5 Reasons Why CSPM Tools are not Enough

Cloud Security

This post was written by Jennifer Gill, VP Product Marketing at Skyhawk.

Cloud Security Posture Management (CSPM) tools are an important part of any security strategy. However, they fall woefully short in terms of being the end game to secure your public cloud. Why? They only look at the static configuration of your environment, and only for the assets you know you have. Developers and IT teams are spinning up resources all the time – is the security operations center (SOC) aware of those? Have any assets been exploited? How were they exploited? These important questions cannot be answered by CSPM tools alone.

Here are the top 5 reasons why CPSM tools are not enough:

  1. Not all misconfigurations can be fixed.

Most CSPM tools are pretty good at detecting issues – so you find the misconfiguration which is great – but, can you fix it? According to a Gartner® report, “Through 2026, non-patchable attack surfaces will grow from less than 10% to more than half of the enterprise’s total exposure, reducing the impact of automated remediation practices.” .[1] If you can fix it – it is going to take a while. There are reports that this can be anywhere from 60 to 256 days[2][3]. You need a threat monitoring platform to protect your cloud and enable you to live with these known vulnerabilities.

  1. 15% of breaches are due to misconfigurations[4], what about the other 85%?

Monitoring the configuration will help you find open ports, non-compliance with specific initiatives, and other misconfigurations which account for 15% of breaches – but what about the other 85%?  Advanced threat detection tools look beyond the static environment and look at the activities and behaviors in the environment. All breaches are going to have an element of bad behavior even where a misconfiguration is used! The open port will be used by a bad actor to gain access to your company’s financial data. The open port is interesting, the fact that it was used is evidence of the breach.

  1. Even if you are 100% compliant, you are not 100% secure.

Prevention is needed but will not guarantee you are not breached. Prevention and compliance are not enough. Developers, administrators, and others are constantly in the cloud and doing work. This means that your cloud configuration is always changing, so you are always chasing compliance. You will never close the gap. This is why you need to focus on the runtime along with eliminating misconfigurations – prevention and detection. You need to implement and follow best practices, but even with 100% compliance you can still be breached – and CSPM tools will not alert you on this.

  1. An attack is not a single event. They are a series of events that make up stories that evolve over time.

Once you analyze an attack, it is not a single event. An attack is not just a single anomaly – like someone started their day at 6 AM versus their usual 9 AM, or network activity suddenly spiked. Breaches are a sequence of events of suspicious and malicious behavior that are executed over time to cause damage to your company. Monitoring of the runtime by a threat detection solution makes it easy for the SOC to see these malicious behaviors and to understand how the attack unfolded. A CSPM tool will not show you each and every step in the attack. The security team needs to understand how the attacker got into the environment and moved throughout the organization.

  1. It isn’t dynamic or static – it’s dynamic AND static, over time.

Looking at the configuration is helpful and looking at the activities in the environment is also helpful – but looking at both the configuration and activities over time is how you are actually able to detect an incident or realert. Many solutions do a point in time analysis of the configuration and behavior – so if you don’t see an interesting issue in the configuration or behavior at that time, some security tools will simply dismiss that data and move on and that data will not be available for analysis again. Today’s advanced threat detection tool leverages artificial intelligence and machine learning to build models of what is normal for your environment. This personalized context will look for changes from the normal behavior, over time, to identify the risky behaviors that need to be investigated.

[1] Gartner, Predicts 2023: Enterprises Must Expand from Threat to Exposure Management, Jeremy D’Hoinne, Pete Shoard, et al.., 1 December 2022 . GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved

[2] https://www.securitymagazine.com/articles/95929-average-time-to-fix-severe-vulnerabilities-is-256-days

[3] https://www.prnewswire.com/news-releases/organizations-take-an-average-of-60-days-to-patch-critical-risk-vulnerabilities-301496256.html#:~:text=Organizations%20Take%20an%20Average%20of%2060%20Days%20to%20Patch%20Critical%20Risk%20Vulnerabilities

[4] Verizon, Data Breach Investigation Report, 2022.

 

Blog

Continuous evolving clouds with continuously evolving threats need continuous threat exposure management (CTEM). This programmatic approach to managing threat exposures can help organizations dramatically reduce breaches. Many organizations are well on their way. According to a Gartner Peer Insights survey,

Cloud SecurityAIData BreachThreat Detection
Blog

Please check out this guest blog post by Alex Sharpe, a Cyber Security Expert with decades of experience. The SEC Cybersecurity Rule is designed to provide transparency so investors can make information decisions. The rule effectively imposes two requirements on

Cloud SecurityAIData BreachThreat Detection
Blog

Security teams are quickly realizing the benefits of Generative AI and are incorporating this technology into their security products for earlier detection of risks in the environment. AI can help security teams better recognize and resolve threats and exposures in

Cloud SecurityAIData BreachThreat Detection
Blog

Can you believe that re: Invent ended only 10 days ago! Skyhawk had a great event – great conversations, a great product launch and lots of coverage. So, what did we learn? Purple team is “the perfect use case for

Cloud Security
Blog

The reason why cloud threat detection is so difficult is for one reason – it requires expertise to make sense of vast amounts of disjointed data. There is too much data to sort though, aggregate, correlate, and determine the outcome

Cloud Security
Blog

This blog was written by Amir Shachar, Director, AI and Research. As we saw in Part 1 of this blog series, New Horizons in Cloud Security, the new approach to leveraging large language models was outlined. In this blog, we

AIAuthenticationData ScienceLLMs

Thanks For Reaching Out!

One of our expert will get back to you
promptly at asafshachar@gmail.com

Ready?
Fill out the form and we'll schedule your demo
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.