Next in Tech | Ep. 188: Cloud Native Application Security

View Full Transcript

Eric Hanselman   00:00:00

Welcome to Next in Tech, an S&P Global Market Intelligence podcast with a world of emerging tech lives. I'm your host, Eric Hanselman, Chief Analyst for Data and Insights at S&P Global Market Intelligence. And today, we're going to be talking about cloud-native application security, the interesting aspects of it. And with me to discuss it is part of our security analyst team of Mark Ehr, Mark, welcome to the podcast.

Mark Ehr   00:00:23

Thanks, Eric. Glad to be here.

Eric Hanselman   00:00:25

It's great to have you. We've talked about a lot of different pieces of what is that broader security puzzle. And this is an area that it's been out there for quite a while, but especially when we think about how approaches to security in the cloud-native sphere have operated. -- it really is something that continues to be fast evolving. There's a lot that's taking place. And I think in terms of perception, your average enterprise probably doesn't have a real serious depth in terms of an understanding of it. So before we get too far down the road, maybe can you give our listeners a little bit of background in terms of where did this come from? What is it? How is it defined?

Mark Ehr   00:01:09

Yes, absolutely. So as you already mentioned, CNAP stands for a cloud-native application protection platform. And it was coined just a few years ago in 2021. And since that point, it's literally exploded as a market. But I thought before I got started, I would throw a couple of stats out there just to kind of talk about the overall cloud security market scenario right now, and then I'll jump a little bit into what CNAP is. The first thing that I found really interesting when I first started covering CNAPP was I started to delve into our 451 research data. And a couple of things I found that stuck out right off the bat. The first one is that -- so we run these Voice of the Enterprise surveys, right, every year. And one of them is called Voice of the Enterprise Information Security budgets and Outlook 2024. And in that, we asked the respondents what their top pain point was. And the #1 was cloud security. Then on top of that, in a completely different security, this is a cloud security survey, we asked them what their #1 tool in the SOC was today. And #1 was cloud threat detection. So I see a little bit of a theme going here.

Eric Hanselman   00:02:18

Everything cloud.

Mark Ehr   00:02:19

Yes, exactly. And then I dug a little bit into -- because I came -- like a lot of us came from the on-premises world, right? And so they dug a little bit into -- because I was really interested in learning just how prevalent cloud is. And the reality is everybody's got cloud today, virtually everybody or it seems like it. But at the same time, I found and you had another survey that 87% of the respondents still have on-premises workloads, either running in classic data centers and that kind of stuff. So...

Eric Hanselman   00:02:49

Yes, it's not as though everybody has abandoned their existing infrastructure. It's just now they've got both and lots more to deal with.

Mark Ehr   00:02:57

Yes. And then the one last little mini data point around that is not only do a lot of organizations have cloud -- they have multiple clouds. They have 2 or 3, sometimes even 4 different cloud hyperscalers, service providers, whatever you want to call them. So you've got that whole situation where you've got this on-premises sort of legacy state. And then you've got cloud, which is completely different, right, because it was all built kind of from scratch and a lot of folks have completely different vendors that they have to support on the cloud side.

Eric Hanselman   00:03:27

Well, and to your point, cloud actually has some fundamentally different constructs than what most organizations or the way in which most organizations have been running their on-prem environments.

Mark Ehr   00:03:40

Yes, absolutely. And that actually folds right into another one of the big pain points, which I didn't mention, which was the cloud skill shortage, right? So the organizations are having increasingly hard time finding people that know cloud and especially when you have multiple clouds because you take an individual and if they're an expert in just one, say, AWS, they're almost guaranteed not to be an expert in the others, right? So now you're looking at multiple people or service providers. But anyway, so backing up a little bit and then let's dive into CNAPP is what it is, right? So the idea there is that, hence, the name cloud-native application protection is that you're obviously protecting cloud applications. And as I mentioned, it was coined just about 4 years ago, and it's really just an amalgam of several key cloud application security technologies that were conveniently bundled into an acronym. And that's kind of evolved into a platform play for a lot of vendors, but not necessarily the way it's being purchased. So I'll more about that in a little bit. But it's very similar to like extended detection and response, SASE, SSE, all these sort of convenient acronyms. And I like to call it acronyms in search of a solution or solutions in search of an acronym. And I'm not sure what the answer is there.

