Application Security Solutions: CNAPP vs CSPM vs ASPM

The CSA Security Update podcast is hosted by John DiMaria, Director of Operations Excellence at CSA. The podcast explores the CSA STAR program, cloud security best practices, and associated technologies. In this blog series, we edit key podcast episodes into shorter Q&As. Today’s post features Karthik Swarnam, Chief Security and Trust Officer at ArmorCode. Karthik and John discuss the differences between ASPM, CSPM, and CNAPP security solutions and how to make informed decisions when building a mature software security program.

Listen to the full podcast episode here.

John DiMaria: Hello everyone and welcome to another episode of the CSA Security Update podcast. We have a great session for you today about the ever-expanding digital world of securing applications and infrastructure. We're going to tackle three key acronyms: Application Security Posture Management, better known as ASPM; Cloud Security Posture Management, CSPM; and Cloud-Native Application Protection Platforms, CNAAP.

And with me today to bring some light to the subject is ArmorCode’s Karthik Swarnam. Welcome to the show.

Karthik Swarnam: Thank you, and glad to be a part of your show, John.

Distinguishing Between ASPM, CSPM, and CNAPP

JD: Let's start out by explaining the core functionalities of these processes, ASPM, CSPM, and so on, and how they address different needs.

KS: Absolutely. Let's take ASPM to start with. ASPM is a holistic set of capabilities that helps you manage and enhance the security stance of any organization. It identifies and helps you mitigate cyber threats and vulnerabilities, as well as helping you stay compliant with the expected regulations.

CSPM focuses on managing the security posture of your Infrastructure-as-a-Service - your workload, your infrastructure, your compute, your network aspects of anything that is in the cloud.

And then you talk about CNAPP, a new term that's been thrown out. It actually kind of merges CSPM and ASPM. It’s a cloud-native security model that helps you manage your cloud security posture for cloud-native applications and the workloads associated with those applications.

JD: There's a reasonable amount of overlapping features between these three. Maybe you can shed some light on how companies should determine the most appropriate tools for them?

KS: Companies should consider their environment first. Understand your digital enterprise and how much of it is in different pockets. For example, “I’m 85% in the cloud and I’m lacking. How do I manage my cloud workload securely against any misconfigurations?” And if that's your concern, then you will be looking for a CSPM-type of solution.

If you don't need to do just that, if you also need to be able to encompass the application aspects of it, the vulnerabilities aspects, et cetera, not just misconfigurations, then you may want to consider ASPM.

Enhancing Compliance Efforts

JD: A lot of our audience is CSA STAR certified, some certified in up to 13 different standards globally. So they're always looking for something that's going to help them comply with industry regulations and standards. Give us some sort of example of how this directly impacts those compliance efforts.

KS: When you're going through these certifications, tools like ASPM or CSPM can help facilitate them because they’re looking for process implementation. ASPM and CSPM are able to do self-assessments and self-checks. Maybe you’re creating too many waivers and exceptions. When do you need to fix it? Does it ever get fixed? They help guide you through.

The second thing is when you have the assessors come in, you can turn them onto these platforms and get almost near real time artifacts that they can look at it.

Keeping Up with the Times

JD: How do these three solutions adapt to new types of vulnerabilities? How are they advancing and keeping up?

KS: We’re moving on to next generational capabilities. When it comes to security posture management, what I mean by next generation capabilities is that we’re looking at it from multiple attributes. It used to be, “Hey, you have a vulnerability. Let's identify whether that vulnerability is a critical vulnerability, and if it is a critical vulnerability, I want you to go fix it within seven days.”

But the reality is, the threats are constantly evolving. The adversarial situation is changing. So what we do is we don’t just take the vulnerability data, we also then enrich that data with the threat aspects of it through open source threat intel. What is being exploited today? What is of interest? So that elevates it to be able to say, well, should I bump this risk up or bump this risk down?

JD: And of course choosing the right solutions is important. Anyone who's looking to vet solution providers, you could check out ArmorCode's submission to the STAR Registry. Companies that are really pioneers in this area are willing to say, “Hey, you can rest assured that we have the proper tools in place. We're telling you how to protect your organization, we protect our organization just as well.”

I urge everyone to check out the STAR Registry, check out ArmorCode's submission, and of course contact ArmorCode.