Prisma Cloud CSPM looks to mitigate DevSecOps conflicts

From rules to real DevSecOps threats

Rules-based CSPM tools can help standardize and automate security policy management with fewer hindrances to developer velocity, but this approach doesn't identify which policy violations represent real security threats in the IT infrastructure.

If security teams in large organizations forward all policy violation alerts from such systems to developers for patching, those developers may get fatigued and less responsive to urgent requests, Badhwar said.

Hence, the release of an update to Prisma Cloud CSPM this week, called True Internet Exposure. The feature compares machine learning analysis of cloud network paths against security policy rules, narrowing down the number of policy violation alerts to those most likely to involve real threats.

"A security group may allow traffic from the internet to a host, but if a developer has hardened the host so you're not even listening on [the right] port, there's no exposure per se," Badhwar said. "At scale, security teams were going to developers saying, 'Why is this security group open?' and developers were saying, 'Look, stop bothering me with stuff that's noise. If you only paid attention, you'd realize that's not a real security issue.'"

Similarly, a Data exfiltration detection feature added to Prisma Cloud CSPM this week looks at a broader set of metadata than in previous versions of the software, including network flow logs, audit logs and threat intelligence data, to uncover which misconfigurations are actually being exploited in an IT environment. Another new machine learning-based feature detects anomalies in compute resource provisioning, specifically to prevent cryptojacking by Bitcoin miners.

We need to evolve how we protect these environments ... beyond shipping hardened configurations.

Features such as these indicate that CSPM tools are becoming more critical for enterprise IT organizations, which are demanding that these products expand beyond just checking for misconfigurations, said Doug Cahill, an analyst at Enterprise Strategy Group (ESG), a TechTarget company.

"We need to evolve how we protect these environments ... beyond shipping hardened configurations," Cahill said. "We need to ensure that cloud-native data assets are appropriately protected and that the security operations center has good visibility into those environments as well."

DevSecOps products mature, cybersecurity still bleak

But while cloud-native security tools continue to add cutting-edge capabilities, the overall state of cybersecurity in the U.S. continues to be alarming.

As the country was still reeling from the SolarWinds supply chain attack that affected a wide swath of public and private-sector organizations, a ransomware attack on a major oil and gas pipeline also captured headlines, prompting new federal guidance on ransomware response and pipeline security requirements. And that's to say nothing of the smaller identity theft and other attacks that continue on a daily basis.

In general, enterprise cybersecurity defenses still have yet to gain an edge, or even catch up with, the sophistication of attackers.

Doug Cahill

Part of this disconnect is rooted in the amount of legacy infrastructure that still exists within enterprises that cloud-native security tools don't reach, according to Cahill.

"We just have a lot of old computers and old processes," he said. "And often they contain the critical assets that adversaries are going to target."

The good news is that the highest levels of government and corporate management are beginning to prioritize cybersecurity and app modernization as part of that effort, Cahill said. The COVID-19 pandemic also sped up migration to cloud computing services significantly, which means more corporate IT assets can use modernized security tools, Cahill said.

However, as enterprises are also learning, sophisticated IT security tools are only as effective as the way they're used, and that still leaves open the problems of malicious insiders and social engineering.

"Ultimately, DevOps and DevSecOps are really about culture and skill set," Cahill said. "If we truly see [cybersecurity] as a national emergency, everybody owns being vigilant and responsible for it."

Beth Pariseau, senior news writer at TechTarget, is an award-winning veteran of IT journalism. She can be reached at [email protected] or on Twitter @PariseauTT.