BETA
This is a BETA experience. You may opt-out by clicking here

More From Forbes

Edit Story

Six Reasons To Put Data At The Center Of Your Security Strategy

Forbes Technology Council

Ravi Ithal is Co-Founder and Chief Technology Officer at Normalyze, a data-first cloud security provider for the digital enterprise.

“Castle and moat” is the classic model of cybersecurity, which restricts external access while allowing internally trusted users. Although familiarity breeds comfort, security leaders should start feeling very uncomfortable with this business-as-usual approach. We’ve seen a never-ending stream of successful attacks and data breaches, so the castle and moat strategy is unreliable. It’s also misplaced because attackers aren’t going after your castle. Their real target is your data—and these days, data can be almost anywhere! And what makes you think the attackers aren’t already inside the castle?

Here are six reasons why you should consider putting data at the center of security strategy instead of relying on a legacy castle and moat approach.

1. CI/CD brings an explosion of deployments and new changes.

The constant change in business requirements has fueled the need for automating stages of application development. Continuous integration and continuous delivery (CI/CD) accelerate app development and make multiple changes to a codebase on a frequent basis. The risk of bugs in apps and data leakage rises with the continuous flow and higher velocity of services and changes because there’s no time for manual review. Cloud data is especially at risk with DevOps constantly spinning up instances and links to data repositories—especially with temporary buckets or forgotten copies of data used for testing apps.

2. AI/ML fuels the need for more access to data for modeling.

Compared to legacy apps, machine learning (ML) workloads require enormous amounts of both structured and unstructured data to build and train models. As data scientists experiment with models and evolve them for new business requirements, new data stores are created for testing and training. This constant movement of production data into nonproduction environments may expose it to potential exploits. Putting data at the center of your security strategy will help ensure that controls are extended to wherever data exists in the cloud—be it inside or outside of production environments.

3. Microservices drive more services and granular data access.

The cardinal rule of football, basketball, baseball and other ball games is to keep your eye on the ball. The same lesson applies to cloud data security: Keep your eye on the data. Doing so was easier for legacy applications, which were built with a three-tier architecture and a single data store. In that scenario, protecting application data merely required protecting that one database.

Modern app development uses multiple microservices with their own data stores that contain overlapping pieces of application data. This vastly complicates securing data, especially as new features often introduce new microservices with more data stores. The number of paths of access to these data stores also increases quadratically over time. Continuously reviewing the security posture of these multiplying data stores and access paths by hand is impossible—and is one more reason for using automation to help keep the team’s eye on the data.

4. Data proliferation brings more copies into more places.

The proliferation of copies of data in different cloud storage locations is a big issue for organizations using infrastructure as a service and infrastructure as code options. These architectures allow getting things done quickly, but “faster” often means there’s no one looking over your shoulder to apply security checks to the expanding data. Putting data at the forefront of your security policy will help provide the ability to automatically follow data to wherever it’s stored and automatically apply security controls to ensure the data is protected from unauthorized access.

5. Reliance on a cloud infrastructure suffers when data access is misconfigured.

Access authorization is a pillar of data security. Obviously, if there’s no access authorization in place, the data is a sitting duck for attackers. But what if authorization controls are improperly implemented? Did someone simplify or remove them to facilitate easy use by DevOps? Are controls consistently applied to data wherever it resides in the cloud? Most cloud breaches are due to the misconfiguration of the cloud infrastructure (IaaS and PaaS), according to Garter analysts. A data-first approach to security should ensure that access configurations for cloud data are properly used wherever data resides.

6. Privacy regulations require more control and tracking of data.

Compliance is a significant driver of cloud data security. Examples include personally identifiable data for GDPR, payment account data and sensitive authentication data for PCI DSS and personal health data for HIPAA. Noncompliance in protecting sensitive data like these can trigger substantial penalties. A data-first security policy should enable automatic discovery and classification of all protected data anywhere it resides in the cloud environment.

Data is your organization’s most valuable asset. As more data and workloads move into the cloud, it’s imperative for security teams to have 100% visibility into where sensitive data resides and to ensure it’s protected. Using a legacy castle and moat approach to security will fall short in modern environments. For the reasons mentioned, adopting a data-first strategy for security is important for keeping data secure anywhere in the cloud.


Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?


Follow me on LinkedInCheck out my website