Ravi Ithal – Why Cloud-Native Requires New Approaches for Data Security

you hello everyone. I'm Ravi ital I'm gonna present today make a case for why Cloud native development requires a new approach to data security. a little bit about myself first My name is Ravi.

I thought co-founder and CTO at normalized. We are a data security company this previously co-founder and Chief Architect at nextcope which is also ordered security company in the now and era when Cloud native was not a term yet and founding engineer at Palo Alto networks as well spent a lot of years and several security engineering development and operation. So have a lot of badgers cars so to say and I have a thing to do today, right?

So let's talk about that. You know, what are we going to talk about today? Two high level sections problem and solution we're going to talk about why data is exploding in the cloud native era some quantitative Trends in the cloud native era about like, you know how the development and some of these Technologies are affecting the data explosion.

We'll do a qualitative analysis of how Cloud native and Legacy are different in this respect and challenges that cloud native development post daily security, then we'll come up with the requirements for a good solution and architecture and what the outcome would be from such a solution. So to begin with pretty much everybody agrees the data is exploding. It's everywhere due to a number of trends.

The important ones are highlighted in red there is a lot of clcd going on infrastructure as code going on and Cloud native app development going on which is the interest of this conversation. Of course. There are also other trends like Ai and ml privacy regulations, which all these are making having a control good control over your data and who can access it more and more important but back to like, you know matter at hand what cloud native is how Cloud native is contributing to this particular problem.

Let's look at some numbers. We are Engineers. We like numbers.

Well, let's start with developers. You know, we are very root of all evil, right? So and there are seven million Cloud native developers, by the way, these numbers are about I think a year or two old.

So this number is probably even higher at this point, but what happened was within a span of about three years the number of developers who call themselves Cloud native more than tripled, right? So that's the that's very important thing to keep in mind. Everybody now wants to do Cloud native development, right?

So it contributes a lot of changes in the environment. Out of this about 6 million are using kubernetes with 60 plus percent increase year over year. And a whopping 61% of backend developers now are using containers.

So when you have a lot of developers using Cloud native Technologies what happens? This is another graph that shows the effect of that which is basically the number of parts for organization. Is growing right?

So this luckily for us it's not exponential but it's growing nevertheless rights over the course of two years it almost doubled from 450 plus to about a thousand parts per organization parts are a proxy for microservices. So you can easily imagine how many more microservices have been churned out every day and what they're doing right? So when these microservices come up, what did they do?

They put they produce data, they create data, they capture data copy and consume data, right? So if you look at the another proxy, which is the total amount of data that's being put out in the cloud and consumed worldwide. This is a chart from 2010 to 2025.

You can see started from two Zeta bytes to 2025. It's going to be about 180 zettabytes. I think it's it's an underestimate but you know, this is the the source that we got.

From studies time 2022, right? So another thing to note is it's not only the the velocity and the volume that is increasing but also the variety here is yet another proxy that we're going to use to say how There is a lot there's a huge variety of data stores in Cloud environments granted like most of the Arts will have they don't custom apps. So they form the long tailors these unique Technologies running on containers.

But if you look at the top 10 container Technologies eight of them Are essentially data stores where it is postgres elasticsearch. Rabbitmq my SQL Mongo Kafka and then there is LCD as well, right? So tons of data could be pii PCI API Keys jail related tokens, you know logout information kept in redis and configuration and hcv and so on right so there is a lot of data being exchanged among all of these.

So what is the upshot of all of this? So if you look at a few numbers, we know that data is increasing. We know that number of micro Services increasing parts of increasing the variety of data is increasing.

So how does this really affect data security which is, you know a topic of my concern as well. So let's look at like in what exactly so qualitatively speaking. What happens when you start developing your applications in Cloud native way as opposed to Legacy Day.

Let's look at the goods and the bads and that leaves right? The Legacy application development starts with provisional. You need a few servers and databases and users are entities.

And so on all of that used to be slow manual provisioning today. What you do you go to your code base like pick up your telephone files edit your, you know, add a new module or maybe add a few lines and apply and you're done right? So you can do fast programmatic conversion that's good.

Like, you know, you can move fast. So instead of having a slow moving model pick application. You have a bunch of micro Services which teams can release independently, which is, you know, part of the reasons why microservices came about But the bad part is of course, there are lots of changes anytime you make a change potentially something can go wrong, right?

It used to be that an application uses a single monolithic data store. You would use a typical rdbm or sortical my SQL or what? Have you put everything there.

Right? But today is world is different each microservice has its own data store. What that means is you have to deal with n number of variety of data stores.

Which is not densely bad by itself. But what used to be one data store fits all now you have a variety. So you need to understand a lot more things that are going on variety of data stores tailored for each microservice, but from understanding the access and what's in it and how do you secure it now?

