Achieving and maintaining compliance in the cloud proves challenging for many organizations, as it is a complex, ongoing effort that includes safeguarding sensitive data and ensuring infrastructure resources are correctly configured. Success often hinges on the ability to monitor compliance-related trends over time, enabling organizations to spot risk patterns, gauge their current compliance posture, and adapt as new risks emerge. However, gathering this data can be difficult.
In addition to surfacing misconfigurations mapped to PCI DSS, SOC 2, and other popular compliance frameworks, Datadog Cloud Security Management (CSM) also offers out-of-the-box dashboards to measure progress in adhering to these frameworks over time for AWS, Azure, and Google Cloud resources.
In this post, we will explore the Misconfigurations Overview dashboard, breaking down how it can help you understand your compliance posture and identify the most impactful steps you can take to improve it. We’ll cover how to:
- Identify the most important misconfigurations to address
- Understand why your compliance posture has changed over time
- Track where misconfigurations are being introduced or fixed in your environment
Identify the most important misconfigurations to address
Organizations across heavily regulated industries often find they can significantly increase remediation speed when they set a plan to tackle misconfigurations one at a time, rather than trying to address all issues at once. In order to establish an effective remediation plan, it’s essential to have a process with which to easily prioritize misconfigurations.
The Misconfigurations Overview dashboard makes it easy to visualize which misconfigurations in your environment have the highest severity and the widest reach, so you can remediate the issues that will have the biggest impact on your compliance posture. The Overview section of the dashboard outlines:
- The total number of critical and high-severity misconfigurations
- The most common critical and high-severity misconfigurations throughout your environment
- The number of misconfigurations compared to last month
These widgets help teams understand their remediation progress over time, how many more misconfigurations they still need to resolve, and which misconfigurations are the most important to target. You can see these metrics for all issues across your environment or scope the findings to, for example, a specific compliance framework.
In the screenshot below, for example, the dashboard has been scoped to the PCI DSS v4.0 framework.
In this example, the organization has been making steady progress in reducing misconfigurations month over month. To continue that trend, it would likely be best to focus on remediating instances of the “Ingress traffic to remote administration ports should be restricted” misconfiguration, since this is the most widespread issue in the environment.
CSM also includes report pages for each of the major compliance frameworks, which provide a central place to view all mapped misconfigurations and visualize posture score changes over time. You can also see the highest-severity misconfigurations to prioritize reflected in these pages as well.
Understand why your compliance posture has changed over time
CSM calculates a Posture Score for every supported compliance framework so you can track progress toward complete misconfiguration remediation for each set of requirements. The formula uses a weighted ratio that considers the severity of the misconfiguration and the number of pass/fail misconfigurations for each severity.
Understanding the underlying causes of changes in your Posture Score can be critical for gauging progress, identifying areas for improvement, and explaining compliance posture trends to leadership. The Trends section of the Misconfigurations Overview dashboard provides key insights that help you understand the factors driving these trends.
This section includes widgets that show month-over-month changes in which rules and resources, respectively, have the most misconfigurations—these are the types of changes that are likely to impact your Posture Score the most. For example, if CSM scans new resources that are not well-configured, this could lower your Posture Score. On the other hand, if the rules and resources with the most misconfigurations trend downward, as in the example above, this may improve your Posture Score over the month.
If there is a change in a particular rule or resource that you want to investigate further, you can hover on any data point and click “View related misconfigurations.”
This will pivot you to the Misconfigurations page in CSM, where you can gather details on the specific set of misconfigurations associated with the finding you selected.
Track where misconfigurations are being introduced or fixed in your environment
As you work to improve your organization’s security posture, it’s critical to understand where in the environment misconfigurations are being introduced, as well as where they are being fixed. The Misconfigurations Overview dashboard surfaces trends in the prevalence of misconfigured resources broken down by team, environment, and service. These insights help you understand which environments and services present the most risk, and where teams stand in their remediation progress, so you can determine which services and resources to focus on to reduce risk and which teams need the most support.
For example, let’s say you identify a specific service that is the source of a significantly higher number of critical and high-severity vulnerabilities than others. When you click “View related misconfigurations,” you see there is a high number of misconfigured Kubernetes worker nodes associated with that service. Now, you can reach out to the team that owns this service with specific remediation instructions, which are provided directly in CSM.
We recommend tracking resource ownership with team, env, and service tags to get complete visibility into remediation progress. You can also use custom tags to track ownership. To get insight into your tagging health, you can reference the Tagging section of the Misconfigurations Overview dashboard. Check out our documentation to learn more about tagging best practices.
Understand your compliance posture with Datadog CSM
The Misconfigurations Overview dashboard is now available for all Datadog CSM customers. You can check out our CSM documentation for more information about getting started with Datadog Cloud Security Management. If you don’t already have a Datadog account, you can sign up for a 14-day free trial today.
