Why Third-Party Security Adoption Must Get Better
Prisma Cloud from Palo Alto Networks sponsored this podcast.
Major exploits such as the Target and Equifax hacks made headlines a few years ago. But these infamous attacks have not necessarily served as a wake up call for many, if not most, organizations. They lack the security tools, processes and culture required to properly protect their data, Chenxi Wang, Ph.D., managing general partner of Rain Capital, said.
“Everybody read about those headlines, but translating that into the work [organizations] do today, I think there’s still a gap,” Wang said. “As security industry professionals — myself included — we need to reach out more to the adjacent community and especially with dev these days. I mean software is eating the world and dev is the one driving software, so we need to work with dev to make it happen.”
In this edition of The New Stack Makers podcast hosted by Alex Williams, founder and publisher of The New Stack, Wang spoke about these and other third-party security trends. The podcast was recorded in anticipation of The State of Cloud Native Security virtual summit to take place on June 24.
Chenxi Wang, Ph.D. Why Third-Party Security Adoption Has to Get Better
Like the Target and Equifax breaches, government-sponsored attacks also make headlines. According the U.S Justice Department, for example, a North Korean team of hackers allegedly orchestrated the WannaCry exploit for ransomware.
Regardless of their origins, security policies, and the resulting tools adopted, must all take into account that the vast majority of attacks are financially motivated. “By and large hacking follows a trail of money,” Wang said. “They want to hit places and systems where there is the most valuable data.”
Data stored on the cloud is often seen as a potential goldmine among those seeking vulnerabilities for access to sensitive and often compromising data to broker or exploit as organizations increasingly make the shift to the cloud. At the same time, DevOps and DevSecOps teams often lack the toolsets they need to lock down what is, for many organizations, a new universe. Difficulties in monitoring cloud logs is one example of challenges they face when trying to manage security on cloud services.
“I can’t tell you how many security professionals have been telling me they’re drowning in those cloud logs and they need something to help them to aggregate and make sense of and to analyze and visualize them,” Wang said. “I think that’s one gap that the cloud service providers are not providing today.”
The tools DevOps and DevSecOps teams require must also be able to encompass DevOps’ increased reliance and adoption of open source tools — and that can pose challenges.
“Open source tools are easy to manipulate and a lot of developers like them, but for enterprise security to do enterprise security tasks, they often don’t provide the right way to analyze data or to integrate with other tools easily so you have to build that,” Wang said. “So, there is a place I think in Infosec for someone to step in and say, ‘okay, I’m going to come manage your open source tools that have security implications and give you that enterprise layer of control on top of those tools.’”
Ultimately, security must also address protecting its victims. In that respect, security policies must have an “altruistic aspect,” Wang said. “We are protecting consumers’ financial data, and on the other end of the wires consumers are 80-year-old guys who have bank accounts,” Wang said. “I like that aspect of being able to provide protection. to individual consumers and users.”
Join Prisma Cloud by Palo Alto Networks June 24 at 9:00 AM PDT at The State of Cloud Native Security virtual summit for a full discussion of the “The State of Cloud Native Security” report and other topics relevant to your organization’s digital journey. The summit will feature a panel session hosted by The New Stack’s Founder and Editor-in-Chief Alex Williams, with security thought leaders from Accenture and Prisma Cloud by Palo Alto Networks.
Feature Image by Juan Diego Guzmán Hijuelos from Pixabay.
