Does Cloud Automation Create New Vulnerabilities for the Enterprise?

by Chris Smith, Senior Product Marketing Manager, CyberArk

While cloud automation can help organisations become significantly more agile and improve security, it can also expand the enterprise attack surface, creating new vulnerabilities and risks in what becomes an increasingly dynamic and complex environment. It’s important to understand and address the vulnerabilities that can come with automation.

Organisations have many different reasons and roadmaps for their migration to the cloud. While some have an “all-in” strategy, most migrate to the cloud over time, moving individual business activities and applications as needed. Automation needs vary based on the enterprises cloud strategy and drivers.

Common Drivers for Cloud Adoption

Three of the most common drivers for cloud adoption include cost savings and efficiency, access to on-demand computing, and increased agility.

To achieve cost savings, some enterprises take a “forklift approach” and simply move their apps from their on-premises data center to the cloud – and shut their data centers. In this scenario the enterprise does not take full advantage of the dynamic capabilities offered by cloud computing, and consequently, requires only minimal automation. To achieve much greater efficiency, organisations need to re-architect and replace applications, rather than simply move them. This agility requires a high level of automation, which is noted in the third scenario below.

It’s increasingly common that enterprises want access to on-demand computing. This provides rapid access to significant computing capacity, such as for big data and analytics. To achieve this, application instances are created instantly to meet the demands of the business. It’s automation that makes this possible, assigning and securing the required credentials and privileges when each new instance is created.

The third scenario is all about agility — enabling the enterprise to more rapidly develop and deploy applications to better support customers and evolving market needs. As development practices such as Continuous Integration, Continuous Delivery (CI/CD) pipelines, and DevOps are adopted, developers also leverage orchestration and automation tools to speed software development and deployment.

Enterprises with robust CI/CD pipelines may do multiple and potentially dozens of code deployments each day using automated processes and tools. Clearly, automation is critical in this scenario.

Potential Vulnerabilities Expand With Automation

Across each of these scenarios, the level of automation required increases. It’s important to understand some of the core vulnerabilities and risks that need to be addressed to protect an organisation’s cloud environment.

Regardless of the primary driver for cloud adoption or the level of automation, every organisation needs to protect privileged accounts and credentials and access rights for their cloud management consoles.  The consoles are very powerful, and they are used by both humans and automated scripts. Consequently, the console is vulnerable to phishing attacks and is a common entry point for attackers.

Additionally, all organisations will need to secure the privileged credentials used to manage the enterprise’s cloud-based infrastructure, including the operating system, database and other resources, as well as any embedded static application credentials.

With on-demand computing, there are additional vulnerabilities to protect. These include, for example, any dynamically assigned application credentials, API keys, and cloud secrets as well as the privileged credentials established when new application instances are created with auto scaling or other orchestration tools. When each new instance is created with auto scaling, it will need privileges to access other applications and resources, and this access must be automatically secured.

In the market agility scenario, not only must the vulnerabilities and risks described in the earlier examples be protected, but also the privileged credentials and secrets associated with the CI/CD pipeline, including all the administrative consoles for orchestration and other tools. And the trust relationships must be fully automated by automatically storing, retrieving and managing secrets and credentials across the pipeline.

In summary, as the level of automation increases, the vulnerabilities and attack surface also increases. Consequently it is important that organisations are aware of and defend against the vulnerabilities that can come with automation.

No matter where you are in your enterprise’s cloud journey or the level of automation you are using, you will need to implement robust privileged account security policies to protect your cloud assets.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags cloud securityVulnerabilitiesdata centrescyber attacksdata protectioncyber securitycloud adoptioncloud automation toolsCyberArkcloud automation

More about

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Chris Smith

Latest Videos

More videos

Blog Posts