Traditional security best practices continue to be challenged as more IT systems migrate to the cloud, but Snyk Chief Architect Josh Stella noted there are steps organizations can take to transform their cloud security and deliver innovation faster. 

Cloud computing represents “a paradigm shift” in the roles and responsibilities of security teams as they build and manage new applications, Stella pointed out.

The shared security model of cloud requires cloud service providers (CSPs) like Amazon Web Services (AWS), Google Cloud, and Microsoft Azure to be “responsible for the security of their physical infrastructure,” while “their customers are responsible for the secure use of cloud resources,” he said.

Companies that are "getting cloud security right'" all share five traits: They understand their environment, focus on secure architecture, empower developers on security, build on a foundation of policy as code (PaC), and maintain process discipline – meaning “consistently measuring what matters, such as whether security technologies and processes are reducing the rate of misconfiguration and improving developers’ productivity by automating security checks and approvals,” Stella explained. 

A key understanding for organizations is that many of the security tools and best practices that worked in the data center "cannot protect your cloud environment and data,” he added.

Cybercriminals are becoming increasingly adept at using automation technology to detect weaknesses like cloud misconfigurations, application vulnerabilities, and API keys in source code, according to Stella.

“Once they choose their targets, they go hunting for data using the cloud control plane,” he noted. “Control plane compromise has occurred in every major cloud breach that has happened to date.”

Stella noted cloud security teams typically find and remediate dozens of misconfiguration issues each day, but misconfiguration is just one of many paths on the threatscape a hacker can take to compromise the control plane. 

“Focusing only on finding and eliminating single resource misconfigurations is tilting at windmills because hackers will eventually slip through,” he said. 

Stella added that only focusing on other avenues like indicators of compromise (IOCs) is risky too, because cloud breaches can happen in “a matter of minutes,” before even teams with the best monitoring, analysis, and alerting tools have the ability to react. 

With application security as critical as ever, network monitoring tools that rely on spans or taps to inspect traffic aren’t as necessary as they once were, because cloud providers don't often provide direct network access. 

“The primary cloud security gaps you need to fill are concerned with resource configuration and the architecture of your environment,” Stella said, adding “the good news is that just as the cloud is programmable and can be automated, so is your cloud environment’s security.”

Although many traditional security tools are rendered obsolete in the cloud, Stella said that doesn’t mean organizations need to ditch everything they’ve been using. “Instead, understand which ones still apply,” he recommended.

Organizations should also deploy automation to enable developers to build and operate safely in the cloud with processes in place to find and fix vulnerabilities before attackers can find them, Stella pointed out.  

“Your application teams can deliver innovation faster, your cloud engineers can focus more on building value, and your security team can do more with the resources they have,” he said.