Why Managing Security Posture and Entitlements from One Place Makes Sense

Security decision leaders are prioritizing cloud security posture management (CSPM) tools for their organizations, and with just cause: the ability to monitor cloud configurations is essential for complying with regulations and reducing risk from cloud data breaches.

However, CSPM answers only some of the modern security challenges that cloud infrastructure has introduced. Cloud Infrastructure Entitlements Management (CIEM) complements CSPM by securing identity entitlements -- another Achilles heel of cloud infrastructure due to their potential to grant unfettered access to sensitive data upon a breach. Therefore, a unified CSPM and CIEM platform can, in one sweep, provide solutions to highly prioritized security risks, with minimal overhead. Let’s see how.

What is CSPM?

So what is CPSM? (Cloud Security Posture Management) is a set of technologies that automatically monitor risk in public cloud service configurations and security settings. By reviewing and assessing the environment settings and configurations, CSPM can map the discovered risks to security standards and policies, such as CIS, GDPR, SOC2, PCI DSS, ISO and HIPAA. This capability makes CSPM solutions useful for compliance and regulation management, especially in multi-cloud environments. Some CSPM tools can remediate detected risks.

CSPM Advantages for Organizations Growing Their Cloud Infrastructure

CSPM is a valuable solution for helping organizations secure their cloud infrastructure because it:

• Provides visibility into cloud workloads and services
• Continuously monitors and identifies cloud misconfigurations that could lead to data breaches
• Alerts when changes to the cloud infrastructure result in policy violations, misconfigurations and risks
• Can enforce policies to adhere to industry regulations and best practices

As a result, many organizations are prioritizing CSPM among their cloud security programs. In fact, a recent IDC survey commissioned by Ermetic found that 84% of organizations are using or plan to implement a CSPM tool.

CSPM Challenges

While CSPM gives important visibility into configurations, it does not answer all modern cloud infrastructure security requirements. Technological shifts to globally connected cloud environments and microservices architectures have made identity the new perimeter.

The shift has turned managing human and service cloud identities, and their access capabilities, into one of the greatest modern security risks. The huge number of identities and the complexity of connections and relationships, much of it hidden from even a security expert’s eye, have made managing and mitigating access risk extremely difficult. For multi-cloud infrastructure, this challenge is of even greater magnitude since each cloud provider handles permissions differently. As a result, Gartner and Forrester recognize service entitlements and identity management as the Achilles heel of cloud infrastructure, and prioritize securing them.

Introducing: CIEM

CIEM is a set of technologies for managing the entitlements of human and service identities in the cloud infrastructure. CIEM tools utilize advanced analytics to mitigate risks in modern, complex cloud infrastructure environments, which have tens of thousands of human and service identities, and thousands of policies and configuration settings.

CIEM Advantages for Organizations Growing Their Cloud Infrastructure

CIEM complements CSPM by:

• Providing deep visibility into all multi-cloud assets - identities, resources and entitlements
• Detecting and prioritizing excessive entitlements, including toxic combinations
• Mitigating risks with least privilege remediation, integrated in workflows
• Detecting anomalies and threats using continuous, advanced risk analysis
• Governing privileged access across the identity lifecycle

CIEM or CSPM?

CIEM and CSPM are two complementary cloud security categories. While CSPM manages compliance and identifies misconfigurations, CIEM manages cloud asset inventory and identifies entitlement risks that can result in significant security breaches, like that of Capital One. Discover what CIEM is.

One Unified Solution for CSPM and CIEM

Security leaders who choose a single solution for CSPM and CIEM are able to address highly-prioritized security challenges in one, simplified platform.

• A unified CSPM-CIEM solution provides cloud identity entitlements management and cloud security posture and compliance monitoring in one platform
• Sophisticated risk analysis with intuitive visualization, prioritization and automated remediation across configurations, permissions and behavior

Securing the Cloud Infrastructure

A unified approach to answering security needs, both for entitlement management and for complying with regulations, can help resolve security needs, enhance visibility and collaboration across Security, Dev and Dev/Ops, and reduce overhead. Focusing solely on configuration monitoring and management can leave organizations vulnerable to attack and lateral movement due to excessive permissions being misused.

Next-generation cloud security solutions need to offer comprehensive CIEM and CSPM, with full stack lifecycle management of identities, entitlements and configurations. Such a platform is essential for effectively assessing and mitigating identity and compliance risk in the cloud infrastructure, including multi-cloud.

*Data points are from the IDC State of Cloud Security 2021 study (commissioned by Ermetic)