How a CNAPP Can Take You from Cloud Security Novice to Native in 10 Steps

Originally published by Tenable.

Written by Shai Morag.

Security professionals are used to protecting on-premises resources, but the cloud is more complex than on-prem – especially in multi-cloud environments. Meanwhile, breaches are happening at a furious pace. The new Tenable 2024 Cloud Security Outlook report shows that 95% of organizations reported a cloud security breach over a recent 18-month period. The prevalence of breaches is a clarion call for an approach to cloud security beyond the array of point products that have sprouted in recent years.

Identity is the new perimeter

The rise of cloud infrastructure entitlement management (CIEM), which helps protect, analyze and govern access, has underscored the importance of managing identity risk and entitlement risk in the cloud.

To put simply, identity is the new perimeter. In cloud security, when you think about visibility and about prioritizing and assessing risk in your environment, context is king.

A cloud native application protection platform (CNAPP) that integrates CIEM functionality takes a holistic view of cloud security. CNAPPs help with context, which provides a basis for understanding, analyzing and prioritizing risk.

CNAPP: Discover, manage risk and scale

These are the ten steps for end-to-end cloud infrastructure security, divided into three stages: discover, manage risk, and scale.

1. Discover: All Assets

Inventorying all the assets, the resources, the workloads, identities and data can be hard because most companies utilize more than one cloud. This means that you need to do it for your AWS, Azure, Google Cloud and other cloud environments. You must make sure that you discover all assets and understand all the assets that you have.

2. Discover: All relationships

The second step is understanding all relationships. A CNAPP can provide critical context, such as the relationships between assets, identities and risk. It can also identify and prioritize remediation of toxic combinations, such as public workloads with critical vulnerabilities and high privileges.

3. Discover: All access to resources

At this step, it’s critical to discover what resources human and service identities can access. Then, it’s important to understand when the identities have accessed those resources and how long they’ve had access.

4. Manage risk: Understand your compliance and enterprise policy needs

Before we analyze the risk, you need to understand what compliance and what policies you want to enforce in your cloud environments. For example, do you need to support SOC2? Do you need to make sure that you’re PCI compliant? Do you need to make sure that you're GDPR or HIPAA compliant?

5. Manage risk: List all risks and compliance violations

You need to understand all the risks and know where those risks lie. You also must understand where you have violations of your policies and where you’re not meeting your compliance, as well as the standards that you need to support. You need to see these issues from low severity to high severity.

6. Manage risk: Prioritize based on full-stack context

It's very important to understand toxic combinations. A vulnerable machine that is publicly exposed can also assume a privileged identity. The risk adds up. This is only one example of a toxic combination. There are many others.

7. Manage risk: Visualize and dive deep into findings

After you prioritize all the risks and all the findings, you want to make sure that when you go to specific findings, you can visualize everything and do a deep dive into the findings. Sometimes it's very hard to understand what's going on and it's important to do so before you remediate.

8. Manage risk: Remediate and drive least privilege and zero trust

When you’re remediating and preventing risk in your cloud, access risk tops the list. Achieving least privilege ensures that people and machine identities aren’t over privileged.

9. Scale: Integrate findings within CI/CD

Ensure the integration of findings in the CI/CD pipeline. This shift left approach uncovers and remediates risks that are part of your code before they’re deployed to production.

10. Scale: Automate findings in DevSecOps workflows

Automation helps DevSecOps remove risk. If there’s a misconfiguration in your production environment, you understand what's the origin in the code and developers get notifications and the context.

Applying the lessons learned

Here’s a timeline for evaluating a CNAPP.

• Week one: Discover the teams in your organization that secure your cloud. Then identify the decision-makers and their concerns.
• Three months: Identify whether your teams know who can access what in the cloud and when. Then discover the tools in use and the gaps. Finally, learn if your teams understand and can enforce least privilege.
• Six months: Select a CNAPP with tailored security and compliance automation. Then define priorities toward greater cloud security maturity.

Learn more about cloud security

To get more cloud security insights, attend our webinar "Tenable Shares Its 2024 Cloud Security Outlook: Winning Half the Battle by Understanding Barriers and Priorities" on July 18 at 11 am ET, which will cover best practices to reduce the risk of cloud data breaches, ways to strengthen the weakest link in your cloud security environment and more.