Work Smarter Not Harder: Tips to Approach Cloud Security the Easier Way

### Overview Presented at RSA Conference 2021 by Trend Micro researcher Erin Sindelar, this talk explores strategies for approaching cloud security more effectively by addressing both organizational culture and technology. Rather than traditional security threats like zero-days or ransomware, the primary cause of cloud breaches is simple misconfigurations. Sindelar argues that security teams can overcome friction with developers by reframing security controls from restrictive roadblocks into operational enablers that accelerate cloud innovation and ensure systems work as intended and only as intended.

### Key Topics - **The People Problem and the Four-Box Model**: Historically, developers and security have had seemingly contrasting goals. As DevOps and dedicated CloudOps teams emerged, security was often pushed around rather than truly integrated. Developers focus on making things work fast, while security focuses on making sure they work only as intended. - **Misconfigurations as the Primary Cloud Threat**: Trend Micro research indicates that 65% to 70% of cloud security issues originate from misconfigurations. Filtering public records shows that over 2 billion sensitive records have been leaked due to single misconfigurations. A notable exception was the 2019 Capital One breach, which resulted from two misconfigurations and an inconsequential bug, exposing 100 million user records. - **Cloud Service Provider (CSP) Reliability**: Addressing the misconception that CSPs represent major security risks, Sindelar notes only two breaches occurred across the top four CSPs in five years. However, high platform velocity (over 5,000 features released in 2020 by the big four, equaling at least two updates daily per cloud) makes manual oversight impossible. - **Shared Responsibility Model**: Under the cloud shared responsibility model, configurations are always the customer's operational responsibility across IaaS, PaaS, and managed services.

### Technical Details & Security Controls To bridge the gap with developers, security professionals should ask two core builder questions: "What else can this do?" and "Are you sure?" - **Cloud Security Posture Management (CSPM)**: The cornerstone tool for continuous auditing. Trend Micro's CSPM identifies over 840 million misconfigurations per day. For builders, CSPM automates checks across hundreds of daily deployments, assists with cost optimization, and streamlines audit compliance. - **Network & Application Controls**: Network controls prevent unwanted traffic from impacting code execution. Automated security testing integrated into CI/CD pipelines eliminates late rollbacks or post-release hotfixes. - **Containers & Open Source Security**: Container admission controls and image scanning prevent vulnerable images from deploying (referencing Snyk's State of Open-Source Security report highlighting vulnerabilities in official base images). Open source dependency scanning catches third-party security vulnerabilities and licensing compliance issues early.

### Takeaways 1. **Shift Messaging from Prevention to Enablement**: Security teams must stop focusing solely on what security stops and explain what it enables for developers. 2. **Inventory Cloud Footprint and Controls**: Map all active cloud services and consult CSPs and cloud-native security partners to identify non-disruptive controls. 3. **Automate and Maintain Continuous Visibility**: Deploy CSPM and CI/CD security controls continuously to handle the rapid release cadence of cloud platforms.