You don't have a single relationship between the application the database you have an exponential number of potential access relationships between all microservices and the data stores that they all contain. Ideally they all talk to apis, but you know, we don't live in an idea what What else is different so databases themselves used to be self-managed you would you know get a server install your database on it like postgres are MySQL or whatnot but today, you know, it's it's going less and less if you're building in a cloud native and environment. You're probably going to use cloud SQL or RDS which is offered as a service.

You're not really managing that anymore. What is a what does that mean for security? And there used to be agents that you could just install on databases to protect a lot of these accesses but these agents are not always possible pretty much like, you know, not possible at all.

If you're using RDS and Cloud SQL and so on. What does that mean that that means like, you know security still needs to be handled outside. There's a yet another problem because of microservices what used to be slow delivery of analytics and reports now, it's of course like good which is like, you know, you can actually scale your analytics using modern database houses like Snowflake and If it's all bigquery data warehouse, you can call that redshift databricks and so on.

However the data access used to be confined to the one database where you could go and inspect the roles and users and so on but now data is getting proliferated. So access is also getting proliferated. The option of all of this is in the olden golden days.

You could go to Legacy application model take application. You had everything related to data and one place you could be artically manually access it things didn't use to change that often either. So quarterly access would do the job.

Now. We are releasing multiple times a day. You don't even have any agents on your database number of accesses has increased so manual review is impossible.

So where does that leave us? So this creates a lot of challenges for data security if you are in a deficrops or ciso org, these will be the questions that you have on your mind at the protect your data starts with raise my sensitive data. Are there any abandoned data stores?

You know when you create a microservice probably it's scaled to about a million users. Then you wanted to bring in a new data store new microservice. You created that you migrated over the whole database has been abandoned at this point.

Right so you're not using it anymore, but I bet like 99 out of 500 people maybe 100 people don't have the confidence deleted right away. You you're gonna keep it around for a while and the more the More confidence you get to delete that data store the less you remember about it, right if you think about it. So so what happens is after a couple of months.

It's just sitting there, you know, waiting for one misconfiguration to expose all your data then entire world, right? So that's a nightmare for livescorps and seesawork. Are there any Shadow data stores that developers are using maybe you created a new surveys you're doing say maybe testing you're slowly bleeding in taking those requests, but it's not even reviewed yet.

So those shareit stores nevertheless contain customer data pi and any amount of data that could be deemed sensitive. And that's just the discovery and classification of data, but who can access my data are there any excessive privileges because of all of this? Is there any risk of breach am I complying with regulations and so on these are usually the data security questions that arise ultimately data security is to the goal of data security is to prevent data breaches.

So these questions have been answered in the past in the Legacy world with data Discovery Solutions classifications Solutions. Access governance privilege access management risk management one of the management and compliance tools, right but they're just getting exactly because of the explosion and number of microservices number of data stores amount of accesses and so on. So the solution the current solutions that exist offer siled coverage meaning depending on what your use cases and where the location of the data is you end up with a mess of solutions that you need to choose from probably hundreds of vendors.

Make sure they are interoperate make sure you integrate them well and you need to maintain all of them, right? For example, let's say, you know, let's take past databases. There is no access governance today like in there is no access governance product.

You pretty much doing it manually if you take as block storage, you can probably discover all your S3 buckets and Azure blobs with a cspm but for classification, you're gonna have to use a yet another product practice governance use yet another product risk and relative management. You come back to cspms compliance for privacy helps so you can imagine if just for Block storage you have to deal with four products you can imagine All locations where your data exists and you know how many products you need and how much work it is to interrupt and into their development. So what does a real ideal holistic solution look like it should cover all these use cases.

It should tackle past databases as databases. I has block storage as file storage and it should be able to discover all the data stores classify all the data figure out who has access to it figure out all the risks and help you with compliance, right? So here are the capabilities, right?

So let's let's just list all the things that we know that we need from these Solutions first step is visibility, right? So you need visibility into all your data stores users identities access and so on. So it's scattered throughout the cloud, you know, Cloud native environment these things change on an hourly basis if not faster.

So first step is you need to make sure at any given point in time. You have an inventory of all your data assets and data accessors. Second step is to figure out a classification among all of this data.

You want to be able to quickly to what type of data you have where with services are using what without manually reviewing in mind it right? So let's say there's an intern that decides to duplicate a column in a new experimental feature. Your data visibility and classification caps should catch it within a few minutes, you know near real time.

Right? And of course like in the hopes of doing this you don't want to hand over all of your data to a third party. So it should do it with privacy and data residency in mind.

The next step is to figure out the data flow and data access flow is actually the real access of data by individual entities like users and services and so on access is basically who has configured access to it both are important because the difference between those two is what is going to allow you to achieve a principle of least privilege right by taking your taxes from those who don't need it. Lastly you need to figure out what type of risks and policy violations are there in your environment. So if you combine all of these what happens is you can figure out where there is are and whether it's really being accessed and exposed to the outside world.

And what type of data is at stake. So you have all of this visibility in any real time basis, right? So that is the fundamental capability that you need.

But you also need other items. We have we live in a cloud native world. So the solution that you use for monitoring your Cloud native data should also be Cloud native.

So to say right number one that we already mentioned is data residency in privacy. You should not take the data out of let's say your German Data Center and then bring it to us. For example, are you to us to South America and so on each the classification and Discovery should happen with the data exists and not outside of that.

Second is cloud neutrality a lot of Enterprises and even made Market companies have more than one Cloud so you don't want to go and you know deploy multiple solutions for multiple clouds a single solution should work with any public cloud. Third is programmability. Why is this important?

And so provisioning should not be a matter of like, you know going somewhere and onboarding clicking on a bunch of things you should be able to do all of this with apis, of course, like, you know, if you have a UI, that's fine. But you know having apis and terraform modules are the way to go because as you scale your infrastructure, you can actually scale the deployment of these Security Solutions as well extensibility is having apis to be able to integrate additional functionality bring in additional data and so on elasticity, like I mention, you know, the solution should scare the rest of so if you so what would be a good approach to actually satisfy all those requirements. I have a proposal, right?

So that we call this the cloud native data first opposed to Cloud due to infosec what that means is you start with the data, which is your most valuable asset. And then figure out everything around it. So if you have an MVP to protect you identify MVP first and then build your secret service dog, you don't build a secret service to protect the entire country or a city and then figure out who you're MVPs, right?

So first step is to identify your most important asset. Um, then being able to continuously discover and analyze your environment to get a full picture of all your data stores data elements classification of them applications identities infrastructure how they interact the network relationships. I am relationships and so on right so you need that data warehouse or a graph of all of this so that you can detect issues.

Like for example, in this case. Let's say a datastore contains pii That is accessible to let's say another compute instance through an IAM profile. That I am profile is also accessible by a user who is considered risky because maybe he hasn't enabled MFA for his login, right?

So you should be able to make those correlations very quickly using this graph or a warehouse if you will, right so automatically detect those issues and prioritize because you know, what, Ultimately the point of info circuits to protect data so you can prioritize based on what is at stake rather than what the likelihood of just the likelihood of the issue is. Ultimately, it should. Help you remediate and prevent as well.

It should work with AWS gcp Azure or any number of clouds oci IBM Cloud HP sap, and so on all types of data stores starts with like, you know, data warehouse large databases redshift snowflake databricks all the way down to sequels my Sequel and you know radiation so on right so that's a very high level approach. How would you actually build such a such a thing? So I have a proposal for that as well.

So here is how an architecture for such a solution would look like at the center. I would have a cloud InfoCision graph. With an open API, why do you need an open API so that it's programmable and extensive extensible?

You should be able to let's say bring in your quality scans into this graph or you have yet another product that maybe you build or maybe something that you built in house you bring the information from that into this graph as well. Right? So you should be able to like, you know have bring information into the graph connect those notes of information with edges that are relevant that that really identify the relationship between those information and so on right?

but the solution should also allow for agent less scanning agent less important the cloud native world because you know, you don't always get to put agents on your workloads. Sometimes these are offered our services and so on it should be able to do discovery of all your data stores and assets. It should be able to detect your sensitive data.

It should be able to analyze your network. I am privileges DB privileges analyze all of them and draw edges between the notes in the graph. So with this what you'll be able to do is discover classify identify your sensitive data discover all the compute permissions and who has access to what discover all your packages associate them with compute instances.

Maybe there are the modules like, you know, polarity assessment misconfiguration assessment and so on they all become part of this their house of graph what that allows you to do is you can make queries on this graph that will give you answers to questions like who has sensitive date which data stores have sensitive data who can access it. What are the types of risks Iran with this right and ultimately the results of those queries you should be able to you know, each of those might be a risk item or an attack path to get to that data. You should be able to prioritize because the system should tell you what type of data is at stake.

So the outcome would be something like this, right so data breach attack Parts the continuously identified. You can visualize them you can prioritize them because you know, what is at stake. It should be programmable extensible.

So ultimate outcome is that you get the highest return investment for any amount of time that you put in in a product like this, right? So that's that's really the point of all of this if your goal is to protect your data. the your data security program should adapt to how the applications are built which is changing to the cloud native way of doing things which You cannot like do manual review of anymore.

So you need to automate all of this and a solution like this would actually let you do that and bring the highest Roi for all the efforts that you put in right? So that is my you know case that I'm trying to make lastly a self plug try our freemium. We've been trying to build this at normalized to make quite a bit of progress go to https.

ai. You'll be able to read us read about what we are doing and also sign up for a freemium trial.