{"id":117100,"date":"2020-08-03T12:00:27","date_gmt":"2020-08-03T19:00:27","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=117100"},"modified":"2020-08-03T11:54:59","modified_gmt":"2020-08-03T18:54:59","slug":"cloud-cis-controls","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/08\/cloud-cis-controls\/","title":{"rendered":"Do You Have Enough Cloud Security? Use CIS Controls to Assess Yourself"},"content":{"rendered":"

Clients often ask me, \u201cHow do I know if I have \u2018enough\u2019 security in the cloud?\u201d This is a great question because it shows a willingness to learn. The truth is that there is no right answer.\u00a0<\/span><\/p>\n

However, a simple place to begin is the basics. You should be sure you\u2019re covering the basics well and tracking them closely. This is why I am a huge fan of standards. While they are not the be-all and end-all for security, they give you an excellent place to start. One common set of standards are the Center for Internet Security\u2019s (CIS) <\/span>top 20 controls<\/span><\/a>, a prioritized list of 20 best practices that help organizations improve cybersecurity.<\/span><\/p>\n

 <\/p>\n

CIS Controls: Benchmarks for Cloud<\/span><\/h2>\n

Threat research shows<\/span><\/a> that 65% of cloud security incidents are the result of customer misconfigurations. Why is this number so high? Because organizations are not getting the security basics right. This is where standards like<\/span><\/p>\n

the CIS controls can provide an excellent benchmark for those foundations.\u00a0<\/span><\/p>\n

\"This<\/span><\/div>
Figure 1: CIS 20 Critical Controls
Source: Center for Internet Security<\/figcaption><\/figure>\n

A great exercise for your cloud program is to map these 20 controls against what you have in place today. With the exception of control 15, Wireless Access Control, these are all relevant to varying degrees across infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS) platforms.\u00a0<\/span><\/p>\n

 <\/p>\n

Measure a Complete View of Cloud Security Using CIS 20<\/span><\/h2>\n

The trick for your security program is to measure as many of the 20 controls as possible using cloud native tooling. <\/b>By cloud native, I mean platforms that integrate with multiple cloud service providers (CSPs), hybrid-cloud environments and common software development tools like CircleCI, GitHub and Jenkins.\u00a0<\/span><\/p>\n

Most security teams think of only the attack surface on the CSP, however the entire CI\/CD pipeline is just as critical. This is why it\u2019s important to use <\/span>security platforms that are completely integrated<\/span><\/a> across all the major public cloud providers and development pipelines. Otherwise, you are only seeing a part of the picture. See figure 2 below.<\/span><\/p>\n

\"This<\/span><\/div>
Figure 2: Full lifecycle, full stack and multi-cloud coverage from cloud native tooling<\/figcaption><\/figure>\n

 <\/p>\n

We know that most security programs lack this holistic view into the development pipeline thanks to the <\/span>Spring 2020 Cloud Threat Report from Unit 42<\/span><\/a>. Researchers analyzed hundreds of thousands of infrastructure as code (IaC) templates and came up with some interesting findings. The most pertinent: nearly 200,000 insecure templates in use, 43% of cloud databases not being encrypted and 60% of cloud storage services with logging disabled. These numbers illustrate why it\u2019s important to examine your entire cloud stack when assessing your cloud security.\u00a0<\/span><\/p>\n

\"The<\/span><\/div>
Figure 3: Lack of visibility into the development pipeline
Source: unit42.paloaltonetworks.com\/cloud<\/figcaption><\/figure>\n

 <\/p>\n

How to Apply CIS Controls to Cloud Development<\/span><\/h2>\n

So how do you apply the CIS 20 to your entire cloud stack? The first thing I recommend is reading through the <\/span>CIS Controls Cloud Companion Guide<\/span><\/a>. The guide will help you create metrics for each control, decide what end result you\u2019re looking for and begin to work backward to determine where and how to collect data.\u00a0<\/span><\/p>\n

\"This<\/span><\/div>
Figure 4: Example of a spreadsheet for tracking the CIS 20 in the Cloud<\/figcaption><\/figure>\n

Again, it's important to keep the entire cloud stack in mind. Don\u2019t just focus on the CSP but be sure to include your entire development pipeline. These 20 critical controls should evenly apply across the stack.\u00a0<\/span><\/p>\n

Don\u2019t expect to have this process perfect overnight. A great way to test this out would be to make these metrics a key requirement for any proofs of concept your team is likely running on <\/span>cloud native security platforms<\/span><\/a> (CNSPs). <\/span>The key question is will the CNSP enable you to track these metrics over time and take corrective action when necessary?<\/b><\/p>\n

 <\/p>\n

How Much Is Enough Cloud Security?<\/span><\/h2>\n

In my view, you can only begin to answer the question of whether you have \u201cenough\u201d cloud security by first covering the basics. Step number two \u2013 and the key to long term success in the cloud \u2013 then comes by measuring the controls consistently over time across the entire stack. Combined, these give you a better sense of your overall posture, and can inform whether your current controls are enough.\u00a0\u00a0<\/span><\/p>\n

You can see real-world data on how thousands of other companies are securing their cloud native stacks in the <\/span><\/i>State of Cloud Native Security 2020<\/span><\/a> survey. <\/span><\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

The top 20 CIS controls can be a good starting point to determine if you have enough cloud security.<\/p>\n","protected":false},"author":623,"featured_media":113010,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6768],"tags":[7243,6890,635],"coauthors":[6679],"class_list":["post-117100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-cloud","tag-cis-controls","tag-prisma-cloud","tag-soc","cloud_sec_category-devsecops"],"jetpack_featured_media_url":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/06\/prisma-cloud-state-cloud-native-security-report-2020-blog-900x400-1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/117100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/623"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=117100"}],"version-history":[{"count":4,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/117100\/revisions"}],"predecessor-version":[{"id":117169,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/117100\/revisions\/117169"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/113010"}],"wp:attachment":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=117100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=117100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=117100"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=117100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}