Eric Hanselman   00:05:00

But we got plenty of both.

Mark Ehr   00:05:03

Exactly. Yes. So yes, so the idea there is, so it's a platform. And really, if you think about it at a very high level, the key concept kind of underscoring a lot of this is the concept of shifting left, taking security, moving it as far left into the development process as you can. But at the same time, so you've got sort of that world that you need to worry about. But then you've also got kind of the post deployment and production world that you need to worry about. And so what they're trying to solve with CNAP are both sides of that equation. So I kind of look at it as split into maybe 2 or 3 different chunks. One of the chunks is called posture management. And the most common acronym there, yes, we've got a lot of acronyms coming so fasten your seat belts folks. So one of the acronyms...

Eric Hanselman   00:05:49

The acronym is height and heavy.

Mark Ehr   00:05:51

Yes, exactly. is CSPM, which is cloud security posture management. It's pretty obvious. But there's about 4 or 5 different SPMs under CNAPP. But the idea is posture is risk. So what we're trying to do is understand what our risk posture is of -- from these applications that we're running. And within that, there's things like containers, which is the applications that are running. There's the data that they're accessing, the identities that they're using and so on, right? So there's all these different SPMs underneath that. But at the end of the day, what you're doing really is you're scanning these applications and you're looking for vulnerabilities, the usual stuff. Same stuff we used to do on an on-premise side and still do, scan for vulnerabilities, look for configuration errors, looking for ongoing threats, doing behavioral analysis, all that sort of thing. right? So that's posture management. And then the second half is workload monitoring. So actually monitoring those systems as they're running. And so -- and a lot of these, you can do both sides, right? So like posture management, for example, you can scan for vulnerabilities while you're developing code, which is a great thing to do. But you also want to scan for them after -- or scan for vulnerabilities after they go into production, right? Because you've always got emerging threats and emerging vulnerabilities you need to know about. And so under workload monitoring, the acronym there is CWPP or cloud workload protection platforms. And again, that's just kind of what I mentioned. So it's the scanning of the running code, looking for reities compliance. So a lot of those same things, but on the production side. And then last but not least, there's the supporting technology that sit underneath that. One of the key ones that you hear, which is increasingly being bundled into CNAP is cloud infrastructure entitlement management or CIM, as some people describe it. And that's just controlling who has access to what, monitoring it, making sure that you don't have things like entitlements being overprovisioned and all that kind of thing.

Eric Hanselman   00:07:47

Who can spin up a workload who has the ability to actually create stuff and what can they create and in what conditions can they create it?

Mark Ehr   00:07:57

Yes, exactly. Yes. And then surrounding this whole thing is CDR, cloud detection and response, which kind of ties this all together more on an operational side. So let's look for problems when we have problems, how do we detect them, how do we triage them and then how do we respond to...

Eric Hanselman   00:08:13

Well, I wanted to take a step back. You mentioned this -- the move to shift security further and earlier in the development process. shift left, which was not -- that was something we're working on within the DevOps movement and that was -- started out independent of cloud. And yet now that we've made our way into cloud, it's become all that much more important because, again, there are some differences between what we were doing in the on-prem environments and what's in cloud. And I think a lot of organizations now are struggling with how do you actually make sense of how you blend all this together because you were talking about endpoint detection response, the EDR kinds of things, managing the device infrastructure, XDR that's starting to bring some network perspective into that. And now it seems like we've got cloud as one more thing how do organizations get their hands around integrating cloud into their broader security operations? And I guess the challenge, of course, is how do you keep this from being one more siloed chunk of infrastructure from a security perspective. That seems like that's one of the biggest issues that organizations tend to face and doing that in light of a situation in which they may not have the expertise to be able to fully staff it up.

Mark Ehr   00:09:36

Yes. Okay. Well, let me unpack all that. So...

Eric Hanselman   00:09:41

It was only 7 different questions, Mark.

