How the Cloud Is Shifting CISO Priorities

The challenges facing chief information security officers (CISOs) have evolved dramatically in the past decade. Today, they must align their security efforts — and budgets — with the business goals of their organization, which may range from maintaining customer confidence that their data is safe to protecting intellectual property from theft.

As a key member of the executive management team, CISOs often have board-level reporting responsibilities. They must manage a new and daunting level of technical complexity introduced by the cloud, where identities are virtually the first and last line of defense. And the job doesn't end there. To be successful, they must also put substantial effort into building a team with skills in a variety of disciplines, and choosing the right defensive technologies.

The Technical Challenge

The transition to remote or hybrid work models combined with accelerated cloud adoption has greatly expanded the attack surface CISOs must protect. Furthermore, they often have to deal with more than one cloud. The major providers — Amazon Web Services, Azure, and Google Cloud Platform — all have slightly different structures, procedures, requirements, and so on, all of which further increase the complexity of managing these sprawling architectures.

Data-center-oriented companies that have transitioned to the cloud obviously face a new set of security concerns that conventional firewalls were never designed to handle. Hence, the now commonly heard refrain "Identity is the new perimeter." This is certainly true. While firewalls and other network-based controls shouldn't be abandoned, CISOs need to focus on identity issues. The following three-step process can deliver results in this area quickly and efficiently.

The Human Challenge

Securing cloud infrastructure demands unique skills, and finding qualified individuals to do the work is one of CISOs' biggest challenges. There are three key areas of competency that every cloud security team should possess:

The ideal makeup of a cloud security team spans network, cloud, and development specialists who can work collaboratively. The task of building a team with these capabilities is complicated by the fact that there is a shortage of 3.4 million cybersecurity workers at the moment.

One approach that works well as a supplement to hiring is development from within through training. This may occur in-house or through third-party certification programs. Also, in choosing vendors, organizations should favor those whose offerings include a strong training component. If possible, CISOs may find ways to get non-security employees to work on some security tasks.

Once assembled, one of the problems that any security team will encounter is dealing with multi-cloud architectures, which are becoming the norm. Very few individuals are familiar with the tools, nomenclature, and security model of all three major cloud platforms. For this reason, many companies are turning to cloud native technologies that understand the nuances associated with securing different cloud platforms and simplify security tasks for users that may lack specialized training in AWS, Azure, GCP, etc.

To sum up, the challenges facing today's CISOs are largely driven by the cloud, which creates a greatly expanded attack surface that needs to be protected. Meanwhile, mastering the management model and tools used by each cloud platform requires security expertise that is in extremely short supply. Solutions are available that provide the visibility and platform knowledge needed to help security teams implement best practices for protecting their cloud infrastructure, while helping them up-skill analysts in the process.