State of cloud security 2022

Cloud customers suffered a range of major security events within the past year, with data breaches, data leaks, and intrusions into their environment among the most serious. In addition, 25% worry that they’ve suffered a cloud data breach and aren’t aware of it. These incidents can carry a high cost, including fines for failed audits and compliance violations, cryptomining on the customer’s cloud bill, and loss of business due to system downtime resulting from misconfiguration and remediation errors.

Many cloud security failures result from a lack of effective cross-team collaboration and team training. When different teams use different tools or policy frameworks, reconciling work across those teams and ensuring consistent enforcement can be challenging. Insufficient tooling that produces false positives leads to alert fatigue within security teams, which itself contributes to human error when identifying critical issues that need to be addressed quickly. Issues with inconsistent policy interpretations and a lack of education may indicate the need for policy-as-code based tooling.

The adoption of cloud-native services and architectures, such as container-based and “serverless” (i.e Functions as a Service), raises new security considerations and requirements. A cloud native approach can improve developer speed and agility, but 41% of respondents cited it as a major impact on their cloud security effort because it creates more complexity. To eliminate security issues pre-deployment, teams have to add specific expertise related to cloud native security, set up additional training and education, and shift left on cloud security. Only one fifth of respondents have managed to avoid a significant security impact due to cloud native adoption.

While the motivation to improve cloud security efforts is primarily driven by the desire to keep cloud environments secure, there are a number of other desired outcomes, including the ability to better demonstrate that cloud security is an organizational priority. Inefficient cloud security processes can be a significant drag on team productivity, and security professionals cite a desire to improve their own productivity as their top motivation. Among all respondents, cloud engineering productivity ranked just behind keeping their environment secure.

Every organization is pursuing a number of cloud security objectives, but priorities differ considerably depending on the organization type. Enterprises are focused on preventing cloud misconfiguration pre-deployment, while minimizing reviews and approvals ranks lowest for them. Small and mid-sized businesses, however, are very interested in speeding up approval times, while pre-deployment security ranks lowest for them. Public sector organizations are focused on designing secure environments and bringing existing ones into compliance, while startups are equally focused on getting better security visibility and streamlining security processes.

Organizations and teams each have their own cloud security objectives and motivations for improving their effort, and success delivers real results across the board. 49% of respondents said that cloud security improvements resulted in faster application and feature deployments, and 48% said their security team is able to do more with the resources they have. 44% said that security improvements have led to better collaboration between teams, and 41% said it’s now easier to attract and retain cloud engineering talent. When cloud security improvements result in fewer misconfiguration issues to remediate, engineering teams can reinvest their time in building value, and 40% said they’ve been able to do so.

A significant factor in improving cloud security efforts is infrastructure as code (IaC) security done pre-deployment, during development and CI/CD. The adoption of IaC means there’s a software development life cycle for cloud infrastructure — and the opportunity to shift left on cloud security. The median reduction in cloud misconfiguration resulting from IaC is 70%. Nearly a quarter of respondents claimed productivity improved by 80% for engineers responsible for cloud security tasks such as remediations. And 70% was the median increase in deployment speed due to IaC security checks, which largely results in automated approvals and less rework required.