Mark Ehr   00:09:45

So Shift left, my perspective on cloud application development is very positive because not only are the tools all modernized, right, they're all cloud-based. And there are a lot of really great platforms now, which on the on-premises side, in the past, there were like hundreds of different tools. And now there's -- I'm not to say that there aren't a lot of tools in the cloud, but there are a lot of very popular ones like Get, for example, right? And so these platforms have helped to simplify the development side to some extent and then coupled with APIs, right, which allow a lot of these applications, the monitoring and scanning applications to actually go all the way down to the repo level and look at the code and point the developer to what needs to be fixed. So that's a big plus. Now moving back around to your other question, though, is sort of the consolidation or what the strategies are between on-premises and cloud. That's a tough nut, right, because they are fundamentally very different systems. If you look at it, historically, on the on-premises side, you would have a SIEM, maybe a loghym or a QRadar or whatnot. And that sort of evolved into XDR to an extent or so XDR incorporated a lot more of the EDR, endpoint detection and response, network detection and response along with the orchestration and remediation components. But then cloud kind of evolved completely differently, right? So you don't -- there isn't really that I know of an XDR for cloud per se, but a lot of those same things exist. So that's part of what cloud detection and response is, IT detection and response or identity threat detection and response, all that. So I think what people are doing, what organizations are doing is they're either looking to run them separately, which is, I'm sure, happening a lot, or they're looking to standardize on something. And a key bellwether of that move, I think, was if you looked at the recent sale of QRadar SaaS assets to Palo Alto. So IBM has taken the SaaS assets and kind of sold them, divested them, whatever you want to call it, to Palo Alto, letting them take that SaaS business/cloud business. But they are continuing to maintain their on-premises code base because that's still a significant business for them. And so I think that really shows that there is a shift in some of those on-premises cloud platforms. Some of them are making the shift into cloud, some of them are not. But I think the general trend is that organizations are increasingly looking to cloud platforms as sort of the single source of truth -- alongside that, you've got security data lakes coming along security data fabric. So the idea is it's getting all that data in one place, both on-premise as well as cloud data. And now all of a sudden, you've got other vendors coming along with cloud-based SIEMs and detection and response systems, which then can operate on that kind of singular source of truth.

Eric Hanselman   00:12:41

Well, because fundamentally, we face 2 different real different principles of operating. What we owned on-prem, you could get your hands around it. You had full control of the infrastructure. You could instrument the network, you could stick agents on stuff. You had lots of control in terms of what you actually did. Now you had a lot of variability because different servers work different ways, different network equipment worked different ways. So you had all these different things that you potentially were juggling just from the componentry of the infrastructure. you shift to cloud, all of a sudden, you don't have your hands on that infrastructure. Somebody else is running an infrastructure for you. And now the good news is that, as you pointed out, you got APIs in that environment. You got a lot of telemetry that the cloud throws off. You got -- and typically, your average cloud is throwing off a lot more telemetry than your on-prem environment was, but it's throwing it off in different forms. And that's when I put my network security hat on. You look at all -- everything that you're getting in cloud is flow records, whereas when you're on-prem, you actually had real capture of the network data. And so you've got to triangulate the difference between those 2. And I thought the important point in all this is what you were identifying is that there has been this shift towards accumulating data in cloud environments just simply because the cost of maintaining lots of data in cloud has been relatively inexpensive or at least maybe less expensive. It seems like we're now to this point where this transition is starting to get to a point at which we've moved from what had been sort of the on-prem leading to the cloud end of things leading as this transition takes place. Is that a fair statement?

Mark Ehr   00:14:33

Yes, I think so. The general trend, of course, I think a lot of organizations are looking to their end state is they would like to be cloud native. They like to be cloud first. Now obviously, there are some environments that will never be cloud-like if you have a mainframe, for example. But I think the trend is, to your point, on the cloud, a lot of the advantages are those APIs. It's a lot more standardized there's a lot less because on-premise, it was sort of the Wild West for decades, right? People were getting their own data centers and their own hardware, their own software, their own management, all of that. Whereas with cloud, there's many, many fewer choices. And there's a lot more standardization going on, to your point.

Eric Hanselman   00:15:12

Well, I mean, because it's the cloud providers that are driving the bus on this?

Mark Ehr   00:15:16

Yes, you don't have a choice, right?

