5 Reasons Why CSPM Tools are not Enough

Cloud Security

This post was written by Jennifer Gill, VP Product Marketing at Skyhawk.

Cloud Security Posture Management (CSPM) tools are an important part of any security strategy. However, they fall woefully short in terms of being the end game to secure your public cloud. Why? They only look at the static configuration of your environment, and only for the assets you know you have. Developers and IT teams are spinning up resources all the time – is the security operations center (SOC) aware of those? Have any assets been exploited? How were they exploited? These important questions cannot be answered by CSPM tools alone.

Here are the top 5 reasons why CPSM tools are not enough:

  1. Not all misconfigurations can be fixed.

Most CSPM tools are pretty good at detecting issues – so you find the misconfiguration which is great – but, can you fix it? According to a Gartner® report, “Through 2026, non-patchable attack surfaces will grow from less than 10% to more than half of the enterprise’s total exposure, reducing the impact of automated remediation practices.” .[1] If you can fix it – it is going to take a while. There are reports that this can be anywhere from 60 to 256 days[2][3]. You need a threat monitoring platform to protect your cloud and enable you to live with these known vulnerabilities.

  1. 15% of breaches are due to misconfigurations[4], what about the other 85%?

Monitoring the configuration will help you find open ports, non-compliance with specific initiatives, and other misconfigurations which account for 15% of breaches – but what about the other 85%?  Advanced threat detection tools look beyond the static environment and look at the activities and behaviors in the environment. All breaches are going to have an element of bad behavior even where a misconfiguration is used! The open port will be used by a bad actor to gain access to your company’s financial data. The open port is interesting, the fact that it was used is evidence of the breach.

  1. Even if you are 100% compliant, you are not 100% secure.

Prevention is needed but will not guarantee you are not breached. Prevention and compliance are not enough. Developers, administrators, and others are constantly in the cloud and doing work. This means that your cloud configuration is always changing, so you are always chasing compliance. You will never close the gap. This is why you need to focus on the runtime along with eliminating misconfigurations – prevention and detection. You need to implement and follow best practices, but even with 100% compliance you can still be breached – and CSPM tools will not alert you on this.

  1. An attack is not a single event. They are a series of events that make up stories that evolve over time.

Once you analyze an attack, it is not a single event. An attack is not just a single anomaly – like someone started their day at 6 AM versus their usual 9 AM, or network activity suddenly spiked. Breaches are a sequence of events of suspicious and malicious behavior that are executed over time to cause damage to your company. Monitoring of the runtime by a threat detection solution makes it easy for the SOC to see these malicious behaviors and to understand how the attack unfolded. A CSPM tool will not show you each and every step in the attack. The security team needs to understand how the attacker got into the environment and moved throughout the organization.

  1. It isn’t dynamic or static – it’s dynamic AND static, over time.

Looking at the configuration is helpful and looking at the activities in the environment is also helpful – but looking at both the configuration and activities over time is how you are actually able to detect an incident or realert. Many solutions do a point in time analysis of the configuration and behavior – so if you don’t see an interesting issue in the configuration or behavior at that time, some security tools will simply dismiss that data and move on and that data will not be available for analysis again. Today’s advanced threat detection tool leverages artificial intelligence and machine learning to build models of what is normal for your environment. This personalized context will look for changes from the normal behavior, over time, to identify the risky behaviors that need to be investigated.

[1] Gartner, Predicts 2023: Enterprises Must Expand from Threat to Exposure Management, Jeremy D’Hoinne, Pete Shoard, et al.., 1 December 2022 . GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved

[2] https://www.securitymagazine.com/articles/95929-average-time-to-fix-severe-vulnerabilities-is-256-days

[3] https://www.prnewswire.com/news-releases/organizations-take-an-average-of-60-days-to-patch-critical-risk-vulnerabilities-301496256.html#:~:text=Organizations%20Take%20an%20Average%20of%2060%20Days%20to%20Patch%20Critical%20Risk%20Vulnerabilities

[4] Verizon, Data Breach Investigation Report, 2022.

 

Blog

In honor of Cybersecurity month, Skyhawk Security is offering a free 30-day subscription to the complete platform.   Why try Skyhawk Security?  Your Security and Development teams are overwhelmed with the number of CNAPP findings. There is a constant argument between

AICloud BreachCloud SecurityThreat Detection
Blog

When Skyhawk set out to develop a new cloud security solution it was already clear that traditional security paradigms were not appropriate for cloud environments. Traditional security was built to secure on-premises environment. These environments were protected by numerous security

AICloud BreachCloud SecurityThreat Detection
Blog

As seen from recent security incidents involving cloud-based systems (for instance- numerous cyber incidents in the healthcare sector), reliance on cloud services can amplify cybersecurity risks associated with third parties and the supply chain. For example, some organizations allowed external

AICloud BreachCloud SecurityThreat Detection
Blog

With the exploitation of vulnerabilities on the rise, many organizations are evaluating vulnerability management solutions. However, vulnerability management provides only a partial picture of what is happening in the environment. Organizations need to take a more comprehensive approach, looking not

AICloud BreachCloud SecurityData BreachData ScienceThreat Detection
Blog

Cloud security teams are evolving their security approach, going beyond alerts and looking at the threat exposure with a business context. This enables the cloud security team to prioritize security gaps based on the value of the asset behind it.

AICloud BreachCloud SecurityData BreachData ScienceThreat Detection
Blog

Blackhat 2024 wrapped up last week and we had quite a show! We advanced our Purple Team, creating a new asset for our partners to advance their sales and spread the news on Skyhawk, discussed our automated response capabilities with

AICloud BreachCloud SecurityData BreachData ScienceThreat Detection

Thanks For Reaching Out!

One of our expert will get back to you
promptly at asafshachar@gmail.com

See the Purple Team
See the breach before it happens
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.