Cloud Security Posture Management solutions have become a must for detecting and fixing misconfigurations in public clouds – from code to runtime.

As organizations eagerly adopt public cloud services to digitally transform business processes, they encounter critical cloud-based vulnerabilities their legacy tools can’t address. To find and fix these software flaws, misconfigurations and identity compromises, organizations need a cloud security posture management (CSPM) solution.

First introduced years ago, CSPM offerings have gone through several innovation cycles, and are now entering mainstream status in the cloud security market. However, as often happens with in-demand technologies, the market buzz can make it hard for security leaders to separate the signal from the noise as they evaluate the options.

Worry not – we’ve got you covered.

In this blog post, we’ll explain what CSPM is, which capabilities you should look for and what questions you should ask in order to choose the right solution for your cloud security needs.

The skinny on CSPM 

For years, organizations have been boosting their usage of public cloud infrastructure, but the adoption went into overdrive during the pandemic, as IT departments scrambled to adapt to the rise in remote work.

This trend has sped up the adoption of cloud security wares, including CSPM, which automates the detection and resolution of security and compliance issues — such as misconfigurations — in applications and services developed for and deployed in public cloud infrastructures.

At first, CSPM focused on establishing a secure configuration baseline in runtime environments and monitoring them for drift. This approach sufficed when cloud infrastructure was defined and managed in runtime.

However, a significant portion of cloud infrastructure is now defined and managed as code during the development stage, a trend that’s expected to intensify – meaning that misconfigurations are also introduced during development.

Thus, as the popularity of infrastructure-as-code (IaC) grows, CSPM solutions must be able to “shift left” to detect and resolve misconfigurations during development as well – not just in runtime.

The three tenets of modern CSPM

As you evaluate CSPM offerings, make sure that they offer capabilities in these three key areas:

Securing IaC 

The CSPM solution must scan IaC during development, when code is being written, to detect and resolve misconfigurations and establish a secure baseline. This ensures that cloud infrastructure is not provisioned with risks and is “born secure.”

Important questions to ask:

What types of IaC, and which compliance and security standards are supported?
How many predefined policies are available?
How are breach paths identified and issues prioritized for resolution?
Is code automatically generated to resolve misconfigurations and create pull requests?
Which CI/CD tools does the solution integrate with?

Monitoring infrastructure configurations in runtime

Because users will change configurations in runtime, causing drift, the CSPM offering must continuously monitor configurations in runtime against the IaC baseline to maintain a secure environment.

Important questions to ask:

What runtime environments are supported?
Does the solution identify resource creation or termination relative to a secure baseline defined through IaC?
Does the solution identify changes to the configuration of a resource from its definition in the IaC baseline?
Does the solution apply the same set of policies in runtime that were used to assess IaC?
How does the solution identify potential breach paths in runtime and prioritize issues for resolution?

Remediating through IaC

The CSPM should always refer to IaC as the single source of truth, so if a change introduces risk, the cloud instance is redeployed based on the secure IaC baseline. Otherwise, the IaC is updated to reflect the change and establish a new IaC baseline.

Important questions to ask:

When a change is made in runtime, does the solution automatically generate the code to resolve the issue?
Does the solution programmatically create pull or merge requests with the code in order to update the IaC and remediate the drift created in runtime?

Want more in-depth CSPM insights?

We hope this information proves useful in your efforts to select the best CSPM solution for your organization. If you want a deeper dive into this topic, download our ebook “Vulnerability Management from Code To Cloud: Your Guide to Modern CSPMs” which goes into much more granular details about what to look for in a next-gen CSPM.

Download the ebook today!

Read More

One of the largest library services in Germany, EKZ Bibliotheksservice, has been impacted by a ransomware attack that has left book lovers unable to rent and borrow eBooks, audio books, and electronic magazines.

Read more in my article on the Hot for Security blog.

Read More

A police car’s digital in-car video system uncovered that two Los Angeles officers ignored calls to provide assistance at a department store robbery because they were too enthralled in catching Pokémon.

Read More

Multiple series of network switches manufactured by Aruba Networks, owned by Hewlett Packard Enterprise, and Avaya, owned by Extreme Networks, are vulnerable to attacks that could allow attackers to break network segmentation, exfiltrate data from internal networks to the internet, and escape captive portals. The flaws stem from mistakes made by the vendors when implementing a popular embedded TLS library.

The vulnerabilities are rated critical and can lead to remote code execution (RCE), according to researchers from security firm Armis who found them. These flaws, collectively dubbed TLStorm 2.0, could enable attackers to take full control, often without authentication, of switches that are deployed in a wide variety of enterprise networks and are also used to isolate public-facing network segments in airports, hospitals, hotels and other organizations.

To read this article in full, please click here

Read More

This blog was written by an independent guest blogger.

APIs are a crucial tool in today’s business environment. Allowing applications to interact and exchange data and services means that companies can provide an ever-greater range of features and functionalities to their clients quickly and easily. So, it is no wonder that a quarter of businesses report that APIs account for at least 10% of their total revenue – a number that will only increase in coming years.

But for all their benefits, APIs also create security concerns for organizations. In one survey of API users, 91% reported an API-related security incident. Unfortunately, API security efforts within many organizations are simply not sufficient, exposing the company and its clients to attack and loss of sensitive data. 

