A major appeal of the cloud is the shared responsibility model, where much of the security responsibility is shouldered by the cloud providers. Fortunately for users, the cloud providers have done a good job. However, that still leaves a large surface for customers to secure. According to Gartner, “through 2025, more than 99% of cloud breaches will have a root cause of preventable misconfigurations or mistakes by end users.” Securing code to cloud is where DevSecOps comes in.
Those preventable misconfigurations and vulnerabilities can be caught and remediated by cloud security tools at runtime. However, relying on runtime security tools alone can lead to an overwhelming number of alerts and tasks for teams to fix.
The faster, more scalable solution is to include security throughout the development process. Securing the code that provisions your cloud infrastructure and applications prevents misconfigurations and vulnerabilities from ever being deployed.
Securing Cloud Code to Secure Cloud Infrastructure and Workloads
Infrastructure as code (IaC) and containers are quickly becoming the dominant way to provision infrastructure and applications. These templates increase developer velocity as they are much easier to iterate on, scale and copy.
However, Unit 42 found that 63% of infrastructure as code templates are insecure and 91% of container images contain high or critical severity vulnerabilities. That means that the scalability of IaC also amplifies the number of misconfigurations in runtime. This leaves the door open for bad actors leading to those cloud breaches Gartner talked about.
We have an opportunity to flip that paradigm on its head. The scalability and automation of IaC, containers and modern development practices like DevOps, can be used to scale out security teams.
Cloud Code Security is a Proactive Approach to Cloud Security
Cloud Code Security embeds security across the entire development life cycle adding policy-as-code and secrets scanning to existing developer tools. At each stage of development–from code, to build, to deploy, to run–code security provides feedback about misconfigurations and vulnerabilities directly to the developer. This feedback is accompanied with actionable guidance and fix suggestions, reducing the friction for developers to fix things.
In this way, security teams can scale out their policies through automation. Instead of manual reviews after development has finished, security teams can determine their policy ruleset and those policies will show up for developers in their workflows. The result is a much higher patch rate and reduced runtime alerts. Without embedded code security, security teams are an island and get overwhelmed by the alerts that only appear after the insecure code is deployed.
Cloud Code Security and CNAPP
The Cloud Native Application Protection Platform (CNAPP) offered by Prisma Cloud reflects the need for full lifecycle security. As of today, Prisma Cloud IaC Security is generally available, combining leading code security with the most comprehensive CNAPP.
With IaC Security, Prisma Cloud embeds security in popular integrated development environments (IDE), version control systems (VCS) and continuous integration/continuous delivery (CI/CD) tools. Developers receive feedback about the policies that security teams have defined throughout their process.
This combined with the unmatched runtime protection of Prisma Cloud creates a full wrapper around cloud infrastructure and applications. For misconfigurations and vulnerabilities that slip through the cracks or infrastructure not provisioned by IaC templates, Prisma Cloud’s CSPM and CWPP offerings identify and remediate those issues. Additionally, for unknown and new threats, Prisma Cloud offers runtime protection and anomaly detection.
Cloud Security Needs Code Security
Without Cloud Code Security, security is creating unnecessary work for themselves. By leveraging automation and policy-as-code, security can, instead, extend their policy controls to every developer. Prisma Cloud now offers Cloud Code Security as a part of its comprehensive CNAPP to protect cloud native applications and infrastructure from code to cloud.
If your current cloud security strategy lacks code security, you’re putting an unnecessary burden on your security team. You can also experience the new Cloud Code Security features along with the rest of our CNAPP functionality with a hands-on trial of Prisma Cloud.
