For the first time in its 30-year history, the 2021 RSA Conference was a virtual-only event, and not in its usual time during the spring. But, with 20,000 registrants joining for the various sessions, it was a testament to this year’s conference theme of resilience.
One continuing trend we saw from the sessions is the marketplace’s sustained demand for the convergence of operational visibility and security. This demand was clear from discussions on the rise of the chief product security officer (CPSO) and DevSecOps. There still doesn’t seem to be a generally accepted definition of DevSecOps, but everybody is talking about it anyway. Whatever term or title you use, it was clear from the sessions that the drive to shift security left into DevOps release cycles is continuing to grow.
The challenges of unifying security and DevOps
Good software development practices, such as modularization (e.g., microservices in many cases), can indirectly benefit security. However, when it comes to promoting collaboration between security and DevOps, the majority of discussion at the RSA Conference sessions revolved around two key points. The first is promoting shared visibility and tooling between the two groups, down to the hands-on-keyboard level. The second is helping each function understand the other. But, in spite of the market demand and industry trend, other sessions indicated that the divide between DevOps and security mindsets still seems as wide as ever.
One gripe that security often has with DevOps is the use of automation and infrastructure-as-code, which can quickly replicate misconfigurations that create attack surfaces at scale. An overarching definition of attack surface management (ASM) that we heard was that it is the continuous discovery, inventory, classification, prioritization, and security monitoring of external digital assets that contain, transmit, or process sensitive data. When it comes to the cloud and thinking of security as operating from within—that is, providing security with unified visibility and internal access across the operating environment—this essentially means Cloud Security Posture Management (CSPM). “Operating from within” is key, as it often implies security working hand-in-hand with DevOps.
Security visibility needs to be at cloud scale
A number of speakers quoted statistics that more than half of cloud breaches are a result of misconfigurations. It would not surprise us if those numbers are accurate. With current offensive security tools, it is possible to scan the entire internet for known exploits in under an hour, making exploitation of a misconfiguration all but a certainty. What does surprise us, however, is how preventable these misconfigurations are. Organizations are not just unlocking their doors but throwing them wide open.
You can’t protect what you don’t know about; up-to-date and comprehensive asset management is a prerequisite for ASM. Beyond that, the next challenge is twofold. One is being able to aggregate findings about your security posture across multiple environments (especially multiple clouds) into meaningful groups. Two is avoiding the alert fatigue that arises from continuous configuration scans, especially when it comes to cloud scale.
Defense in depth is paramount
Another common thread that this year’s RSA Conference’s sessions on ASM brought to the foreground is the focus on defending against the infiltration phase of an attack. Notably, one session discussed the dichotomy between the industry’s emphasis on infiltration versus lateral movement and exfiltration. That is, the security industry tends to prioritize safeguarding against attackers’ initial efforts to gain access to your system rather than what to do once they’re already in. A lot of offensive technology and innovation is focused on scanners, phishing support, and the like. There is far less “off-the-shelf” security tooling for detecting the execution of movement across networks or privilege escalation beyond standard operating system utilities. And the sophistication of what is available can be minimal; you can get commercial support on Metasploit, but for a rootkit your support option is GitHub.
Tooling is created to meet demand, and it would appear that offensive actors tend not to need this post-infiltration tooling as frequently. Perhaps this is a reflection of the slow pace and difficulty teams have in adopting a Zero-Trust security policy throughout their environments. Regardless, it is beneficial for defenders to leverage detection controls within the perimeter of their environments, where attackers may not have as many capabilities for evading detection or obfuscation. The concept of defense in depth—implementing security at multiple layers of your environment—remains relevant.
Ultimately, each topic we touched on—breaking down divisions between DevOps and security, reducing attack surfaces, and maintaining defense in depth—all tie back to this year’s theme for the conference, resilience. A company that does not silo security and technology innovation has increased resilience and is able to proactively mitigate risks and respond to the unknown. Likewise, ASM is a preventative measure while defense in depth mitigates post-infiltration risk exposure. Both of these enhance an organization’s resilience.
Unified, full-stack cloud security with Datadog
One way to support resilience is through the Datadog Cloud Security Platform, which provides full-stack security for virtualized production environments and promotes collaboration between DevOps and security teams toward shared goals. The platform includes Datadog Cloud Security Posture Management (CSPM), which supports ASM for the cloud but from an internal perspective through continuous configuration audits across cloud accounts, hosts, and containers. Out-of-the-box executive reporting provides summaries that minimize alert fatigue while at the same time delivering posture snapshots, not just for right now but also points in the past.
Datadog’s Cloud Security Platform also provides Datadog Cloud Workload Security (CWS), which gives you real-time eBPF-powered threat detection across your hosts and containers to identify suspicious activity that may be indicative of post-infiltration motions. Along with Datadog Cloud SIEM, which provides real-time threat detection across operational and security logs, the Datadog Cloud Security Platform provides unified visibility across your environment to counter the latest trends we’ve seen at the RSA Conference.
