Cloud security posture management (CSPM)
A tool that continuously reads the configuration of a company's cloud accounts and flags mistakes such as storage open to the public; the cyber questionnaire asks whether one exists and who works its alerts.
Cloud security posture management (CSPM) is the category of tools that continuously read the configuration of a company's cloud accounts on Amazon Web Services (AWS), Microsoft Azure or Google Cloud, and flag whatever departs from a rule. A storage bucket readable by the whole internet, an admin port open to the world, an access key never rotated, an audit log switched off: those are the textbook findings. The tool works through the provider's application programming interfaces (APIs), with no agent on the machines, and compares what it finds against references such as the Center for Internet Security (CIS) benchmarks. The case underwriters cite is Capital One, disclosed in July 2019: a misconfigured web application firewall in its AWS environment let an attacker read data on more than one hundred million people. In 2020 the Office of the Comptroller of the Currency (OCC) fined the bank 80 million dollars, faulting it in particular for failing to assess risk before migrating to the public cloud. The mechanism is the shared responsibility model: the provider runs its infrastructure, the customer answers for what it configures, and CSPM watches that second half. Recent cyber questionnaires ask in two steps. Is a tool of this kind in place; are critical alerts handled within a written deadline. The second step weighs more than the first, because a tool that throws off thousands of alerts nobody reads changes nothing about the exposure. The practitioner's caveat: CSPM only sees the accounts it has been plugged into. An account opened by a development team on a company credit card, outside the corporate cloud organization, escapes it, and that is often where the open bucket sits.
Textbook case, made-up figures: an e-commerce platform declares a CSPM tool across its 14 AWS accounts. In the underwriting call, the chief information security officer (CISO) reports 2,300 open alerts, 40 of them critical, with no written handling deadline. The external scan finds a public storage bucket holding order exports. The underwriter reads the questionnaire answer as a yes on paper only: the tool exists, the control does not run. That goes into the pricing, and closing the bucket becomes a subjectivity.
CSPM, cloud security posture management, cloud misconfiguration scanning, cloud posture tool
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.