Eric Hanselman   00:15:18

You get what your cloud provider gives you. And for most of them, that's a wonderful panoply of options, but they get to decide what you get and what you don't.

Mark Ehr   00:15:30

Yes. Yes. One thing I do find interesting, and this is a bit of a battle between some of the vendors is the agent versus agentless battle, right? And that happened on-premise as well for a while. But back then, it was a little less -- you could do a lot more with an agent because there weren't all -- it wasn't the standardization of all the APIs that you have on the cloud side. But point here is that the cloud providers have done a very good job, in my opinion, of creating some very robust APIs to the point where many of these vendors start out as agentless because they can gen up their solution very quickly. You can get it installed, you can start delivering value literally within hours. Now it's not going to be -- the metrics and telemetry aren't going to be as deep. But in certain cases, then they started to evolve to the point where they can then build their own agents and get those out like especially like for container monitoring, some really deep kind of stuff where you need either real-time data or very deep data, then they can also do agents. And so you're starting to see that same kind of thing happening on the cloud side. But fundamentally, a lot of these applications, the security platforms were able to start as being API-based, and that was a huge plus.

Eric Hanselman   00:16:42

B because to your point, all you have to do is bolt up to the API and now you got data. Although..

Mark Ehr   00:16:48

I will make the point that there were a handful of folks that went out agent-based first.

Eric Hanselman   00:16:52

And now both sides of that pendulum swing have taken place.

Mark Ehr   00:16:56

Yes. Well, and they're both going the other direction. So the agentless -- like perfect example is Wiz, right? Wiz started out as agentless, and it was -- they're trumpeting the advantages of agentless, which were absolutely founded, well founded.

Eric Hanselman   00:17:10

Quick results, yes, minimal impact, get it deployed, get answers right away.

Mark Ehr   00:17:15

Yes, exactly. But now they're saying, well, yes, but we also support agents because we understand there are certain use cases where you just need one, right? And then -- do on the other side, you've got the LaceWorks of the world that started out agent-based and now they're also supporting agentless, which also makes sense. But one other point I wanted to mention, so you've sort of got the monitoring APIs, right? And those are all great, and you've got the agents here and there. But underneath all of this is the data. And the other key thing, I think, that's happened is standardization and normalization of security data, again, through sort of the centralized data lake concept. And underneath that is the OCSF, the Open Cybersecurity framework standard, which has been picked up by a lot of the vendors. And that, I think, is really smoothing some of that process because now the data that's coming from all these disparate systems can be normalized into a single format, and that makes it a whole lot easier to do analytics on it.

Eric Hanselman   00:18:13

And this is -- it's something -- it's a cycle that we've seen repeat itself because Back in the day, we had -- after much screaming and hauling and all sorts of stuff, we did wind up on ways to exchange events so -- and do some of the basic low-level kinds of event transfer back and forth. So formats like sticks and taxi and those sorts of things. But what was happening is it was simply just the exchange of an event as opposed to something like OCSF in which you actually are now getting to a point at which you can query data. And now we've raised that level of abstraction up to a point at which we're now getting beyond just simply pitching events back and forth, but now being able to communicate with much greater context and actually do that query in -- rather than just getting a stream of things coming in from all of the various security gear that you got out there. Now you can actually have repositories of data that are queryable in a standardized format.

Mark Ehr   00:19:18

Yes, absolutely. And the other thing that really I found really cool is the concept of the security data fabric. And the one vendor that I know for sure, and I'm very familiar with is Comcast, which is kind of an unlikely cybersecurity vendor for a lot of people, but they have a product called DataV, which was originally developed internally to solve some of their own compliance and security use cases, and they've productized it. But the idea there is it's OCSF-based, and it can pick up data from hundreds of different sources, normalize it and store it in a data lake in OCSF format. And so you almost need for those tools that aren't necessarily OCSF yet, the data fabric can solve that -- a big part of that puzzle, too. And that's kind of fascinating to me.

Eric Hanselman   00:20:01

But it seems like getting to that point of being able to share data because you've got start-ups like Cribble, you got a lot of folks in data and the rest of these that are going to that next level of building what is a way to move data back and forth to get out of some of that silo. It sounds like -- I don't know, is this a path that starts to maybe bring together the on-prem and the cloud and make us all one happier family?

