BlogPart 3 in a series on cloud security solutions: Choosing the right solution for securing your cloud and hybrid environments can be complicated. The market is an alphabet soup of acronyms, and it's hard to tell what you'll get from one product to the next, or from one vendor to another. That complexity can lead to gaps, confusion, tool sprawl, and weakened defenses.
To help you make sense of the current tooling landscape, we're going to dig into individual product categories, explaining what they are, what they do, and their strengths and weaknesses. We'll also compare cloud-native network detection and response (NDR) to those products and show you where NDR provides similar or complementary capabilities.
Today's entry in this ongoing series focuses on cloud security posture management tools, or CSPMs.
Read Part 2: What is a Cloud Access Security Broker (CASB)?
What is a Cloud Security Posture Management (CSPM) Tool?
It's all in the name for this cloud-first tool. CSPMs help organizations manage the security posture of their cloud-hosted applications and data by identifying misconfigurations and compliance issues. CSMPs can also provide some level of threat detection and audit reports. Some CSPMs offer automation to address security settings related to risk, governance, and compliance.
How Do CSPMs work?
CSPMs discover cloud infrastructure assets such as Amazon Simple Storage Service (S3) buckets or Azure Virtual Machines and provide visibility into security configurations. CSPMs can work across infrastructure-as-a-service (IaaS), platform-as-a-service (Paas), and software-as-a-service (SaaS) environments. They benchmark security and access settings against compliance goals or mandates to determine the overall security posture of an environment. Some CSPMs make recommendations to reduce risk, improve security posture, or bring an environment back into compliance. Some CSPMs offer continuous activity monitoring.
While CSPMs offer several benefits, like everything they also have drawbacks. Many CSPM capabilities are available in leading cloud access security broker (CASB) and cloud workload protection platform (CWPP) tools, as well as cloud service provider (CSP) products. Since they're cloud-first tools, CSPMs generally can't be relied upon for on-premises security. They also don't inspect traffic or provide security at the data and application layers. Some CSPMs rely on other tools for vulnerability scanning.
How Does NDR Compare to CSPM?
Network detection and response (NDR) solutions and CSPMs both provide cloud security, but they don't have an incredible amount of overlap. Unlike CSPMs, NDR tools inspect network telemetry and provide security at the data and application planes. NDR tools also offer on-prem and hybrid security. Best-in-class NDR solutions also work across multicloud environments.
While CSPM tools mostly focus on prevention, NDR solutions identify the threats and detect post-compromise behaviors—such as lateral movement—that CSPM tools miss. This real-time detection enables security teams to answer questions, such as, "Do I have a threat actor in my cloud infrastructure right now?" or, "Is my web-facing production infrastructure currently under attack?"
Combining NDR with CSPM
NDR and CSPM tools complement each other and strengthen your defense in depth. CSPM focuses on posture, compliance, and identifying vulnerabilities in a cloud footprint, and they're good at identifying misconfigurations and gaps in cloud architecture. While these are important components of understanding risk in the cloud, they do not offer real-time attack detection and context-rich investigation that leverages the network as a data source. That's where cloud workload monitoring from NDR comes in as part of a defense-in-depth strategy. By hardening your attack surface CSPM and providing real-time visibility, threat detection, and investigation of cloud traffic with NDR, you can defend your critical workloads and data from the inside out.
