Cloud Security Posture Management (CSPM)

In today’s increasingly sophisticated and fragmented business environment, we are all increasingly interdependent on “other people’s computers.” From Gmail, to Software as a Service (SaaS), to web hosting - we are interconnected in profound and tangled ways.

Cloud Security Posture Management is about securing every place and every way we connect online. As a fast-growing and increasingly critical part of online security CSPM maintains, controls, and secures every site where our corporate assets or personnel rely on externally-hosted software, data, or processes. For example, a retail site using a PayPal hosted payment module needs to secure the connection for customers its own website and on PayPal, without violating the customer’s right to privacy and ensuring that the payment is processed successfully.

The interface between your own identity system (IAM) and the third party site is a vector of attack for hackers, who seek to interpose themselves between your traffic and its cloud destination in search of salable credentials. Robust CSPM is essential for a company seeking to do business online. Customers, partners, and employees need to know that their passwords and identities will not be stolen because the company didn’t invest in an adequate CSPM system.

KeyData is an expert and industry leader in the field of CSPM. With our technology partners we can create the bespoke system that’s best for you, your staff, your clients, and your business.

1. IAM Best Practices: we are recognized for our industry leading IAM/CIAM “Best Practices”, success in complex systems integrations, including cloud integrations, and excellence in customer satisfaction.
2. CSPM Experience: We understand how to use cloud applications and networks effectively, while limiting security risks leveraging IAM. We have extensive experience implementing the following capabilities to ensure organizations data in the cloud is protected and secure:
   • Authentication: KeyData has implemented strong authentication methods for access to systems and data in the cloud, including Multi-Factor Authentication (MFA), Strong/Single Sign-On (SSO), certificate-based authentication, and other risk-based authentication methods, across multiple clients and based on each client’s unique requirements and business appetite.
   • Authorization: We are well versed in implementing correct authorization workflows to ensure users have the capability to perform only the tasks they are permitted to perform based on their roles at the organization.
   • Access controls: KeyData has extensive experience in implementing coarse- and fine-grained access controls and permissions, to ensure users are correctly using services they are authorized to use, and nothing more.
   • Governance, Risk Management, and Compliance: we have helped numerous organizations manage credentials securely using access control policies and access right delegations.
3. Complex IAM integrations experience: We have successfully performed multiple complex IAM cloud integrations for clients. We understand the requirements associated with cloud integrations, and how to keep data on the cloud secure, using IAM Best Practices.

If it is difficult to assess your organization’s cloud security posture, conducting a cloud security assessment is the first step. KeyData has an excellent track of record in IAM, CIAM, and PAM in cloud environments based on leading practices as well as relevant compliance frameworks. We understand that each organization has different priorities and may follow unique standards depending on the industry. As such, we build our assessments based on relevant frameworks for our clients, including but not limited to the following:

• National Institute of Standards and Technology (NIST): provides a comprehensive framework for information security controls for both on-prem and cloud-hosted infrastructure with an extensive list of special publications on identity and access security, including security of industrial control systems (NIST SP800-82)
• International Organization for Standardization (ISO) 27001: outlines an international management framework for implementing information security within an organization. ISO has also published a control-based standard known as ISO/IEC 27002 which details the controls required from an implementation perspective
• North American Electric Reliability Corporation (NERC): assists North American organizations involved in the bulk electric power systems industry to assess and implement a cybersecurity program. Relevant NERC-published standards include CIP-002 through CIP-014
• Payment Card Industry Data Security Standard (PCI DSS): guides organizations across the globe in implementing security controls and policies that protect the integrity and confidentiality of financial transactions (e.g., credit, debit, and cash card transactions) as well as cardholders’ privacy
• Health Insurance Portability and Accountability Act (HIPPA): provides U.S. security requirements that protect health-related information, including the privacy of consumers. This is relevant for all clients in the healthcare and sciences sector in North America. For stakeholders in Ontario, Canada Personal Health Information Protection Act, or PHIPA, provides similar set of security standards.

By following established standards and leveraging our deep expertise in the industry, we’re able to apply leading practices and recommendations consistently for our clients, and can assist you in measuring the maturity of your enterprise and cloud security program regardless of the maturity model you prefer to follow (e.g., Cybersecurity Maturity Model Certification (CMMC), Cybersecurity Capability Maturity Model (C2M2), Information Technology Infrastructure Library (ITIL) Maturity Model, etc.)

1. https://www.identitymanagementinstitute.org/identity-and-access-management-for-cloud-security/
2. https://auth0.com/learn/cloud-identity-access-management/
3. https://technologyadvice.com/blog/information-technology/advantages-of-software-as-a-service-saas-2/