Security and compliance are going to be hot topics next year as more and more organizations confront the challenges of the cloud. In 2018, a few major new regulations, such as the EU General Data Protection Regulation (GDPR) will start to swing the privacy pendulum towards better cloud security and more protections for consumers and end users.
Here’s what that means for 2018:
An accountability tipping point will change the calculus for custodians of sensitive private information
High profile incidents in 2017 – Equifax, Uber, I’m looking at you – deeply shook the general public. In 2018, that angst will translate into action. Data custodians will be held to significantly higher data security standards. We’ll see more rigorous board and senior management oversight, with severe consequences for security malfeasance. More exacting regulations are already on the way – and they’ll continue to tighten fiduciary expectations and raise the penalties for non-compliance.
Security risk management will change as a result. Executives will find it far more difficult to fob off blame to subordinates. Benchmarks for acceptable risk will change, and the approaches organizations take to manage that risk will change too. Which leads me to my second prediction:
We’ll come to grips with the fact that perfect security isn’t possible
In 2018, data custodians need to be better prepared for cloud breaches and their consequences. Due diligence on configurations, continuous auditing for security best practices, active monitoring, regular red team/blue team exercises, and response plans will be a big part of the security discussion in 2018.
Spotting, fixing, and reporting breaches quickly makes post-breach press conferences far easier on the CEO. Therefore, expect reaction times to get much more attention. This focus on responsiveness, combined with the move to the cloud, will disrupt the IT status quo. Policy-centric perimeter security tools need lots of labor to stay effective and up to date.
Those tools aren’t going away – but tolerance for their labor-intensive maintenance requirements is. The cloud magnifies the problem: DevOps and the drive for ever-faster service delivery velocity makes manual processes simply impossible. Which brings me to my third prediction:
Security automation will get real
DevOps and cloud computing may have started the automation party – but expect security to get in on the action in 2018. In the cloud, automation use cases will expand beyond DevOps to make compliance, detection and configuration management more systematic and robust. Automation will also expand to include incident detection, forensics, and visibility.
Machine learning technologies will power successful automation solutions, and vendors with ML approaches will deliver significant value. Cloud security automation emerged as a theme in 2017 and it will become mainstream next year, with more and more organizations dramatically improving cloud security with automation in 2018. Complexity and the pace of change won’t slow down and there will be broad agreement that convention security tools aren’t right for the cloud.
Cloud service providers (CSPs) will continue to take security – and security automation – seriously. In 2017, for example, Amazon quickly responded to the high risk of AWS misconfiguration and leaky S3 buckets with new services and toolings. In 2018, CSPs will increase their commitment to cloud security. Third-party vendors, working in concert with CSP-native security capabilities, will deliver powerful new solutions to automate and simplify operations across the entire security stack.
Goodbye 2017!
At Lacework, we believe that 2018 will be a watershed year in cloud security. After 2017’s string of shocking breaches, big changes are on the horizon. Risk calculations will shift towards a higher standard of care. IT practitioners will refocus on accountability and responsiveness. And, with any luck, that will translate into a less “eventful” 2018!
