The Control & Security of Cloud Resources: How to Be (or Not to Be) Cloud Confident

The Control & Security of Cloud Resources: How to Be (or Not to Be) Cloud Confident

Speakers: Marius Zaharia, Cloud Team Leader, Société Générale

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=y11xcrIrTXA

Overview

In an era defined by rapid cloud adoption, the security of cloud resources has become paramount, yet it remains a persistent challenge for organizations worldwide. Marius Zaharia, Cloud Team Leader at Société Générale, addressed this critical topic at DefCamp, shedding light on the pervasive issue of cloud misconfigurations as a primary vector for security breaches. His talk, "The Control & Security of Cloud Resources: How to Be (or Not to Be) Cloud Confident," explored the inherent complexities of securing public cloud environments and presented a structured approach to achieving robust security postures.

Zaharia, a principal engineer and cloud solution architect, candidly positioned himself as an "intruder" among security professionals, emphasizing his daily collaboration with security teams to secure public cloud resources. His perspective offered a practical, architect-driven view on the operational realities of cloud security, bridging the gap between theoretical security principles and their real-world implementation. The core of his presentation revolved around understanding, assessing, and mitigating risks associated with cloud-native services, ultimately guiding enterprises toward becoming truly "cloud confident."

The relevance of this discussion cannot be overstated. As organizations increasingly migrate critical workloads and sensitive data to public clouds, the responsibility for securing these environments becomes a shared one between the Cloud Service Provider (CSP) and the customer. Zaharia highlighted that while CSPs offer a secure foundation, the misconfiguration of services by users is a recurring cause of data breaches. This talk provides invaluable insights for security professionals, cloud architects, and developers grappling with the intricacies of securing dynamic, agile cloud infrastructures, particularly in highly regulated sectors like banking and finance.

Background

▶ Watch: Introduction: Cloud misconfiguration as the main security issue (0:00)

The journey to cloud confidence begins with a clear understanding of the public cloud landscape and the challenges it presents. Zaharia commenced by outlining the fundamental principle that while CSPs provide a robust, secure infrastructure, the default configurations of many cloud services are designed for mass consumption and ease of initial use, rather than stringent security. This often means that out-of-the-box settings are not optimized for enterprise-grade security, leaving organizations vulnerable to exploitation. Coupled with an explosion of cyber threats targeting the expanding attack surface of the public cloud, this necessitates a proactive and sophisticated security strategy.

Central to running applications in the cloud are landing zones, which comprise a foundational set of services like networking, Identity and Access Management (IAM), monitoring, and cost management. Within this framework, the concept of "trust of cloud native services" emerges as a critical area of focus. In a DevOps context, where feature teams are empowered with autonomy to deploy applications ("you build it, you run it"), the challenge lies in maintaining central control and ensuring security without stifling agility. This delicate balance forms the crux of Zaharia's discussion on achieving trust in cloud services.

The speaker detailed the key security concerns that drive the need for this trust:

• Data Privacy and Confidentiality: Protecting sensitive information from unauthorized access.
• Data Sovereignty: Adhering to jurisdictional requirements for data storage and processing.
• Intellectual Property (IP) Sensitivity: Safeguarding proprietary information critical to business operations.
• Data Loss and Leakage: Preventing accidental or malicious exfiltration of data, which is "almost the most important" concern for companies with valuable assets.
• Regulatory and Legal Compliance: Meeting stringent requirements, particularly in public, banking, and financial sectors.
• Operational Risks: Addressing risks that can impact the availability and performance of cloud services.

To systematically address these concerns, Zaharia presented a three-tiered risk assessment and mitigation methodology:

1. CSP Trust Assessment: A high-level, transversal risk discussion and negotiation with the cloud provider itself, typically a large contractual agreement.
2. CSP Service Level Assessment: A concrete analysis of individual cloud services (e.g., AWS S3, Azure Storage, EC2 instances, Azure VMs). This is addressed once for the entire company, streamlining security efforts.
3. Application Risk Analysis: A specific assessment for each application, documenting its unique risks and mitigation strategies.

The talk primarily focused on the second tier: securing individual CSP services. To contextualize the discussion, Zaharia introduced a range of cloud security terminology that has matured over recent years, defining different functional blocks and domains:

• Identity and Access Management (IAM): Controls user, service, and application access. Zaharia later emphasized this as the foundational security control, even ahead of securing services.
• Cloud Security Posture Management (CSPM): Focuses on the configuration of cloud services, ensuring compliance, performing checks, and enabling remediations. This operates at the control plane level of the cloud.
• Cloud Workload Protection Platform (CWPP): Concerned with the security inside workloads, such as Virtual Machines (VMs), containers, and serverless functions.
• Cloud Infrastructure Entitlement Management (CIEM): Provides insights into permissions, ensuring least privilege and efficient access management.
• Data Security: Encompasses data classification, encryption, and sovereignty.
• DevSecOps: Integrates security into the entire CI/CD pipeline to protect against supply chain attacks.
• Cloud Native Application Protection Platform (CNAPP): An overarching, unified platform that combines features from CSPM, CWPP, and other domains to provide comprehensive security for cloud-native applications. This unified approach is gaining popularity as platforms evolve to include multiple functionalities.