Every business that uses APIs, indeed every business even thinking about using APIs, should have a solid API security strategy in place. This article reviews API vulnerabilities and outlines steps organizations should take to secure their APIs.

The importance of APIs

APIs provide numerous benefits for both businesses and their customers. At its most basic level, an API is simply a tool that allows an application to communicate with external applications and data sources. Developers can leverage these connections to create new applications, functionalities, and analytical tools, speeding the pace of business innovation and constantly improving user experience.

APIs facilitate everything from online payment systems and banking to travel aggregator services, social media, and media streaming services. They are also an important part of the rapidly expanding cryptocurrency world. 

Crypto developers use APIs to build decentralized applications (DApps) on blockchains. APIs also interact with the smart contracts that control everything from transactions to the formation of decentralized autonomous organizations (blockchain governance structures known colloquially as DAOs).

APIs also ease data sharing among corporate applications, reducing the need for repetitive and wasteful data entry. And they are an essential part of automating many business functions. And in a business environment that increasingly includes remote workers, they help businesses build effective collaboration tools to ensure that their teams continue to work well, even when virtual.

Businesses can also use APIs for advanced competitive intelligence programs. Not only can they simplify the aggregation of competitive data from a range of sources, but they are integral in building effective data analytics and display tools. 

They can even be used to continuously track changes to your competitors’ websites so you can always be on top of the latest innovations in your industry (e.g., with tools like Visualping).  

API security vulnerabilities

Because APIs are such a dominant part of the business landscape, cyber attackers have targeted them with growing frequency. Gartner predicted that API attacks would be the most common attack vector this year, and that prediction is rapidly proving true.

Some of the world’s largest and most sophisticated companies have suffered widely publicized data breaches resulting from API attacks. And as businesses have painfully learned, hackers have many different ways to attack APIs.

Targeting code vulnerabilities

As with any software, APIs are only as good as their underlying code. Poor coding of APIs creates inherent vulnerabilities that hackers are only too happy to exploit.

DDoS attacks

Distributed denial of service attacks, which attempt to render APIs completely unavailable to users by overwhelming them with traffic, are rapidly increasing in frequency. One reason is the increase in e-commerce in recent years. DDoS attacks can prevent access to inventories by adding stock to carts that they then never check out (denial of inventory attack).

Failed authentication and access control policies

It is crucial for organizations to strictly control API access and require strong authentication. Company API security policies should include role-based access control, least privilege, and zero trust policies to limit opportunities for hackers to interfere with APIs using compromised credentials. These policies will also help restrict how far a successful hacker can get within company systems using compromised credentials, especially if companies strictly limit granting wide-ranging privileges to users.

Man-in-the-Middle (MitM) attacks 

Hackers can insert themselves between users and APIs by intercepting and changing the communications between them. Using MitM attacks, hackers can gain access to sensitive user accounts and information, which they can use to exfiltrate company data. The danger of MitM attacks increases when companies do not apply transport layer security (TLS) in their APIs.

Securing your APIs

So what steps do businesses need to take to have the best security possible when using APIs? 

Build an API inventory

The first step is to know what APIs you have and how you use them. A complete API inventory, including whether you have multiple versions of a given API, allows you to minimize your overall attack surface by eliminating unused or outdated APIs. An API inventory also helps you prioritize your security efforts, directing resources towards your most critical systems.

Create effective API security policies

API vulnerabilities start well before a hacker ever enters the picture. Unfortunately, many companies don’t adequately protect their API assets because they don’t have API security policies in place, or if they do, those policies are ineffective. Organizations must apply strong security policies to their API usage and routinely enforce and update those policies.

Use strong authentication methods and encryption

In addition to having policies that limit who can access your APIs, you need to verify the identity of the people and services accessing them. Authentication methods such as API key or OAuth authentication harden your APIs against attacks and reduce your attack surface.

Limit data exposure

The less data transferred through an API, the less there is for an attacker to intercept or exfiltrate. Therefore, keep data sharing across an API to what is absolutely necessary. Not only do you minimize potential breach issues, but the organization will also be in a better position concerning compliance issues.

Conclusion

APIs will only continue to grow in popularity and utility. And they will also continue to be popular attack targets. So, make sure you are taking all the necessary steps to secure your APIs against attackers. 

Read More

Mozilla finds most are neither secure nor protect user privacy

Read More

Effective partnerships between CISOs and their cybersecurity vendors are integral to security success. A well-oiled relationship built on trust, communication and mutual understanding can reap significant benefits for a business’s cybersecurity posture. Conversely, one that is problematic and incohesive can have the opposite effect, negatively impacting a company’s security practices and leaving them vulnerable to risks and wasted investment.

“For CISOs, maintaining a positive relationship with their security vendors is an important element in staying informed on industry related trends, providing competitive analysis on alternative solutions and building trust in order to take on large partner-enabled initiatives,” John Hellickson, executive advisor at cybersecurity consultancy Coalfire, tells CSO. He notes that CISOs often have a select group of key security vendors that have become trusted partners where the relationship is mutually beneficial. “When CISOs fail to maintain positive working relationships with their security vendors they will often see their vendor provide less of a priority on their needs and overall responsiveness can be delayed, and in worst cases they may be flagged as a toxic account that no sales representative wants to be assigned,” he says.

To read this article in full, please click here

Read More