Cloud security defined
Cloud security refers to a set of policies, controls, procedures, and technologies that work together to protect cloud-based systems, data, and infrastructure. This is a shared responsibility between client and the cloud provider.
What is cloud computing?
Understanding cloud computing is the first step to learning how cloud security works. This includes understanding the different cloud service models and deployment models.
Cloud service models define the level of control and management that a cloud customer has over their resources. The three main cloud service models are:
| Service Model | Description | Examples |
|---|---|---|
| Software as a Service (SaaS) | SaaS applications are hosted and managed by the cloud provider, and customers access them over the internet. Customers do not have any control over the underlying infrastructure or platform. | Google Workspace, Microsoft Office 365, Salesforce, Dropbox. |
| Platform as a Service (PaaS) | PaaS provides customers with a platform for developing, deploying, and managing their own applications. Customers have some control over the underlying infrastructure, but they do not have to manage it directly. | Google App Engine, Microsoft Azure App Service, Heroku, Red Hat OpenShift. |
| Infrastructure as a Service (IaaS) | IaaS provides customers with access to computing, storage, and networking resources that they can use to build and manage their own infrastructure. Customers have full control over the underlying infrastructure and platform. | Amazon EC2, Microsoft Azure VMs, Google Compute Engine, DigitalOcean Droplets. |
Cloud deployment models describe where and how cloud environments are hosted and who has access to them. The common deployment models are:
Organizations can choose the cloud deployment type and service model that best meets their needs. Some factors to consider include the size and complexity of the organization's IT environment, the budget, and the specific requirements of the organization's applications.
Free Cloud Security Risk Assessment
Connect with a Wiz expert for a personal walkthrough of the critical risks in each layer of your environment.
Request My Assessment
How Cloud Security Works
Cloud security works by implementing a variety of security controls and configurations across the following four main categories:
Identity and access management (IAM): This pillar ensures that only authenticated and authorized users can access cloud resources. It involves user identity verification, role-based access control, multi-factor authentication, and management of user permissions.
Infrastructure protection: This involves securing the cloud service infrastructure itself. It covers network security (like firewalls, intrusion detection/prevention systems), securing servers and endpoints, and hardening virtual machines or containers.
Data protection: At the heart of cloud security is the protection of data, both at rest and in transit. This includes encryption, tokenization, data masking, and other techniques to safeguard data against unauthorized access and breaches.
Detection controls: This pillar involves implementing security controls that can detect suspicious activity in your cloud environment. Tools that provide real-time insights and alerts are crucial.
Incident response: This pillar covers the process of responding to and recovering from security incidents in your cloud environment. This includes having a plan in place for identifying, containing, eradicating, and recovering from incidents.
Security Leaders Handbook: The Strategic Guide to Cloud Security
Learn the new cloud security operating model and steps towards cloud security maturity. This practical guide helps transform security teams and processes to remove risks and support secure cloud development.
Download Handbook
Why is cloud security important
Cloud security is paramount for organizations leveraging cloud computing in any capacity. While the cloud offers undeniable benefits like scalability and agility, it introduces a unique security landscape compared to traditional on-premises IT infrastructure. Here's why prioritizing cloud security is crucial:
Protection from Evolving Threats: Cloud environments store sensitive data, making them prime targets for cyberattacks. Robust cloud security safeguards this information from unauthorized access by hackers who employ ever-more sophisticated techniques. Measures like encryption, access controls, and intrusion detection systems form the first line of defense.
Business Continuity and Disaster Recovery: Cloud security often involves data backups and disaster recovery plans. This ensures business continuity in the event of outages caused by unforeseen circumstances. This can range from natural disasters to power failures, minimizing downtime and potential financial losses.
Compliance with Regulations: Many industries have strict regulations regarding data privacy and security. Cloud security helps organizations meet these compliance requirements by ensuring data is stored and accessed securely. This is especially important for businesses dealing with sensitive data like financial information or healthcare records.
Reduced Costs: Cloud security can potentially reduce costs in the long run. Cloud providers typically handle the underlying infrastructure security, potentially eliminating the need for significant investments in in-house security hardware and expertise. Additionally, features like automated threat detection and remediation can streamline security processes and reduce manpower requirements.
Shared Responsibility but Enhanced Security: Cloud security is a shared responsibility between the cloud provider and the customer. The provider secures the underlying infrastructure, while the customer is responsible for securing their data, applications, and access controls within the cloud environment. By implementing a comprehensive cloud security strategy, organizations can leverage the shared security model to achieve a more robust security posture than they might manage on their own.
Cloud Security Risks and Threats
Cloud security risks and threats can be broadly categorized into intrinsic and extrinsic. These categories help organizations identify whether the risks arise from the nature of the cloud computing technology itself or from external factors like users and other systems.
Intrinsic cloud security risks and threats are those that are inherent to the cloud computing model itself. They include:
Insecure interfaces and APIs: Cloud providers offer a variety of interfaces and APIs that allow customers to manage their cloud resources. If these interfaces and APIs are not properly secured, they can be exploited by attackers.
Lack of visibility: It can be difficult for cloud customers to have complete visibility into their cloud environment. This can make it difficult to identify and respond to security threats.
Multi-tenancy: Since cloud platforms often serve multiple clients on shared resources, there's a risk that one tenant's activities might negatively affect others.
System Vulnerabilities: Cloud infrastructure components may have vulnerabilities that can be exploited if not regularly patched.
Shared responsibility model confusion: Cloud providers are responsible for the security of the underlying cloud infrastructure, but cloud customers are responsible for the security of their own data and applications. This shared responsibility model can create confusion and lead to gaps in security.
