Cloud Security Automation

The Cloud Security Problem

Most agencies are learning as they go along when moving to the cloud. The movement of IT resources to the cloud has preceded a management structure to monitor and control how cloud resources are provisioned and used.

The lack of clear standards for cloud usage has caused serious vulnerabilities for major agencies. The current landscape is dominated by:

Over-provisioning, over-scheduling & underutilized cloud assets
Lack of usage guidelines for harding, encryption, and vulnerability monitoring
Cloud services in use that are not FedRAMP-approved and insecure

The Solution

As a first step, agencies need to determine the cloud standards to enforce. There are proven industry standards available, like Center for Internet Security (CIS) Benchmarks (for AWS, Azure, and GCP), NIST SP 800-53 & 800-207, and CSP Best Practices.

The large CSPs have developed many of the cloud security best practices that are needed for security-related automated remediation, which is required to move towards a Zero Trust approach as mandated by the Biden Administration.

Here at STS, we help agencies implement a controls-as-code approach that includes three operational phases which fully integrate cloud-native monitoring and remediation within existing agency systems for long-term security and success: