In the rapidly evolving world of cloud-native infrastructure, the traditional security perimeter has dissolved. Organizations now manage hundreds of SaaS vendors and thousands of ephemeral Kubernetes workloads, making “knowing what you have” one of the most daunting challenges in cybersecurity.
We sat down with Kesten Broughton, a member of the security infrastructure team at Crunchyroll and former cloud security specialist at Praetorian and Nuro, to discuss why asset management is the bedrock of a security program. With over 12 years of experience in DevOps and security, Kesten provides a roadmap for building a streaming, enriched, and engineering-friendly asset inventory.
You can read the complete transcript of the epiosde here >
Why is Asset Management the Most Important Component of Security?
Asset management is often cited as the most critical part of a security program because it provides the foundational visibility needed to answer basic questions in seconds rather than days. For example, if a security team identifies a suspicious IP address, a robust asset inventory can immediately determine if it belongs to their AWS or GCP environment, an on-prem system, or a third party.
Without a centralized data lake or warehouse to ingest these feeds, tracking down system owners and permissions can take significant time, leaving the organization vulnerable. Asset inventory is essentially about the ability to query your organization’s entire footprint in a matter of seconds.
How Should Organizations Prioritize Assets in the “Swiss Cheese” Perimeter?
Kesten notes that the concept of a strong perimeter has been replaced by a “Swiss cheese” model, where everything is connected to the web. For startups and enterprises alike, prioritization should follow these steps:
- Third-Party SaaS Vendors: Most companies use 300 to 500 SaaS tools but cannot list them all. Organizations must track these because if a vendor is compromised, they need to know immediately if they are at risk. This is where a solid third-party risk management program becomes essential.
- Outside-In Visibility (DNS): DNS is often the primary entry point for attackers. “Dangling subdomains” — records pointing to ephemeral cloud IPs that have been released — allow attackers to claim that IP and launch attacks using the trust of the organization’s domain.
- Registrar Management: Younger companies often find their domains are still registered in the name of a founder who may not check expiration warnings.
What Makes Kubernetes Asset Management Different from Traditional Cloud Resources?
While daily snapshots are sufficient for slow-moving assets like DNS records or static EC2 instances, they are completely inadequate for Kubernetes. Kubernetes workloads are highly ephemeral and often exist for less than a day.
To avoid being out of touch during a security incident, organizations should:
- Avoid “For Loops”: Manually querying 100 clusters and thousands of namespaces via APIs is slow, inefficient, and can potentially DDoS your own system.
- Use Cloud-Native Feeds: Leverage services like GCP Cloud Asset Inventory feeds or AWS Config to get real-time state information.
- Implement Pub/Sub: Configure the cloud to send continuous updates to a Pub/Sub feed that triggers database updates on the backend, ensuring you have the latest state information.
This event-driven streaming approach is the correct paradigm for Kubernetes — treating asset inventory as a real-time data pipeline rather than a periodic snapshot.
How Can Organizations Enrich Asset Data to Drive Ownership?
A list of IPs is useless if the security team doesn’t know who to contact when a vulnerability is found. The native GUIs provided by cloud providers are often too limited for full SQL queries or data joins.
Kesten recommends dumping asset inventory into BigQuery (GCP) or Athena (AWS) to enable deeper analysis. Key enrichment strategies include:
- Tagging: This is the most underutilized tool in the cloud. Organizations should use linters to refuse any deployment that lacks an owner tag. A strong tagging strategy is the foundation of asset ownership at scale.
- Mapping to Code: Enrich data by mapping infrastructure back to GitHub CODEOWNERS files or Terraform modules. This creates a direct line from any asset to the team responsible for it.
- Graph Layers: Transition from a spreadsheet view to a “spider web” or graph view. This allows security teams to see how an IP is connected to a load balancer, which is connected to Route 53, which is vital for end-to-end tasks like blocking bot traffic.
Can Security Automation Be “Overdone”?
Contrary to common industry trends, Kesten argues that automation can sometimes be overdone if the maintenance effort exceeds the security value.
- Infrastructure as Code (IaC) Drift: Terraform models the cloud state, but the cloud is the source of truth. Minor provider updates (e.g., changing a default from an empty string to “none”) can break deployments that haven’t been touched in months. Understanding IaC security trade-offs is critical for making pragmatic decisions.
- Security Logic vs. IaC: If a one-off security deployment (like a logging sink) will not be touched for a year, building it manually or via CLI commands may be more efficient than maintaining a complex Terraform module.
The key insight is that automation should serve the team, not the other way around. Every automated system carries a maintenance cost that must be weighed against its security value.
How Can Security Teams Help Engineering Move Faster?
Security should focus on removing friction for developers rather than becoming the “department of no.”
- Identity-Aware Proxy (IAP) “Paved Roads”: Security can create standard, documented ways to implement IAPs for backend admin panels, reducing the number of “permission denied” errors in the logs.
- Post-Deployment Checks: Instead of a blocking code-scanning gate that interrupts a tight development loop, consider post-deployment checks. While this may leave a vulnerability live for a few hours, it may allow a team to meet several more sprint objectives over a year — a trade-off that is often worth the risk. This philosophy aligns with shifting security culture from friction to flow.
How Does Kesten Rate Common Security Practices?
- Unrestricted Access (Rating: 3/5): While a “1” for production, Kesten rates this as a “3” for non-prod. Supporting “Wild West” zones — where developers have full ownership but automation “annihilates” all resources weekly — helps them move faster without accumulating risk.
- Periodic Security Audits: Third-party pentests are often expensive “checkbox exercises.” A better approach is to use Bug Bounty programs to leverage the creativity of niche attackers.
- Training and Awareness (Rating: 1/5): A one-size-fits-all approach is ineffective. Training must be tailored; for example, Finance needs to know about fake invoice scams, while Legal and Security need better joint workflows.
Conclusion: From Compliance Task to Strategic Asset
Asset management in the cloud and Kubernetes is a dynamic engineering challenge rather than a static compliance task. By shifting toward real-time feeds, enriching data with ownership tags, and maintaining a “paved road” approach that enables engineering velocity, organizations can turn their asset inventory into a strategic defensive asset.
The organizations that treat asset management as a living, streaming data problem — rather than a quarterly spreadsheet exercise — will be the ones best positioned to respond to incidents in seconds rather than days.
Learning Resources Recommended by Kesten Broughton
-
Darknet Diaries Podcast
Fascinating stories on social engineering and hacking that highlight the human psychology behind many breaches. A must-listen for security professionals who want to understand attacker motivations.
People Also Read
- What is Cloud Asset Management?
- Importance of Kubernetes Security
- Tagging Strategies
- A Detailed Guide on Tagging for Better Cloud Cost and Resource Management
- Strategies For Defending Kubernetes Cluster
- The Digital CCTV: A Masterclass in Cloud Detective Controls
- The Cloud Security Saga
- Shifting the Security Culture: From Friction to Flow
