By Amit Shaked, CEO, Laminar
Data security is a C-suite imperative for 2022 and beyond. As organizational IT and security teams enabled hybrid work models, digitized processes and transformed business models, products and services, their security posture changed dynamically and often for the worse. Organized crime rings, nation states, and other cyberattackers have taken advantage of the chaos, capitalizing on weaker organizational controls and targeting end-users with an array of tactics. By mid-2021, 51 percent of all organizations had reported a successful data breach, and 61 percent had paid a ransomware attacker to restore frozen data and systems.
Seven Cloud Security Predictions CISOs Can Use in 2022
Now, it’s time to right the ship. Since hybrid work models and digital business models are here to stay, IT and security teams will need to rethink how they can better protect data to prevent data breaches in the future. There’s a logical place to start: the public cloud.
In 2021, 73 percent of cyberattacks involved external cloud assets, up from only 27 percent the prior year. While companies are cloud-enabling business processes at scale, data protection teams lack visibility into how they are storing and securing data across cloud services. In addition, many companies use multiple providers, which can easily result in inconsistent security processes being applied across cloud infrastructure, storage, software as a service applications, and other assets. Finally, cloud security is a shared responsibility: Providers ensure security for cloud services, while customers must secure data. All of these issues point to a need for organizations to improve their visibility into their sensitive cloud data and use tools to protect it, both at rest and in transit.
To address this growing business need, we offer seven cybersecurity predictions for 2022. Our goal is to help chief information security officers (CISOs) and their teams place the right bets on cloud data security. By evolving programs, processes, and technologies at pace, CISOs can protect their most valuable asset – their data – against every attacker and threat pattern. These seven predictions are:
-
Organizations will increase investments in cloud security: With successful cyberattacks abounding, it’s not surprising that 78 percent of IT and security leaders have serious concerns about their organization’s security posture. Some 96 percent increased cybersecurity spending in 2020, and 91 percent in 2021. In 2022, cloud security will capture $12.73 billion of that spending. Since cloud security is notching double-digit year-over-year gains and threats are getting worse, spending could easily outpace this estimate.
-
Cloud data protection will match pace with data democratization: Organizations want to democratize data, which means making it freely available to authorized users without IT intervention. That’s a huge trend in business, as users in marketing, HR, finance, and other business functions want to create their own analytics and innovate faster.
While manipulating cloud data is exponentially easier than integrating on-premises sources, security teams have fallen behind the pace of change. For security teams to move at the speed of cloud they will have to invest in new approaches that not only equip users but manage and protect data at massive scale: Data volumes are slated to reach 175 zettabytes in 2025, up from just 33 zettabytes in 2018.
To close the cloud data security gap, new data protection solutions will be cloud-native and integrate with the public cloud itself in a modern, agentless way. The new market definition for this is Cloud Native Application Protection Platform or CNAPP. These platforms must be able to identify where and which types of data reside in the cloud, so that organizations can focus on what matters most. Finally, the solution must not impact day-to-day operations.
-
Cloud-native security tools will become mainstream: Cloud security tools provide a wide array of capabilities, including secure access, identity and access management, data loss prevention, workflow protection, application security, security automation, intrusion detection and prevention, security information and event management, encryption and more. As companies move more workloads to the cloud, they will want to avail themselves of many or all of these capabilities. These tools enable remote teams to manage their growing public cloud footprint: easily configuring services, automating processes, and using artificial intelligence and machine learning to identify and proactively address threats of all kinds.
Gaining control over data is obviously one of security teams’ highest priorities. A cloud data protection solution should constantly scan managed and unmanaged storage and compute, looking for signs of data leakage. In addition, it should discover and classify all sensitive data, improving teams’ visibility into – and control over – cloud data. Next, it must enforce policies across the multi-cloud environment, issuing alerts when policies are violated. Finally, the platform should monitor all data channels, enable approved data flows, and detect leaks across all cloud infrastructure. If that sounds challenging, that’s correct. Very few solutions in the market can do that today.
-
Security teams will evolve from gatekeepers to enablers: Recent events have forced CISOs and security teams to transform the way they work. They can no longer simply say no to activities that challenge the firm’s security posture. Instead, they must collaborate with the business to safely enable innovation. That means partnering with the C-suite to speed up digital transformation, partnering with the business to create data cultures and environments for driving innovation, and working with DevOps teams to ensure products are secure by design. Teams can accomplish this goal by implementing zero-trust architectures and providing risk data to the business for decision making.
-
Insiders are the new outsiders: Remote work, lax security controls, and fast-changing business practices have all added up to an environment where insider threats are growing. Whether accidentally or intentionally, insiders cause many data breaches. Up to 85 percent of data breaches now have a human element. That means organizations need to understand the who, what, where, when, how, and why of anyone accessing cloud data at all times.
-
Best-of-breed tools will continue to emerge, rather than consolidate: Organizations are leaving nothing to chance, adopting 45 security tools on average to harden their defenses. All of this creates great business opportunities for security providers, who are continuing to develop and expand solutions. However, it is increasing complexity for security teams. Those enterprises that use more than 50 tools say they are eight percent less able to detect threats and seven percent lower in defensive capabilities than those who adopted fewer tools. Thus, solution providers who can provide greater transparency, simple management tools, and prioritized alerting stand to take share from purveyors of harder-to-use tools.
-
Analysts will invent at least three new acronyms for cloud security platforms: The security industry is awash with acronyms, from EDR to IAS, IDS/IDP, and SIEM. This compendium blog lists 70, but the answer is surely higher now. We predict that analysts will develop at least three new acronyms for must-have cloud security platforms this year. So, what will they be?
Conclusion
As the new year beckons, security teams can rethink processes to better protect data – and the public cloud is the place to start.
In 2022, it will become essential that organizations use a cloud data protection solution that provides visibility, context, accountability, and alert data to halt adversaries in their tracks. The solution should be able to discover and classify data for complete visibility, secure and control this data to improve the firm’s risk posture, and detect and remediate leaks without interrupting data flow. These simple approaches can go a long way in preventing devastating breaches in 2022 and beyond.
