{"id":36119,"date":"2019-12-10T11:37:50","date_gmt":"2019-12-10T11:37:50","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=36119"},"modified":"2019-12-16T09:59:57","modified_gmt":"2019-12-16T09:59:57","slug":"making-sure-cloud-security-is-your-new-priority","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/12\/10\/making-sure-cloud-security-is-your-new-priority\/","title":{"rendered":"Making sure cloud security is your new priority"},"content":{"rendered":"\n

It’s crucial that security strategies must shift to protecting what\u2019s most important from within.<\/em> Katie Curtin-Mestre,<\/em> VP of Product, CyberArk<\/em>, says that organisations must take steps to protect what attackers target most as cloud applications proliferate: privileged access<\/em>, and drive down risk. <\/em><\/p>\n\n\n\n

Public cloud adoption shows no signs of abating. According to our Threat Landscape Report<\/em> published earlier this year, 94% of global organisations use cloud services. Digital Transformation projects mandated by the C-suite and demands from developers to streamline development processes are forcing even heavily regulated industries such as financial services and healthcare to speed up their adoption cycles. <\/p>\n\n\n\n

More\noften than not, these cloud initiatives are deployed without security being\nfactored into the equation. The fault for this can\u2019t be laid at the feet of\ncloud architecture and DevOps teams though. They often lack the expertise to\naddress – and ensure the mitigation of – the risks associated with extending\nprivileged access. As a result, they often opt not to make security a priority\ndue to the strict mandate to bring new digital services to market quickly and\nefficiently. With this in mind, it\u2019s crucial security teams collaborate to\nintegrate security before poor practices become entrenched in product\ndevelopment cycles. <\/p>\n\n\n\n

Whether\nbased in the cloud or on-premises, one thing is for sure – organisations\u2019\ninfrastructures remain vulnerable to attackers\u2019 tried and trusted hacking\ntechniques. These individuals and bodies continue to seek the path of least\nresistance, so privileged access management (PAM) is vital to securing the\nattack path.<\/p>\n\n\n\n

The\ndifference between on-premise and cloud attacks<\/strong><\/p>\n\n\n\n

During\na typical on-premises breach, attackers begin by looking for ways to compromise\na user, leading them to start with an attack on the endpoint. For instance, an\nattacker could start with phishing to get their hands on privileged\ncredentials. Once the stolen privileged credentials are secured, they could\nmove laterally through the network by escalating privileges and work their way\nup to owning a domain.<\/p>\n\n\n\n

In\nmodern cloud environments, an attacker can save steps by compromising one\nprivileged user and then leveraging this access to compromise, for example, a\ncloud management console. Hijacking these types of privileged credentials\nallows attackers to shut down said cloud environment.<\/p>\n\n\n\n

It\u2019s impossible to say whether the cloud is more or less secure than on-premises. Regardless, misconfigurations across these open, more centralised environments can ripple in an exponential way that you don\u2019t see in traditional deployments. Securing privilege in the cloud has therefore become an enterprise imperative.<\/p>\n\n\n\n

Bringing\ndevelopers and security teams closer<\/strong><\/p>\n\n\n\n

Application\ncredentials typically outnumber those associated with human accounts, so\ncontrolling, managing and auditing non-human privileged access for these\napplications is no small feat. A similar approach must be taken to securing the\napplication credentials of cloud native apps.<\/p>\n\n\n\n

Organisations can quickly find themselves leveraging native secret stores provided by their cloud, DevOps and Robotic Process Automation (RPA) vendors. This leads to a heavily fragmented approach and ‘islands’ of security. Then, when the security teams are asked to help secure these applications, the main questions are: where do these secrets live and who is responsible for rotating them? Questions developers often have no answer to.<\/p>\n\n\n\n

Organisations seek centralisation but development teams are often more focused on high velocity, code sharing, ad-hoc tooling and full-on automation. It therefore becomes the job of the security team to get the developers on board.<\/p>\n\n\n\n

When\nyou have so many applications, focus becomes paramount. The priority must be\nremoving application secrets for RPA \u2013 this has the advantage of facilitating\ncross-team visibility, adoption and quick wins \u2013 which is useful for\ndemonstrating benefits to developers. From there, the next step is migrating to\na shared services security model, with the end goal that non-security teams\nprovide internal financing for cybersecurity projects. This creates\ncross-functional teams, allowing organisations to bring DevOps and security\nteams into alignment and fostering collaboration for stronger overall security.<\/p>\n\n\n\n

Extending\nsecurity to the cloud<\/strong><\/p>\n\n\n\n

A recent CyberArk study shows that nearly 70% of organisations do not secure business-critical applications deployed on the cloud any differently to how they secure low-value applications or services. Organisations must take steps to protect what attackers target most as cloud applications proliferate: privileged access. This means locking down the powerful human and application-to-application credentials used by SaaS applications and cloud-native applications built using DevOps methodologies to reduce the risk of an attack.<\/p>\n\n\n\n

When data and applications are moved to the cloud, it\u2019s easy to provide all developers access to any cloud resource, postponing the tedious permissions management to later. However, \u2013 the more it is postponed, the harder it is to impose stricter security permissions. A previous study of attendees of InfoSecurity Europe 2019<\/em> showed that 37% of organisations have already experienced attacks that could compromise their data and applications to the cloud. According to industry experts, nearly all cyber-attacks involve privileged access. In cloud-first environments, access therefore not limited to the network and the perimeter is no longer defensible.<\/p>\n\n\n\n

Security strategies must therefore shift to protecting what\u2019s most important from within. Zero trust security models, where organisations trust nothing and verify everything, whether it comes from inside or outside the network perimeter, before granting access, are making this possible – practising defence-in-depth and incorporating privileged access security controls at the core of their strategy will allow organisations to implement a zero trust framework that helps to drive down risk while maintaining business velocity.<\/p>\n","protected":false},"excerpt":{"rendered":"

It’s crucial that security strategies must shift to protecting what\u2019s most important from within. Katie Curtin-Mestre, VP of Product, CyberArk, says that organisations must take steps to protect what attackers target most as cloud applications proliferate: privileged access, and drive down risk. Public cloud adoption shows no signs of abating. According to our Threat Landscape […]<\/p>\n","protected":false},"author":21,"featured_media":36134,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4,57,1489,93,24],"tags":[25,1908,9794],"class_list":["post-36119","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-enterprise-security","category-insights","category-top-stories","category-used","tag-cloud","tag-cloud-security","tag-cyberark"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/36119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=36119"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/36119\/revisions"}],"predecessor-version":[{"id":36365,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/36119\/revisions\/36365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/36134"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=36119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=36119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=36119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}