Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
Secure data strategies for insecure times – Data protection has become very cloudy
By Brendan O’Connor, CEO and Co-Founder of AppOmni
Despite the tremendous innovations made in the speed and capacity of data storage along with the cybersecurity capabilities such as Data Loss Prevention (DLP) and behavior analytics, we are not close to closing the data exposure gap. The technology and its applications never stopped evolving, so the security goal posts have continued to move, and the holy grail of data safety remains largely elusive.
That’s not to say we haven’t tried; in fact, data-centric security has been a major focus of IT efforts for decades. Consider this: back in the day, sensitive data used to be parked in one location, typically in an on-premise data center, where perimeter protections and other measures did a respectable job of keeping files secure. But over time, as data began migrating between different applications and onto devices outside the control area, and as SaaS services and cloud computing came to dominate the world of big-time computation, the legacy approaches to data protection just didn’t work anymore.
Of course, newer tactics have attempted to staunch what eventually became a hemorrhage of private data and a global industry of criminals exploiting stolen information. Techniques like encryption, data masking, tokenization, firewalls, and detailed user policies were developed to shield sensitive data against attackers, and they do help, at least up to a point. But for many organizations, data protection remains a struggle – one amplified by the scale of current online operations, the emergence of third parties in the data cycle, and the pandemic-driven explosion of remote working.
One way of thinking about data security is to look at the lifecycle of data. An analysis by Securosis, LLC, visualizes it has having six stages: Creation, Storage, Use, Sharing, Archiving, and Destruction. Not every piece of data makes it through all six stages, but it’s still a useful way of visualizing the different stations where a piece of data might reside at any given time. That would allow you to make decisions about how best to protect that information and control access to it at that particular point. And it works in theory. But in practice, there are so many data types, and so many different data processing functions, so many different servers, so many legitimate users, and so many controls which apply at each phase of the lifecycle, that what might work in a small, isolated system becomes unwieldy when attempted at scale.
That said, there are some stages of the data lifecycle you don’t have control over since with cloud-based services, much of those controls are obscured. For example, fixing a system vulnerability that creates an exploit path giving attackers unapproved access, is the responsibility of the cloud provider, not the customer. The same applies to unauthorized paths that would allow data to exit the organization. The same holds true for storage, archiving and destruction. As a cloud customer, your most important security responsibility involves preventing unauthorized parties from accessing data by managing configuration and entitlements – making sure the right user, process, or service can perform the needed functions at approved times. Access control and Authorization are the keys to data security.
Even so, that’s easier said than done, particularly with the proliferation of apps and the frenetic pace of change which is characteristic of so many SaaS applications today. Creating appropriate policies and guardrails to safeguard access requires setting priorities to identify which applications have the most important and sensitive data. This can seem like a daunting task, but tools are available to help you keep your security posture current. They can be especially important with the current shortage of security personnel, the growing body of regulatory requirements, and the ongoing evolution of cyber threats.
One class of solutions to control access is known as Cloud Access Security Brokers, or CASB. As the name suggests, they act as in-line access brokers, overseeing user access to particular cloud services. CASB solutions come from different developers and focus on different features including detection of shadow IT, encryption of cloud data, and cloud-based data loss prevention. Their vendors often represent them as the standard of security for cloud services. But CASBs also have many shortcomings, including being reactive rather than proactive to intrusions and trading off detailed controls over SaaS applications for broad, network-based coverage.
An alternative class of solutions, SaaS Security Posture Management, or SSPMs address capabilities not available with CASBs. For example, by integrating with SaaS applications they can analyze the specific settings and configurations relevant to the service in question. They also tend to be more granular, in contrast to CASB’s one-size-fits-all approach. That can mean configurations can more closely represent the intentions of the client. SSPM monitoring also tends to be more proactive in flagging unusual behavior and identifying potential risks before they become actual breaches.
What’s the bottom line? The job of securing data is becoming harder all the time, and cyber criminals are getting more sophisticated. Legacy solutions don’t work in an environment where data is distributed across multiple applications, environments, and devices. That means different strategies and tools are required to keep your data out of the wrong hands. To make sure of that, enterprise security teams need all the help they can get.
##
About the Author
Brendan O’Connor – CEO and Co-founder, AppOmni
Brendan is a 20 year veteran of the security industry. Prior to founding AppOmni, he was Security CTO at ServiceNow. Before joining ServiceNow, Brendan spent 10 years at Salesforce where he led Salesforce’s global information security organization as CSO. Prior to his role as CSO, Brendan was VP Product Security at Salesforce. Brendan has also worked in the Financial Services and Communications sectors. His past experience includes work as a vulnerability researcher, security engineer, and privacy advocate. He is passionate about securing the technology that connects the world.
