When you hear Gartner state that through 2025, 99% of all cloud security breaches will have a root cause of customer misconfigurations or mistakes, you can’t help but wonder—what is it that the experts and analysts know that customers don’t? Security teams are certainly aware of today’s cyber threats, whether that’s ransomware, supply chain attacks, or account takeovers. Organizations are keen on taking the necessary steps to make life difficult for attackers by deploying all the right endpoint and perimeter security along with multi-factor authentication (MFA).
There’s just one problem with that approach: none of these tools will help secure what happens in the cloud, and they are all prevention-centric. Okay, that’s two. Even the added measure MFA provides gets bypassed by cybercriminals on a regular basis (and don’t get me wrong, your organization should use MFA, but there is no silver bullet).
To gain more insight about how teams are securing their IaaS and PaaS environment, we recently surveyed hundreds of security professionals who work to secure the Amazon Web Services (AWS) cloud in their roles each day. You can see the findings in the State of Security Report: PaaS & IaaS—More People, More Access, More at Stake, where CISOs, security architects, and DevSecOps alike shared their experience and insight about how their organizations address the security of AWS deployments.
Go ahead and download the free report as there are some key takeaways that help explain many of the priorities and challenges organizations face when securing their cloud environments. Some of the highlights include:
Securely configuring the cloud remains a challenge
Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) have been foundational for DevOps engineers as IT teams head for cloud-native architectures as a solution to handle today’s always-connected businesses. However, visibility is lost when services move to the cloud which can leave you blind to compromised accounts, roles and abuse of misconfigurations, which all increase risk. The survey found that a surprisingly high number of responding organizations don’t have formal deployment sign-off, meaning people have access to make modifications without a process in place.
Companies are Investing heavily in security
With the rise of DevSecOps, there’s no doubt that organizations are continuing to prioritize security. Over half of those surveyed have over 10 employees in their Security Operations Center (SOC). We also found that both security and DevOps personnel are looking for more ways to be proactive and preventative in their roles, which shows that it’s not just the security folks who are prioritizing keeping assets safe.
Teams are looking for expanded coverage
There’s a sentiment expressed in the report that organizations are looking for coverage beyond the three basic AWS services. In fact, according to the findings, 71% said they need a solution that covers more than what is currently available from their cloud service provider.
These are just a few of the findings. Download the full State of Security Report: PaaS & IaaS—More People, More Access, More at Stake to get all the details.
If you’d like to see and stop threats against your AWS environment, get a 30-day free trial here!
Joe Malenfant is the Vice President of Product Marketing at Vectra. Joe and his team are responsible for creating differentiated position for Vectra’s solutions, providing clarity to prospects, customers, and partners. Joe has spent over 10 years driving innovation in cyber security including endpoint detection and response, industrial control systems (ICS), IoT, and network security. He has launched category defining products from pure play SaaS to hardware solutions for IT, IoT, and ICS environments. He regularly presents at industry conference including RSA, Cisco Live, and IIoT World.
Prior to Vectra, he led marketing for Cisco’s Internet of Things business, a $1B portfolio spanning over 5 product segments including cloud, networking, and security. Prior to joining Cisco in 2014 he led product and solutions marketing Lockheed Martin Commercial cyber security solutions through the acquisition of ICS security company, Industrial Defender. Joe holds an MBA from Johnson & Wales in Providence, RI and an undergraduate degree from Concordia University in Montreal, Canada.