Extrinsic cloud security risks and threats are those that originate outside of the cloud computing environment. They include:
Misconfigurations: Misconfigurations primarily occur due to human error, oversight, or lack of knowledge. This means that the external actions of users or administrators—whether from a lack of understanding, rushed deployments, or simple oversight—result in improper settings.
Phishing attacks: Phishing attacks are a common way for attackers to gain access to cloud accounts and steal sensitive data.
Account Hijacking: If an attacker gains access to a user's cloud service credentials, they can potentially misuse the account.
Malware attacks: Malware attacks can be used to compromise cloud servers and steal data or disrupt operations.
Zero-day attacks: Zero-day attacks exploit vulnerabilities that are unknown to the cloud provider and the customer. These attacks can be very difficult to defend against.
Insider threats: Insider threats can occur when malicious employees or contractors intentionally misuse their access to cloud resources.
Supply chain attacks: Supply chain attacks target the third-party vendors that cloud providers use to provide their services. If a vendor is compromised, attackers could gain access to cloud customer data.
Cloud Threat Report 2023
The Wiz Threat Research team looks back on the past year to highlight trends and the state of multi cloud usage based on visibility across our customer base.
Download PDF
Types of Cloud Security Solutions
As organizations increasingly adopt cloud services, various security solutions have emerged to address the unique challenges of cloud environments. Here's a breakdown of these solutions:
Cloud Security Posture Management (CSPM): Provides insight into the configuration of cloud resources and continuous monitoring of these resources. It assesses cloud resources against rules for proper configuration, identifying any instances of misconfiguration. The system ensures compliance through built-in and customized standards and frameworks, automatically remediating non-compliant resources.
Cloud Workload Protection Platform (CWPP): Ensures visibility into cloud workloads and risk mitigation across VMs, containers, and serverless functions without relying on agents. It conducts scans for vulnerabilities, secrets, malware, and secure configurations within workloads. Additionally, CWPP supports the identification of workload misconfigurations and vulnerabilities during CI/CD pipelines. As the final line of defense, CWPP employs a lightweight agent for real-time threat detection.
Cloud Infrastructure Entitlement Management (CIEM): Oversees entitlements within cloud setups, guiding the implementation of least privilege permissions while optimizing access and entitlements across the environment. The system analyzes effective permissions for principals and resources, detecting potential leaks of secrets or credentials that could compromise access to sensitive assets.
Kubernetes Security Posture Management (KSPM): Automates security and compliance for Kubernetes components, providing comprehensive visibility into containers, hosts, and clusters. The system assesses risks related to vulnerabilities, misconfigurations, permissions, secrets, and networking, correlating these risks to offer contextual insights and prioritization. KSPM also facilitates a shift left approach, identifying and preventing Kubernetes security issues during the development phase.
Data Security Posture Management (DSPM): Safeguards sensitive data within the cloud environment. It identifies sensitive data and provides visibility into its location across buckets, data volumes, OS and non-OS environments, and managed and hosted databases. DSPM correlates sensitive data with underlying cloud context and other risk factors to comprehend data asset configuration, usage, and movement. A fully integrated DSPM can even pinpoint potential paths of attack on sensitive data, allowing proactive issue prioritization to prevent breaches.
Cloud Detection and Response (CDR): Enables the detection, investigation, and response to cloud-based threats by monitoring activity within the cloud environment and identifying suspicious events. CDR identifies threats and suspicious activities in real time, including remote code execution, malware, crypto-mining, lateral movement, privilege escalation, and container escape. The system offers comprehensive visibility, automatically correlating threats across real-time signals, cloud activity, and audit logs to track attacker movements. This enables rapid response and limits the impact of potential incidents.
Introducing CNAPP, a unified cloud security solution
The continuous evolution of cloud environments, combined with the complexity of managing multiple specialized security tools, has driven the industry toward consolidating cloud security solutions. The industry is moving towards a unified cloud security solution, called a CNAPP (Cloud-Native Application Protection Platform), that combines all of the above solutions into a single platform.
2024 Gartner® Market Guide for Cloud-Native Application Protection Platforms (CNAPP)
In this report, Gartner offers insights and recommendations to analyze and evaluate emerging CNAPP offerings.
Download Report
CNAPP integrates both runtime and posture management for cloud-native applications. Instead of treating security measures as separate concerns, CNAPP provides a holistic view that encompasses both preventive measures and active threat detection.
This means that CNAPPs can be used to protect cloud-native applications throughout their entire lifecycle, from development to production. CNAPPs can help organizations to identify and remediate security misconfigurations, detect and respond to threats, and ensure that their cloud-native applications are secure and compliant.
The Ultimate Cloud Security Buyer's Guide
Everything you need to know when evaluating cloud security solutions
Download Guide
Wiz for CNAPP
Wiz's CNAPP solution is a unified security platform that protects cloud-native applications across development and production. Wiz provides a complete view of your cloud security posture, identifies and prioritizes risks, and helps you to remediate them quickly and efficiently.
Here are some of the benefits of using Wiz CNAPP:
Complete visibility: Wiz CNAPP provides a complete view of your cloud security posture, including visibility into your cloud infrastructure, applications, and data. This helps you to identify and understand all of the risks to your cloud environment.
Ruthless risk prioritization: Wiz CNAPP uses a unified risk engine to prioritize risks across all of your cloud resources. This helps you to focus on the most critical risks first, and it makes it easier to allocate your security resources efficiently.
Time to value: Wiz CNAPP is easy to deploy and use, and it provides immediate value. You can start using Wiz CNAPP to protect your cloud-native applications in minutes.
Whether you're just starting your cloud journey, or looking to mature your cloud security program, a unified platform is a must. To see firsthand how a CNAPP could work in your organization, schedule a demo with the Wiz engineering team.
A single platform for everything cloud security
Learn why CISOs at the fastest growing organizations choose Wiz to secure their cloud environments.