Key Findings

▶ Watch: Three-layered methodology for cloud risk assessment (9:50)

The talk revealed several critical insights into the current state and future direction of cloud security:

Firstly, a fundamental finding is that default cloud service configurations are inherently insecure for enterprise use. While designed for mass adoption and ease of onboarding, these defaults often expose organizations to unnecessary risks. This necessitates a deliberate and structured approach to reconfiguring services to meet specific security and compliance requirements.

Secondly, implementing a robust security framework for cloud services demands a rigorous methodology of risk definition, assessment, and mitigation. Zaharia illustrated this through the lifecycle of securing a service like Azure Storage: identifying concerns (e.g., data leakage from public access), designing mitigations (e.g., disabling public access), formal validation, implementation, and continuous testing. This process, akin to software development, ensures that security measures are thoroughly vetted before wide-scale deployment.

A significant discovery highlighted was the high cost and complexity of building and maintaining custom cloud security solutions. While bespoke solutions, such as those leveraging Azure Policy and Azure Automation, offer precise control tailored to specific organizational needs, they incur substantial development and operational overhead. Zaharia noted that a single service, like Azure Storage, could require 15 to 20 custom policies in a highly regulated environment. The rapid evolution of cloud services, with an estimated 20% feature return every three to six months, means continuous reassessment and adaptation, making custom solutions difficult to scale and sustain. Furthermore, platforms can impose hard limits, such as 500 policy definitions per management group or subscription in Azure, which can constrain large enterprises.

Consequently, Zaharia identified the emergence of off-the-shelf CNAPP solutions like Microsoft Defender for Cloud and Palo Alto's Prisma Cloud as a pivotal development. These platforms offer a more mature, integrated, and often cost-effective approach to multi-cloud security posture management and workload protection. They abstract away some of the underlying complexities of native cloud security tools (e.g., the disparity between Azure Policy and AWS's combination of SCPs, AWS Config, Lambda, and open-source tools like Custodian), providing a unified interface for policy enforcement and compliance across different CSPs.

Finally, the talk underscored the operational challenges associated with automated remediation. While policy effects like deny (blocking insecure deployments) are powerful, automatic remediation of existing non-compliant resources often faces resistance from operational teams. The fear of breaking production environments or interfering with Infrastructure as Code (IaC) tools like Terraform or Ansible makes many organizations hesitant to fully automate remediation. This suggests a preference for audit, alert, and deny functions, with remediation often remaining a manual or carefully controlled, semi-automated process.

Technical Deep Dive

▶ Watch: Key cloud security acronyms: CSPM, CWPP, CIEM, CNAPP (13:10)

The core technical challenge addressed by Marius Zaharia is how to systematically secure individual cloud services against misconfiguration, moving beyond the shared responsibility model to practical implementation. He used the example of Azure Storage to illustrate this. A primary security concern for Azure Storage is data leakage, particularly if public access is left enabled. The mitigation is straightforward: disable public access. However, enforcing this across potentially thousands of storage accounts and ensuring ongoing compliance requires a robust technical solution.

Zaharia outlined the components of an effective security solution, categorizing policies by their effect:

• Report-type policies: Generate compliance reports, identifying non-compliant resources.
• Alert-type policies: Trigger immediate notifications for critical security violations.
• Deny-type policies: Block the creation or modification of resources that violate security rules, acting as a preventative control.
• Remediate-type policies: Automatically bring non-compliant resources back into a secure state.

The proposed process involves security officers configuring and deploying these policies. Projects then consume CSP services, and the security officer monitors compliance reports, guiding projects to remediate identified issues.

For organizations operating primarily in Azure, Zaharia detailed a custom solution leveraging native Azure services:

• Azure Policy: This is a cornerstone service in Azure that allows organizations to create, assign, and manage policies that enforce configurations. Policies are defined in JSON and can be either built-in (provided by Microsoft) or custom. Key effects of Azure Policy include:
• Audit: Reports on non-compliant resources without preventing their deployment.
• Deny: Prevents the creation or update of resources that violate the policy.
• Deploy if not exist: Automatically deploys a compliant resource or configuration if it's missing.
• These policies can be applied at scale, either at the subscription level or across multiple subscriptions using management groups, providing broad coverage.
• Azure Monitor Alerts: For critical policy violations, Azure Policy can integrate with Azure Monitor to trigger real-time alerts, notifying security teams of immediate threats.
• Azure Automation Runbooks: For more complex or custom remediation scenarios that Azure Policy’s Deploy if not exist effect cannot handle, Azure Automation runbooks can be used to automate tasks.

