A Potentially Fragile Security Bargain With API Secrets

Tie a metaphorical string to your digital transformation and give it a yank. It could be a string or you may need a rope depending on how far you've transformed.  Its girth determined by the volume, value, and sensitivity of the underlying data.

Either way, APIs are probably attached to the far end. Way out there close to where users and partners are. Mobile apps, third parties, whatever, and wherever you’ve got data and information to share via APIs.

The strength of the line represented in strength of the security bargain upheld with your API secrets.

A Pesky Cloud Security Use Case

You’ve loaded up the security controls to protect your data in any of those big name cloud providers. 

Ever think about the source network from which that authorized user is connecting to your internal cloud resources?

The Cloud Security Automation Realization

Defending the cloud means automation.  

Pull a string on any cloud standard and some lines of code should jiggle up and down ready to enforce it in an automated way. This means the team must code. And, they must also think. And, also engage those impacted by any friction from the automation. 

Why Cloud Security Requires A Different Mindset

In the legacy infrastructure world, dwell time for bad actors is often measured in weeks or months. 

Bad actors in the cloud don’t have that luxury. That access token they’ve acquired likely without your knowledge often expires in minutes. They’ve come prepared to sprint with automated attacks ready to go. 

The cloud so far has primarily been an automation race run by one side. The wrong side. Organizations will either invest to catch up or perish before they can respond.

Follow me on Twitter for the latest blog updates: @Opinionatedsec1  

SEE ALSO

The Super Secret Source Of Some Of The Best Cyber Threat Intelligence Available

Cybersecurity Needs Style Points  

Security Tool Myths