1 The Challenge

Most organizations now have a hybrid IT environment where services are delivered in multiple ways, some delivered as cloud services from multiple providers, while others remain on premises or at the edge. Cloud Infrastructure as a Service (IaaS) is used to develop and deliver new applications, reengineer existing ones, as well as to store data. This provides an environment well suited to digital transformation without the need for capital expenditure or lengthy procurement delays to obtain hardware. However, it also brings new challenges including increased complexity, ephemeral resources, and shared responsibility for security.

1.1 Shared Responsibility for Security and Compliance

The responsibility for security of cloud services is shared between the Cloud Service Provider (CSP) and the cloud customer. While the CSP must take steps to secure the service it provides, it is up to the cloud customer to secure the way they use the service. The customer must implement what are known as Complementary User Entity Controls (CUECs) to achieve this. Cloud Security Posture Management (CSPM) tools are intended to help organizations using cloud services to identify and manage the risks under their control.