While powerful, Zaharia underscored the limitations of this custom approach. Developing and maintaining 15-20 specific policies for a single service like Azure Storage, especially when built-in policies don't meet strict requirements, represents a significant development effort. The rapid evolution of cloud services means constant updates to these custom policies, leading to high maintenance costs and a "20% return on features" every few months, requiring continuous reassessment. Moreover, Azure Policy itself has limits, such as a maximum of 500 policy definitions per management group or subscription, which can become a bottleneck for very large enterprises.

Recognizing these challenges, the talk pivoted to off-the-shelf CNAPP solutions, which offer a more integrated and scalable approach to multi-cloud security:

• Microsoft Defender for Cloud: This solution, a "real spin-off" from Azure's security offerings, builds upon the foundation of Azure Policy. It provides comprehensive CSPM and CWPP capabilities. Crucially, Defender for Cloud extends its reach to other cloud providers, using its underlying Azure Policy engine and agents to enforce security across multi-cloud environments. It offers enhanced policy sets beyond native Azure Policy, detailed vulnerability explanations, and various remediation options, including automatic fixes and the ability to deny insecure deployments from the outset.
• Palo Alto Networks Prisma Cloud: Presented as another leading multi-cloud CNAPP, Prisma Cloud has a strong focus on CWPP. It offers a more abstract approach to cloud security, utilizing its own configuration and query language, which requires a learning curve but provides a unified interface across different clouds. While powerful for reporting and dashboards, Zaharia noted that organizations are often hesitant to grant external solutions like Prisma Cloud the permissions for automated remediation due to concerns about operational impact. Prisma Cloud's granularity of alerts was also cited as a potential issue, sometimes leading to an overwhelming volume of notifications for smaller teams.

Zaharia contrasted these solutions, highlighting that while custom Azure-native approaches provide deep integration and control, they come at a high cost and lock-in to a single CSP. Multi-cloud CNAPP solutions, though requiring investment in learning a new toolset, offer broader coverage and a unified security posture across disparate cloud environments, mitigating the complexity of managing different native security tools (e.g., AWS's combination of Security Control Policies (SCPs), AWS Config, Lambda functions, and open-source tools like Custodian).

Demo / Proof of Concept

▶ Watch: Exploring commercial multi-cloud security platforms (28:00)

While the talk did not feature a live, interactive demonstration or proof of concept, Marius Zaharia illustrated the practical application of his concepts through visual aids and detailed descriptions of how security policies and compliance reporting function within Azure.

He presented screenshots of the Azure Policy interface, showcasing how built-in and custom policies are defined and applied. These visuals depicted the JSON structure of policies, illustrating how specific configurations (e.g., disabling public access for storage accounts) are enforced. The presentation included a compliance report generated by Azure Policy, demonstrating how non-compliant resources are identified and categorized, providing a clear overview of an organization's security posture against defined policies. This report showed how services are marked as "compliant" or "non-compliant," reflecting the effectiveness of the applied policies.

Further, Zaharia displayed the interface of Microsoft Defender for Cloud, emphasizing its advanced capabilities beyond native Azure Policy. The visuals highlighted how Defender for Cloud provides detailed explanations of vulnerabilities, outlines potential attack vectors (e.g., compromised VMs accessing storage credentials), and offers actionable remediation steps. These screenshots served to concretely demonstrate the reporting, alerting, and remediation features discussed, making the theoretical concepts tangible for the audience without requiring a live, interactive demo. The absence of a live PoC was offset by the detailed explanation and visual evidence of these tools in action within a cloud environment.

Defensive Implications

▶ Watch: Q&A: The foundational importance of Identity and Access Management (44:00)

The insights shared by Marius Zaharia offer crucial guidance for security professionals seeking to bolster their cloud defenses. The primary defensive implication is the absolute necessity of proactive CSPM. Organizations must move beyond default cloud configurations and implement a systematic process to define, enforce, and monitor secure settings for all cloud services. This involves an iterative lifecycle of risk assessment, policy design, implementation, and continuous validation.

