By integrating with native security services on major cloud platforms, a CNP solution can correlate security findings to pinpoint risks and recommend mitigations

Solution sprawl is one of the biggest challenges facing security teams. Rapid digital transformation has led to nearly 60% of organizations having 30 or more security tools deployed across their organization, according to IBM’s Cyber Resilient Organization Study 2021. Almost a third have more than 50. And worse, this logistical nightmare sits atop an aggressive digital acceleration strategy spurred by the pandemic. It has already pushed many overtaxed security teams to the breaking point. 

Compounding the problem, rapid cloud adoption, multi-cloud strategies, and diverse cloud workloads are further increasing security complexity and friction. Ironically, the shift to the cloud that was supposed to simplify things like remote access to applications and provide dynamic scale has actually led to even further security complexity. The first issue is that many of the security solutions in use on-premises may simply not be available in cloud platforms. And even when cloud versions are available, they often operate differently, increasing overhead while reducing configuration and policy enforcement consistency. And if those tools aren’t also cloud-native, even more friction results because integration requires cooperation across multiple stakeholders, including IT teams, application developers, DevOps engineers, and more.

It’s one of the reasons why, according to Gartner, 80% of organizations are at some stage of vendor and solution consolidation. Because while protecting cloud workloads is essential, undue complexity can impact their ability to detect and respond to threats, especially when events lack context from the cloud control plane. Furthermore, separate tools can generate hundreds of alerts that must be hunted down by hand to understand their scope and context, leading to alert fatigue and inaccurate prioritization. As a result, cloud threats can accumulate faster than they can be resolved.

The problem is even worse in multi-cloud environments. Of course, every cloud service provider (CSP) offers security services to address vulnerability management, threat detection, risk management, data security, and auditing. However, these solutions are only available on their own platform, and few security vendors offer solutions that integrate with or across different cloud providers. As a result, security teams, particularly those that have to work across multi- and hybrid clouds, struggle to rationalize alerts, prioritize risks, and deliver comprehensive remediation. Instead, they are dealt a hand filled with complexity and visibility gaps.

The value of cloud-native protection

Today’s organizations need to adopt a platform that enables them to seamlessly take their application journey from on-premises and into the cloud. For on-premises and hybrid cloud deployments, a cybersecurity mesh platform or security fabric and integrated solutions that work across all deployments and enable consistent policies and centralized visibility makes a lot of sense.

As organizations deploy on public clouds, cloud-native protection (CNP) is needed to effectively consolidate and centrally manage cloud and multi-cloud security. By integrating with native security services on major cloud platforms, such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform, a CNP solution can effectively correlate security findings to pinpoint risks and recommend effective mitigation. 

A CNP solution should also work hand-in-glove with third-party security tools deployed in the cloud, collecting and normalizing data collected from cloud-based firewalls and WAFs. Providing consistent security workflows across public clouds enables stop-gap risk mitigation while extending consistent security across all on-prem and cloud environments.

Consolidating cloud-based security services

Cloud-based security services, such as Amazon’s Inspector, GuardDuty, and Security Hub solutions, enable threat detection, threat aggregation, and vulnerability management across their entire platform. Security teams can focus on remediation rather than collection, correlation, and analysis by consolidating and contextualizing the threat intelligence generated by these tools and deployed third-party solutions. Organizations can then better protect their more complex cloud workloads by normalizing and analyzing threat data across multi-clouds. 

Cloud security consolidation also enables teams to handle the large volumes of data coming from numerous cloud security tools without needing to be an expert in every tool. But a CNP solution must effectively consolidate information without compromising the depth and breadth of coverage. Without that ability, teams are forced to choose between granular security coverage and efficient operations. A CNP solution must also normalize and enhance the information generated by cloud-native solutions to further enrich intelligence with findings from third-party solutions. 

A CNP solution should ingest, normalize, enrich, correlate, and score threat intelligence from cloud-native and third-party security sources. It then calculates risk based on those security findings combined with organization-specific parameters to determine the importance of specific workloads. This normalized risk score accurately prioritizes high-risk resources, allowing security teams to effectively address the highest risks first. And the context-rich actionable insights allow admins to automate and manage the mitigation and remediation process more effectively.

Consistent security workflows across multiple environments enable security teams to manage cloud security more effectively without having to master the intricacies of each security service. This allows them to work efficiently through security backlogs, even across even the most complex multi-cloud environments. And when a CNP solution integrates with on-prem and endpoint solutions, organizations can scale visibility and control end-to-end, enhancing security coverage, improving risk mitigation, and quantifiably improving protection.

Simplify cloud security with CNP

Organizations that embrace CNP quickly realize the benefits of consolidating the cloud security management and orchestration solutions deployed across their cloud environment. It empowers organizations to maximize the value of their investments by establishing consistent and unified visibility and controlling all their public cloud platforms. Effective CNP tools also naturally expand the volume of data points they can leverage over time, allowing them will continually improve their ability to analyze risk and provide deeper actionable insights, thereby improving mitigation, reducing friction, and accelerating cloud adoption.

By John Maddison on Thu, 29 Sep 2022 10:30:00 +0000
Original link