Cloud Native Application Protection Platforms (CNAPPs) have emerged as a critical category of security tooling in recent years due to the complexity of comprehensively securing multi-cloud environments, according to Cloud Security Alliance.
Secure cloud computing environment
Much of CNAPPs popularity has been driven by their ability to consolidate the capabilities of the numerous security tools organizations current deploy, namely Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and Cloud Infrastructure Entitlement Management (CIEM), network security, and secure DevOps.
“When considering the challenges facing today’s businesses, people and technology take center stage. On one hand, companies need to bolster the workforce with well-trained security professionals who understand their roles and responsibilities. On the other hand, there’s a pressing need for effective technology and tooling that both addresses the rapidly evolving landscape of cybersecurity threats while effectively supporting security teams,” said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance.
“It’s clear that today’s multi-cloud environments are increasingly complex, and enterprises must find ways to comprehensively address their security posture,” Baron continued.
“Many traditional security solutions still in use today just aren’t capable of adequately protecting increasingly dynamic and distributed multi-cloud strategies. As organizations navigate their path in the cloud, it’s imperative that they leverage solutions that offer an integrated approach to security. In doing so, they can better prepare themselves to handle the complex cybersecurity challenges of today and the future,” said Adwait Joshi, Director of Cloud Security product marketing at Microsoft.
Securing multi-cloud environments
Cloud native application protection platform
Three out of four organizations opt to use CNAPP to protect their multi-cloud environment. 75% of organizations have implemented or planned to implement CNAPPs in their cloud environments. One of the driving factors behind this move is the prevalence of multi-cloud strategies—84% of organizations reported utilizing two or more cloud environments.
Cloud security posture management
Security teams are demanding clear-cut information for proper prioritization. A flood of security alerts has made it difficult for security teams to manage and prioritize security enhancements.
32% of respondents disclosed that they’re struggling with prioritizing security improvements due to the overwhelming—and often incorrect—information they receive. Moreover, 34% find themselves buried under security recommendations, while an equivalent percentage lacks contextual or actionable insights to make informed decisions.
DevOps security
Despite growing recognition the importance of DevOps security, expertise and talent shortages are hindering progress. Despite the trend toward shift-left security and DevSecOps, the incorporation of robust security measures within DevOps is still in its early stages, with significant obstacles hindering full integration.
Currently, 51% of organizations are in the process of integrating security into their DevOps practices, with only 35% reporting complete integration. The primary challenges include lack of security expertise (46%), insufficient automation (43%), an excessive number of false positives (42%), and lack of actionable feedback (42%).
Cloud workload protection
Challenges around incident response come back to people, process, and technology. The lack of manpower was identified as a significant challenge by 25% of respondents; an absence of formal response plans was reported by 29% of organizations; and 39% reported the lack of automation as a key challenge.
Network security
The most mature implementation, yet threat detection remains a challenge. Network security, out of all the categories, was the most mature. 43% of respondents reported full integration in a multi-cloud environment for network security, compared to just 28% CSPM.
While the growing popularity of zero-trust strategies may be a key driver behind this level, organizations are still facing key challenges in network security, particularly concerning threat detection and the management of a large volume of security alerts.
Cloud infrastructure entitlement management
Misconfigurations top concern with permissions. 43% of organizations identified misconfigurations of permissions as their top concern. This prevalent issue can have serious repercussions, potentially leading to unauthorized access and even catastrophic data loss.
Misconfigurations can inadvertently expose sensitive data or grant unnecessary privileges, creating openings that could be exploited by malicious actors.