Removing the Fog from Cloud Compliance

Originally published by Axonius.

Written by Shlomit Alon, Axonius.

“When I was told our company needs to ensure we’re cloud compliant, I was scratching my head, unsure where to begin.”

Does that quote sound familiar?

A risk analyst at a company wasn’t sure where to reduce risks in the foreboding fog of the cloud.

Inundated by the more than 140 CIS benchmarks — spanning across seven core technology categories — the risk analyst looked for a streamlined solution to reduce the complexity of numerous cybersecurity requirements, help mitigate breaches in the cloud, and make it a snap for her company to pass compliance reviews.

Cloud Asset Compliance uses cloud configuration and asset data from cloud Infrastructure as a Service (IaaS) providers and compares those implementations against industry benchmarks and frameworks. These standards contain consensus best practices that can help safeguard systems against today’s evolving cyber threats, and are important for evaluating an organization’s cloud security posture.

Challenges to Compliance

The common challenges of being compliant with cloud benchmarks include:

• Visibility to all cloud resources for multiple cloud (multi-cloud) environments
• Clarity of the security state of all cloud environments
• Customization of benchmarks to be relevant to an organization's policies
• Creation of a prioritized work plan for security, operations, GRC, and risk teams
• Investigation of cloud resource changes over time that cause risk
• Mitigation of risk stemming from misconfigurations and policy drift

Streamlining Solutions to Complexity

An effective cloud compliance dashboard should:

Connect to your cloud environments via API connections, displaying information about AWS, Azure, Google, and Oracle Cloud, depending on the cloud environment deployed in your organization. A clear and comprehensive dashboard provides the information you need in a real-time, visually appealing manner, allowing you to make the decisions necessary for compliance purposes.

Help you dig deeper to remediate failed controls and see which assets on your cyber asset inventory are non-compliant.

Investigate any issues that cause an asset to be non-compliant, see the required steps to mitigate the gap, and eventually create an automated task that helps you to remediate the risk.