatically in the past decade. Today, they must align their security efforts — and budgets — with the business goals of their organization, which may range from maintaining customer confidence that their data is safe to protecting intellectual property from theft.

As a key member of the executive management team, CISOs often have board-level reporting responsibilities. They must manage a new and daunting level of technical complexity introduced by the cloud, where identities are virtually the first and last line of defense. And the job doesn’t end there. To be successful, they must also put substantial effort into building a team with skills in a variety of disciplines, and choosing the right defensive technologies.

The Technical Challenge

The transition to remote or hybrid work models combined with accelerated cloud adoption has greatly expanded the attack surface CISOs must protect. Furthermore, they often have to deal with more than one cloud. The major providers — Amazon Web Services, Azure, and Google Cloud Platform — all have slightly different structures, procedures, requirements, and so on, all of which further increase the complexity of managing these sprawling architectures.

Data-center-oriented companies that have transitioned to the cloud obviously face a new set of security concerns that conventional firewalls were never designed to handle. Hence, the now commonly heard refrain “Identity is the new perimeter.” This is certainly true. While firewalls and other network-based controls shouldn’t be abandoned, CISOs need to focus on identity issues. The following three-step process can deliver results in this area quickly and efficiently.

• Rein in excess privileges****. During a migration to the cloud, global privileges are often granted to everyone on the transition team. It’s best to avoid this, but if it happens, privileges should be reviewed and limited after the transition. One good way to do this is to monitor which resources are being accessed by which individuals. If an individual isn’t accessing a particular resource, the right to do so should be revoked.

• Correlate excess privileges and misconfigurations****. Cloud misconfigurations are another serious risk. But when a privileged identity has access to a misconfigured cloud resource, the results can be disastrous. Fortunately, automated tools are now available to help detect misconfigurations, as well as excessive privileges, and remediate them to eliminate threats.

• Prioritize****. There is never enough time or enough staff to correct every misconfiguration, so it’s important to focus on those that are the greatest source of security risk. For example, remediating identity-based access threats to cloud storage buckets is critical for preventing data breaches. Monitoring for configuration errors that expose data through excessive, default, etc., permissions should be a top priority.

The Human Challenge

Securing cloud infrastructure demands unique skills, and finding qualified individuals to do the work is one of CISOs’ biggest challenges. There are three key areas of competency that every cloud security team should possess:

• Architectural competence. To assess an organization’s security posture and create a road map for maturing it over time, security teams require a reference model. The CSA framework is an excellent resource, and there are several others available. Without a clear understanding of architectural concepts presented in industry standard security frameworks like CSA, it’s difficult to reduce the cloud attack surface and easy to overlook blind spots.

• Cloud engineering. The security team also needs to handle the day-to-day requirements of cloud security, which may include management, maintenance, and more. Competent cloud engineering is essential for “keeping the lights on” in the security sphere.

• Reactive capabilities. Globally, cyberattacks occur at the rate of 30,000 per day. Every enterprise can expect incidents to occur on a regular basis, and security teams need specialists who can react quickly to limit — if not prevent — serious consequences.

The ideal makeup of a cloud security team spans network, cloud, and development specialists who can work collaboratively. The task of building a team with these capabilities is complicated by the fact that there is a shortage of 3.4 million cybersecurity workers at the moment.

One approach that works well as a supplement to hiring is development from within through training. This may occur in-house or through third-party certification programs. Also, in choosing vendors, organizations should favor those whose offerings include a strong training component. If possible, CISOs may find ways to get non-security employees to work on some security tasks.

Once assembled, one of the problems that any security team will encounter is dealing with multi-cloud architectures, which are becoming the norm. Very few individuals are familiar with the tools, nomenclature, and security model of all three major cloud platforms. For this reason, many companies are turning to cloud native technologies that understand the nuances associated with securing different cloud platforms and simplify security tasks for users that may lack specialized training in AWS, Azure, GCP, etc.

To sum up, the challenges facing today’s CISOs are largely driven by the cloud, which creates a greatly expanded attack surface that needs to be protected. Meanwhile, mastering the management model and tools used by each cloud platform requires security expertise that is in extremely short supply. Solutions are available that provide the visibility and platform knowledge needed to help security teams implement best practices for protecting their cloud infrastructure, while helping them up-skill analysts in the process.