Finding the Right Approach to Cloud Security Posture Management (CSPM)

Cloud security is maturing — it has to. We've had too many face-palm-worthy incidents of organizations hearing "hey, I found your data in a world readable S3 bucket" or finding a supposedly "test" server exposed that had production data in it. Happily, we are emerging out of the Wild West phase, and some order and maturity is emerging, and along with it, new lingo.

Gartner divides the emerging ideas into three main disciplines: CASB, CWPP, and CSPM. Think of these as if you're securing a (pre-pandemic!) office building. CASB is your ID badge reader, and CWPP is your video surveillance. Cloud security posture management (CSPM) is everything else you do to secure your building, like having a security guard walk around to look for gaping holes in the wall, or the sounds of someone drilling through a safe.

CSPM is arguably the hardest area to understand, since it's so broad, but that same breadth is what makes it the most important to get right. In comparison, having no badge readers at all would be bad, but you don't have to go overboard — you just need a reasonable check that you're not letting everyone in. Posture management is different — CSPM isn't a point solution; it's the approach of always asking "what else have we forgotten?"

CSPM in More Detail
If you look for a crisp definition of CSPM, it's hard to find one — after all, posture management can refer to the mindset of "how could we be attacked, what are the consequences if it happens, and what can we do it mitigate it?" I find it easiest to split this into three main questions: What have you got, what are you doing to protect it, and what's the level of risk? All of these are familiar to experienced security professionals — we've been asking these same questions about IT networks forever. So, why is it different for the cloud?

For legacy on-premises networks, the hardest question was "what have you got?" — rapid growth and technology change made keeping an accurate inventory challenging. Cloud disrupts this in some interesting ways. Each cloud account has a controller for the software-defined network, which solves one problem, but then goes and creates another. It's impossible for any network to exist in a software-defined cloud that the controller did not create for you. This means you can always tell exactly how big any one cloud network is. Problem solved, right? Not so fast — anyone who's tried to inventory cloud footprint realizes that this same controller is changing things so quickly you can't keep up. It's also so easy to add new cloud networks that people do it and then forget to tell security, so the inventory problem just moves up a level — not "find the missing router" but "find the missing cloud account."

In CSPM, most of the key innovations are focused on the second question: "What are your protections, and are they working?" Cloud disrupted this, too, bringing innovations that are incompatible with a lot of the traditional security stack. It's not that question 3 — risk assessment — is unimportant. It's just that it isn't so deeply impacted by the differences between cloud, hybrid, and on-premises. Risk assessment is strategy, not tactics.

So, why has cloud disrupted the question of whether you have working protections in place? Well, going back to the start of the article, that unintended exposure of a cloud storage bucket represents a mistake we simply couldn't make until there was a cloud. Sure, every cloud comes with many strong security controls. But that's the problem — there are so many enforcement controls that are all new, all different, and are like nothing we did for the past 40 years in on-premises data centers. Novelty is great for innovation, but terrible for security. Coordinating all the new controls and ensuring they are used correctly is the core job for CSPM. Basic checklists aren't enough — just as we've found with all previous network technologies, a network built out of individual compliant elements can still fail as a system, like a house built out of perfectly formed bricks can still fall down if assembled incorrectly.

This is why the core discipline in CSPM is visibility, so you can achieve end-to-end understanding of what is exposed and what is not. Figuring out access — what can reach what, and especially, what is exposed to the Internet — sounds basic but has become explosively complicated. It's impossible to hire enough certified security professionals with deep enough understanding of all the cloud dialects used across an organization. So, the only solution is to focus on CSPM — building up a map of your cloud assets, then looking across all the layers to ask "what is exposed?"

For more information on RedSeal's CSPM solution, RedSeal Stratus, check out our website.

About the Author

Dr. Mike Lloyd has 35 years of experience in understanding fast-moving, complex systems. He has authored 21 patents on security and networking. Before RedSeal, Mike Lloyd was chief technology officer at RouteScience (acquired by Avaya), where he pioneered self-optimizing networks. Mike served as principal architect at Cisco on MPLS VPN modeling. He joined Cisco through the acquisition of Netsys Technologies, where he was the senior network modeling engineer.

Mike holds a degree in mathematics from Trinity College, Dublin, Ireland, and a Ph.D. in stochastic epidemic modeling from Heriot-Watt University, Edinburgh, Scotland.