How Built-in Security Increases Agility and Reduces Risks

In a newly released 2021 Global Threat Intelligence Report, NTT research reveals a strong focus on protecting cloud services, with half of respondents citing it as a top cybersecurity focus over the next 18 months. And there is good reason for this focus as more business solutions move to the cloud. Yet, to combat a growing order of cloud threats, it’s important to maintain a balanced approach that maintains business agility while growing your security posture.

Grow Security Efficiency

Focus less on the “cool new thing” in security and instead train your sights on growing the efficiency and efficacy of existing security processes and technologies. Do so by asking tough questions around the attack patterns you’re trying to avoid and answer these questions with how you can automate best-practice security processes for ultimate benefit. Focus on automating security to generate greater control over your cloud architecture and new cloud assets as they are created.  

Build In Security

In the cloud, security automation ideally starts by building in security. To illustrate the point, think of two race cars – one with a roll cage that was bolted to the exterior just as its race was about to begin, and the other that was built specifically for racing with the roll cage built into the frame of the car.

Shifting security one step to the left is like the first car. Yes, it’s safer than it was before, but certainly not as safe as the purpose-built vehicle. Similarly, cloud security should not be an architectural afterthought. To grow your maturity and the efficacy of your cloud security program, it’s important to build in security controls, processes and policies as part of your system design.

Cloud platforms and technologies enable you to include elements like containers, immutable infrastructure, and continuous integration and delivery (CI/CD) that can provide automated security at scale and continuous compliance. In this way, security policies are not applied but rather automated across all IT processes as they occur.

• Containers help strengthen your security posture and make it more defensible. They do so by bringing security to the build effort, rather than putting it in the hands of operations to manage at deployment. Moreover, once a container image is built, it can’t be tampered with; you can only run static analysis on it.
• Immutable infrastructure is an approach that treats service components like replaceable parts, rather than fragile artifacts. Instead of fixing or updating components, they are simply removed and replaced. This approach enhances security as it removes change-related risk – especially when automation is used to deploy components that are pre-approved with configurations that meet control objectives and security policies. These set components can be built with Golden AMIs (a pre-approved or template AMI). They can save organizations time because once they are built, they are simply replicated. And they reduce risk by ensuring consistency across the environment.
• Cloud-based CI/CD pipelines using containers and immutable infrastructure are also easier to secure and audit. Once you’ve proven that the pipeline was correctly built, you are essentially done with the audit. Cloud automation also provides the opportunity for continuous — rather than periodic -— audits. Start by identifying the list of controls you’d like to implement (e.g., regulations and best practices like PCI, GLBA, HIPAA, and CIS Benchmarks).

DevSecOps approaches encourage security processes, policies, and controls to be proactively built into systems as they are designed. Doing so encourages the use of best-practice templates and processes that make security protocols easier to follow. And when following security processes becomes easier, overall security is enhanced as people are less likely to do the work to bypass it. Building these processes and policies into your systems also creates a positive cycle where security becomes a byproduct. For example, automation results in fewer opportunities for human error, which in turn reduces risk. 

As organizational threats continue to grow and evolve, organizations should seek ways to build security into the very bedrock of their cloud infrastructures. In addition to more effectively guarding against attacks, this approach allows you to create security guardrails that empower developers and IT operations to increase their speed, growing your business agility.

Learn more about accelerating security with agility with Container Innovation.