Defenders should prioritize the following actions:

• Establish a Strong IAM Foundation: As highlighted in the Q&A, Identity and Access Management (IAM) is the bedrock of cloud security. Before securing individual services, organizations must ensure robust identity governance, strong authentication mechanisms, and strict least privilege principles are applied to all users, services, and applications accessing cloud resources.
• Adopt a Layered Risk Assessment Methodology: Implement the three-tiered approach: assess the CSP contract, conduct thorough risk assessments for each cloud service, and perform application-specific risk analyses. This ensures comprehensive coverage from the foundational provider level down to individual application components.
• Evaluate and Leverage CNAPP Solutions: Given the high cost and complexity of custom solutions, organizations should seriously consider adopting Cloud Native Application Protection Platforms (CNAPP) like Microsoft Defender for Cloud or Palo Alto's Prisma Cloud. These platforms offer unified, multi-cloud capabilities for CSPM and CWPP, streamlining policy enforcement, compliance reporting, and vulnerability management across diverse cloud environments.
• Implement a Phased Approach to Policy Enforcement: Start with less intrusive policy effects like audit (reporting) and alert for critical issues. Once confidence is built and operational processes are mature, move to deny policies to prevent insecure deployments. Automated remediation should be approached with extreme caution, tested rigorously, and implemented only with strong operational team buy-in, due to the risk of unintended disruptions to production environments or IaC pipelines.
• Centralize Security Policy Development and Sharing: For large organizations, centralizing the development of cloud security policies and sharing compliant Infrastructure as Code (IaC) templates (e.g., Terraform, Ansible, CloudFormation) across business units can significantly reduce duplicate effort, ensure consistency, and accelerate secure cloud adoption. This fosters a "culture of knowledge" and prevents individual teams from "struggling for three months" to achieve compliance.
• Prioritize Continuous "Tech Watch": The rapid evolution of cloud services (with new features appearing every few months) necessitates continuous monitoring of new cloud capabilities and emerging threats. Security teams must dedicate resources to staying updated, assessing new features for security implications, and adapting policies accordingly.
• Balance Common Baseline with Specific Needs: Establish a common security baseline that applies across the entire organization, ensuring fundamental protections. However, be prepared to implement more stringent, specific security policies for particular departments, business lines, or workloads with higher risk appetites or stricter regulatory requirements.
• Foster DevSecOps Collaboration: Encourage close collaboration between security teams and feature development teams. Security teams should not just say "how not to develop a thing," but actively work with developers to build secure-by-design templates and share best practices, embedding security early in the CI/CD pipeline.

By embracing these defensive implications, organizations can navigate the complexities of cloud security, mitigate the risks of misconfiguration, and build true confidence in their cloud deployments.

Key Takeaways

• Cloud Misconfigurations are a Primary Threat: The default configurations of cloud services are often designed for ease of use, not stringent security, making misconfigurations a leading cause of data breaches.
• A Layered Risk Assessment is Crucial: Effective cloud security requires a systematic, three-tiered risk assessment approach, focusing on the Cloud Service Provider (CSP), individual CSP services, and specific applications.
• Custom Solutions are Costly and Complex: While offering precise control, building and maintaining custom cloud security solutions (e.g., with Azure Policy) is expensive, resource-intensive, and challenging to scale due to the rapid evolution of cloud services and platform limits.
• CNAPP Solutions Offer a Scalable Alternative: Off-the-shelf Cloud Native Application Protection Platforms (CNAPP) like Microsoft Defender for Cloud and Prisma Cloud provide unified, multi-cloud security posture management and workload protection, offering a more mature and often cost-effective approach.
• Automated Remediation Requires Caution: Policy enforcement should progress from audit and alert to deny (blocking insecure deployments). Automated remediation, while powerful, must be implemented with extreme care, rigorous testing, and operational team buy-in to avoid unintended disruptions.
• IAM is the Foundation: Identity and Access Management (IAM) is the fundamental bedrock of cloud security; securing identities and access controls must precede all other service-level protections.
• Continuous Learning and Collaboration are Essential: The dynamic nature of cloud environments demands continuous "tech watch" and a collaborative DevSecOps culture to adapt to evolving threats and integrate security early into the development lifecycle.

About the Speaker(s)

Marius Zaharia is a distinguished Cloud Team Leader at Société Générale, based in France. He holds the titles of Principal Engineer and Cloud Solution Architect, specializing in PaaS (Platform as a Service) and hybrid architectures, with a particular focus on Microsoft Azure and Amazon Web Services (AWS). Zaharia is also recognized as a Microsoft Azure MVP (Most Valuable Professional) and actively contributes to the cloud community as an organizer and animator of the French Azure user group. Despite identifying himself as primarily a cloud architect rather than a security specialist, his daily work involves close collaboration with security teams to ensure the robust protection of cloud resources, bringing a pragmatic, implementation-focused perspective to cloud security discussions.