Zero Trust in the Cloud: Why Total Context Matters

Originally published by Reco.

Written by Dr. Chase Cunningham.

In recent years, the cloud has become the go-to platform for businesses of all sizes. The agility, scalability, and cost-effectiveness it offers are undeniable advantages. However, this rapid shift to the cloud has also exposed organizations to a host of new SaaS security challenges. As more data and applications migrate to cloud environments, traditional security models are no longer sufficient. In the future, security will need Zero Trust.

Zero Trust is a security framework that assumes that no one, whether inside or outside the organization, should be trusted by default. Instead, it requires continuous verification of identities and strict access control. In the cloud, this approach is essential, but to make it truly effective, it demands a comprehensive understanding of the connections and access points in your environment – in other words – total context across all infrastructure.

‍

The Move to Cloud Resources

According to Statista, in 2020, 88% of organizations worldwide used public cloud services. This number is expected to grow, as cloud computing provides the flexibility needed in today's fast-paced business landscape.

With the rapid adoption of cloud resources, the attack surface has expanded significantly. Each cloud instance, service, or application represents a potential entry point for attackers. In this environment, unmanaged applications and cloud misconfigurations have become common vulnerabilities, exposing sensitive data to breaches.

‍

Unmanaged Applications and Cloud Misconfigurations

Recent data from cybersecurity firms paints a concerning picture. Research by McAfee found that the average enterprise uses over 2,200 cloud applications, but IT departments are aware of only 10% of them. The remaining 90% are unmanaged, often unvetted, and pose significant security risks.

Cloud misconfigurations, on the other hand, are more common than you might think. A report by Palo Alto Networks revealed that misconfigured cloud storage is a primary source of data breaches. In 2019, misconfigurations were responsible for 73% of incidents in the cloud.

‍

Recent Breaches Due to Misconfiguration and Unmanaged Access

1. Capital One (2019): In one of the most high-profile breaches, a misconfigured web application firewall allowed a hacker to gain access to Capital One's AWS-hosted databases. This breach exposed the personal information of over 100 million customers.
2. Marriott International (2020): Misconfigured security settings in a SaaS application led to unauthorized access to Marriott's guest reservation system. This breach affected the personal data of 5.2 million guests.
3. Facebook (2019): In this case, unmanaged access to third-party data by app developers resulted in a breach of user data. Millions of Facebook users' data were exposed through improperly managed APIs.

Why Total Context Matters

In the future, breaches such as the ones above can be mitigated by adopting Zero Trust Security and understanding how to create a total context for your infrastructure. Zero Trust in the cloud cannot be effective without a deep understanding of the connections and access within your environment, which means you need to understand the cloud’s total context. Total context means having real-time visibility into who is accessing what, from where, and why.

1. User and Device Behavior: It's not enough to know who has access; you need to understand how users and devices behave. Behavioral analytics can identify anomalies, such as unusual access patterns or unexpected data transfers, which may indicate a security threat.
2. Application Usage: Tracking application usage helps identify unmanaged or potentially risky applications. This insight is crucial for enforcing policies and ensuring that only authorized apps are used within your cloud environment.
3. Configuration Management: Misconfigurations can be mitigated through continuous monitoring of cloud configurations. This includes ensuring that storage buckets, databases, and other resources are properly configured to prevent unauthorized access.
4. Access Control: With total context, access control becomes dynamic and adaptive. You can apply policies that grant or deny access based on real-time data, reducing the risk of unauthorized access.

Conclusion

In an era where cloud adoption continues to surge, security cannot be an afterthought. The statistics and data on unmanaged applications and cloud misconfigurations, coupled with recent high-profile breaches, are alarming, highlighting the urgency of adopting a more robust SaaS security approach. In the cloud, the key to protecting your data and resources is simple: trust no one until you have total context.