The shift to cloud computing has fundamentally redefined the security landscape, introducing immense scale and complexity that traditional on-premise security models struggle to address. With cloud providers constantly releasing new services, security professionals face a perpetual learning curve and a challenge to keep misconfigurations from overwhelming their environments.
We recently spoke with Joseph South, a security expert, about the critical challenges, best practices, and emerging threats in cloud security, including the persistent issues with the Shared Responsibility Model and the coming wave of AI security needs.
You can read the complete episode transcript here >
How Has Cloud Complexity Evolved Since the Shared Responsibility Model?
The Shared Responsibility Model, which is essentially the same across all cloud providers, defines what the provider secures (“security of the cloud”) and what the customer secures (“security in the cloud”).
- Cloud Provider Responsibility: Covers hardware (e.g., hard drives not failing), the physical network (e.g., plugging in cables).
- Customer Responsibility: Covers everything from Identity and Access Management (IAM) to securing compute instances, and enforcing security controls like TLS within the environment.
The complexity has evolved due to the sheer scale and pace of change:
- Service Overload: Cloud is always changing. In 2023 alone, AWS launched 10 new services, bringing their total to over 200 services. Azure also has over 200 services.
- Increased Misconfigurations: This constant influx of new services, all interacting with different areas of the environment, increases the common misconfiguration issues. As a security professional, you always have to be learning.
What are the Top Cloud Security Priorities Organizations Must Address?
Organizations must address security from several critical angles to manage the cloud’s complexity:
- Misconfigurations: Focus on resolving common misconfiguration issues. This includes persistent problems like public S3 buckets that are unencrypted—an issue dating back to 2010 that still exists today.
- Pipeline Security: Address how infrastructure is deployed (pipeline security). If developers deploy insecure infrastructure (e.g., EC2s with unencrypted hard drives) 10 times a day, security teams will never keep up.
- IAM and Least Privilege: Focus on IAM and implementing the least privilege model. This involves addressing overly permissive roles and accounts and ensuring people only have what they need to do their job.
The deployment of insecure infrastructure code turns security into a cat and mouse game.
How Can Organizations Use Tools and Frameworks to Prioritize Security?
To manage findings and minimize attack surface, organizations must rely on a combination of tooling and established security frameworks.
- Cloud Security Posture Management (CSPM): A strong CSPM solution is absolutely critical, even in a single cloud environment. It provides insight into the cloud’s configuration, checks for best practices (e.g., encrypted hard drives, S3 encryption), and alerts on issues.
- Contextual Prioritization: The biggest challenge with CSPMs is being overwhelmed by thousands of alerts. Organizations should factor in the ability to use environmental context to weed through everything and show what truly needs attention.
- Framework Guidance: Small companies should leverage the NIST framework and the Cloud Controls Matrix (CCM) from the Cloud Security Alliance.
- Compliance Mapping: Organizations should map their compliance requirements (e.g., HIPAA for healthcare or a standard for FinTech) to the cloud services they use. This provides the bare minimum guideline and a starting point for the priority list.
What is the Best Approach to Remediation in the Cloud?
Cloud remediation requires cutting off the problem where it is starting to avoid having the same thousands of findings reappearing the next day.
- Cut off at the Source: You must fix the findings right from where they are occurring (i.e., where the developer is creating the asset from).
- Preventative Controls in Pipeline: Use solutions like AWS Config to enforce basic controls, such as:
- Blocking deployment of unencrypted S3 buckets.
- Ensuring encryption keys are attached and stored in KMS.
- Developer Communication: Communicate with developers that these controls are being put into the pipeline, and they will no longer be allowed to deploy assets that violate these standards. Focusing on covering the basics provides the most security value.
How Has Cloud Security Evolved, and What Does the Future Hold?
Cloud security is evolving similarly to how cybersecurity matured from general network security.
The Specialization of Cloud Security
- Scale and Breadth: Knowing over 200 services per cloud (or over 400 in multi-cloud) means no single security professional can know everything.
- Domain Focus: Cloud security is moving toward specialization. Companies are building dedicated cloud IAM teams, separating from on-prem IAM teams. The same is true for infrastructure and networking.
- Unicorns: Attaining even one professional cloud certification can be rare; having two makes you a “double unicorn”. Companies will have to focus on building out dedicated, specialized cloud security teams.
Emerging Trends: AI and Quantum
- AI Security: AI security will be a critical field within the next five years. This includes securing the generative AI itself (the code, infrastructure, and data pipelines) and using AI for security use cases. You almost have to use AI to secure AI.
- Quantum Computing: Quantum computing is closer than people realize and requires familiarization now, as the learning curve is extremely steep.
How Should Organizations Address Security Practices?
Joe rated several security practices on a scale of one (worst) to five (best):
- Conduct periodic security audits: 4/5. Audits are important, but the organization should be trained to eliminate many of the vulnerabilities the audit would catch.
- Provide training and awareness programs to employees: 5/5. Training is crucial because attackers are becoming significantly more evolved and advanced.
- Use strong passwords, change them frequently, and avoid reuse: 5/5. This is typical and standard good IAM hygiene.
- Development regularly tests an incident response plan: 3/5. When people are under stress (e.g., a breach), they fall back to their lowest level of training. An IR plan should be a runbook or playbook with step-by-step instructions to follow, as it’s not the best time to experiment.
- Always lock your computer when you leave your desk: 5/5. This is very important, as some companies track this violation and may terminate employees for repeated infractions.
- Granting users unrestricted access to systems to move fast: 1/5. This is a terrible idea. Moving fast is not an excuse for poor security. It will lead to a breach, and the resulting fines will be far greater than any short-term gain.
Conclusion: Securing the Cloud in Perpetual Motion
Cloud security today is defined by the relentless pace of change and the challenge of enforcing least privilege and basic configurations across an ever-expanding attack surface. The solution lies in a layered, proactive strategy: cutting off misconfigurations at the source, adopting frameworks like the CCM to prioritize efforts, and recognizing the need for specialized cloud security teams. As the industry faces the imminent challenges of AI security and quantum computing, early investment in knowledge will be critical to staying ahead of the curve.
