The Importance of Continuous Security & Compliance in SaaS Environments

We're living in the era of "giga-breach," where cloud data breaches can easily expose in excess of one billion records. As such, the stakes couldn't be higher for cloud security teams seeking to secure cloud environments. That's why it's important to understand the key vectors driving data breaches today. Read on to learn more.

The three terrible trends elevating data breach risk in 2022

There are three trends that have converged to create the security environment we find ourselves in today. They are:

1. Increased cloud adoption: It's no surprise that during the pandemic, cloud adoption accelerated, but that growth is still set to continue. Foundry (formerly IDG) found in its 2022 cloud computing study that 72% of organizations prioritize cloud solutions when adopting new technologies or resources. Overall in the next 18 months Foundry expects that 95% of organizations will have at least partially migrated to the cloud, with the number of fully on-prem organizations falling to 5%.
2. Increased supply chain attacks: 2021 was the year of supply chain attacks, from the fallout of the SolarWinds breach to Kaseya and attacks on open source dependencies like Log4j. This trend seems to be continuing in 2022 with an attack on Okta earlier this year, and fallout from an attack on GitHub npm infrastructure is still ongoing at the time of this writing.
3. Increased security misconfigurations: Overall, cloud security misconfigurations are so frequent that CISA (Cybersecurity and Infrastructure Security Agency) recently mentioned them in an advisory. The Cloud Security Alliance recently found that potentially up to 63% of security incidents might be the result of SaaS misconfigurations. This is in line with other finds, such as the oft-quoted Gartner statement that “through 2022, at least 95 percent of cloud security failures will be the customer’s fault.” Other studies, like the World Economic Forum's Global Risks Report, suggest the same.

How to prevent data breaches in 2022

Organizations are adapting to this new normal in a multitude of ways, but perhaps the most successful is the adoption of core zero trust principles. The federal government indicated last year that it's moving towards zero trust security, which will put pressure on its private sector partners to do the same. Many have taken this as a signal that we'll likely see guidance and new best practices that will emerge from this effort that will trickle out to the broader private sector.

Zero trust is a useful guiding assumption for security programs, as it encourages teams to act as if a threat actor already has access to resources. This prevents security from crumbling from one central point of failure (like a cloud misconfiguration). We talked in detail about this in a recent post highlighting breaches that illustrate the growth of supply chain attacks and cloud misconfigurations.

Zero trust security involves multiple aspects like identity, authentication, devices, and data. While much attention has been given to schemes like continuous authentication and other means of managing identity and access, data security protection tends to be left out of the conversation.

Data security protections, like cloud-native data loss prevention, are a critical zero trust security control that ensure your environments remain clean of sensitive data like credentials, passwords, or PII and PHI that would immediately escalate a security incident or constitute a breach if they were discovered.

Nightfall enables this type of security for customers across every industry, with machine learning detectors that can scan SaaS and cloud infrastructure for text, images, and files containing names, financial data, geographic identifiers, PHI, credentials, API keys, and much more.

If you want to learn more about enabling zero trust data security, view our on-demand webinar titled Build Continuous Security & Compliance into Your SaaS Environments.