Matthew Chiodi, the Chief Trust Officer at Cerby, joined us on Episode 37 of The Cyber Security Matters Podcast to share his insights into the industry. One of the topics that stood out to us was the best practices that he shared from Cerby’s work on securing cloud-native applications. Here are the highlights of his answers:
“When people say cloud-native application, that refers to applications that are built cloud-first. If you have a VM that’s running on-prem and you move it to run in the cloud, that’s not cloud-native – that’s just cloud transferring. Quite frankly, it’s a waste of time and money to do that. Cloud-native means that your infrastructure was not built manually, but it was built using infrastructure as code templates, defining what your infrastructure would look like in code first. Then you’re using code to bring up things like lambda functions that only work during a certain period of execution. That doesn’t use a typical VM, it’s usually a microservices-based architecture.
When it comes to cyber security, the basics still apply. Organisations have a massive data sprawl issue in the cloud because it’s so easy to upload to. If you go back 5+ years ago, if you needed a new data store, you had to open a ticket with your IT department and wait 2-3 weeks or even months, depending on the size of the organisation, before you got access to it. Data also tended to be much more centralised, and there were checks and balances. For a lot of cloud environments, that’s not a problem anymore. Developers generally have a fairly high level of access to create new services and they can create new data stores on demand by calling APIs, so you tend to get data in all different places.
You have to know where your data is and what it is because if you don’t, sensitive data, like personally identifiable information, can easily end up in the wrong place. Health information that was intended to only be in a production environment can very easily be moved to lower environments that don’t have the same level of governance. I’d advise having a good tool that can tell you what you have and who has access to it.
Knowing your code – specifically your application security code – is still highly important because you might know where your data is, and who has access to it, but if you’re writing crappy code, you’re introducing a vulnerability to your digital environment. So, you have to know who has access to your data and your code. If I get access to your data, I can do what I want with it. Or, if I get access to your code, I can inject things into your code that will then give me access to your data.
In terms of what Cerby does; I usually say that in all organisations, you have two different types of applications. A lot of times we think of cloud apps versus on-prem apps, and that’s true, but really it comes down to identity and access management. You have standard apps that you can very easily integrate with your identity provider, and your IT team can manage them centrally in terms of who should have access through that type of identity provider. The other category is what we call non-standard applications or disconnected applications. This is a massive problem space because the apps that fall into the nonstandard category can’t be managed with your central identity systems. Cerby is focused on that non-standard space.
We connect those non-standard applications back into identity platforms on trial ID. We did a little bit of research last year, and what we really wanted to understand was the scope and scale of the problem, and we found that organisations have a median of about 175 of these non-standard apps. We’ve spoken to some large healthcare companies who have 1000s of these, and we know there are hard costs associated with these applications because if you as an IT admin in one of these organisations have an employee who needs access to one of these non-standard apps, they can’t go through any kind of automated process – they can’t go into your access request system, they’re going to put a ticket in. Once you get to it, you have to manually log into this app, figure out what access they need, etc. and it’s all a lot of hassle. We make it so that you can centrally manage these non-standard disconnected apps, using your existing native tools.
To find out more about securing cloud-based applications, tune into Episode 37 of The Cyber Security Matters Podcast here.
We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.