Mark Ehr   00:20:29

Yes, I think so. Combine that with the fact that for a long time, the cloud-based platforms, the SIMs or whatever and the underlying technologies were really not geared for accepting on-premises data or they were cost prohibitive. And a lot of that has changed to the point where -- especially on the scalability side, where platforms, like I was just talking to one of the Google Chronicle product managers. And I asked them a question because back in my -- I used to be a QRadar guy, and we had a customer that was pulling 2 million events a second into QRadar. And for a long time, I would ask this question, I would say, can your platform accommodate 2 million events a second coming in from an on-premises environment. And they would just say, "Oh, no, no, no, that's not really what we do or it would be cost proven. But now for the first time, I got a positive answer, and he said, absolutely, we can do that. And so for me, that's a really interesting indicator that shows that now these platforms, these cloud-based platforms, I think, are getting to the point where they can accept even the largest Fortune 20 companies data into a cloud environment and combine on-premises and cloud data.

Eric Hanselman   00:21:44

So starting to scale up. Is that where the market is headed? I mean what are other things that we should be thinking about in terms of futures in cloud-native protection?

Mark Ehr   00:21:53

Yes. There's a couple of things that come to mind. First of all, the concept of a platform, which obviously that's the last P in the CNAPP. And when CNOP was first coined, it was sort of -- let's just take a bunch of these technologies and this kind of combine them together under this acronym. And there are still multiple vendors and all that. But what I'm seeing in the market is that a lot of organizations are increasingly looking to go to a platform. Now they don't want to be locked into one, but they want to go with a platform that's got all or a majority of those capabilities, but also gives them the flexibility if they want to plug in a module from somebody else, right, or they already have one. And so -- but that's a definite move that's happening in the market. The other thing that's kind of interesting is you've got the hyperscalers also launching their own CNAPs and with the exception of AWS, which is going more for a partnership kind of thing. But the latent example of that was Google looking to pick up Wizz earlier this year, and it didn't work. But that shows you kind of where they're looking to go is that they're building their own CNAP. Their current message is they're going organic, but I would not be surprised with $23 billion in their pocket, they might be looking to pick somebody else up. So you've got the hyperscalers moving into that, but then you've got a whole bunch of other independent companies, the Wizzes and Orca and Aqua and so on, which also have their relevant offerings. And for me, the differentiation between all of these and what I tend to look for is, first of all, multi-cloud support. If you're a Google, can you support AWS and Azure and all the others to the same level or not? And how important is that versus an independent, which obviously, that's their bread and butter because they have to support those. And the other thing that I see where it's headed is really fleshing out the detection and response side. So CNAP, I'd like to characterize it this way. When CNAP first started, many of those solutions were kind of like hiring a security guard who can observe, look for things that are going on that are untoward and then raise a red flag or call 91 or whatever and basically would hand off to a team to go fix the problem. And now a lot of these solutions are building in detection and response into the platform. So it's more like converting them into police officers, right, which can actually go out and do the remediations and that sort of thing. So that's -- those are the key things I'm looking for.

Eric Hanselman   00:24:19

Interesting transitions. Again, as we often identify in security, it's moving into the operationalization that really winds up being that next page. Interesting stuff. And I will guide our readers to some long-format research you've got coming out, technology and business insight. And we'll put a link to that in the show notes that pulls a lot of this information together, yes?

Mark Ehr   00:24:43

Yes, very good. It will be out there.

Mark Ehr   00:24:45

Well, cool. this has been great, Mark. I appreciate all the insights. Thank you for being on the podcast.

Mark Ehr   00:24:50

Absolutely. There's a lot of fun.

Eric Hanselman   00:24:52

And that is it for this episode of Next in Tech. Thanks to our audience for staying with us. And thanks to our production team, including Sophie Carr, Feranmi Adeoshun, and Kyra Smith the marketing and events teams. I hope you'll join us for our next episode where we're going to be looking into the latest data center markets. We've been talking a lot about data centers and energy, but now we'll be taking a look at really what dynamics are from the market side of that. I hope you'll join us then because there is always something next in tech.