At the AWS Summit in Sydney 2024, Peter James, IT Operations Director at amaysim, and Matt Preswick, Enterprise Solution Engineering at Wiz, shared their expertise on enhancing cloud security operational efficiency. The session highlighted amaysim’s journey to modernize their cloud security and the adoption of new cloud security operational models to keep pace with emerging threats.

The Evolution of Cloud Security

Securing cloud environments against evolving threats is paramount in today’s fast-paced digital landscape. Peter James emphasized the complexity of amaysim’s cloud infrastructure, explaining, “We were fast adopters of cloud technology, but we weren’t born in the cloud. Our infrastructure spans many technologies, from traditional monoliths to modern serverless architectures.” This diverse infrastructure presents unique security challenges, which amaysim addresses by leveraging advanced tools and methodologies.

Matt Preswick introduced the concept of Cloud Native Application Protection Platforms (CNAPPs), explaining their evolution from traditional Cloud Security Posture Management (CSPM) tools. “CNAPPs represent the next generation of cloud security, integrating misconfiguration detection, vulnerability management, and identity security into a cohesive platform,” he said. This integrated approach helps organizations manage cloud environments’ complex and dynamic nature more effectively.

Preswick further elaborated on the need for this evolution, stating, “The cloud has fundamentally changed the way we operate. We’ve moved from self-hosted environments to a shared responsibility model, introducing new risks and complexities. CNAPPs are designed to address these challenges by providing comprehensive visibility and control across multiple cloud services.” He noted that traditional CSPM tools often failed to provide the context and prioritization needed to manage today’s sophisticated cloud threats.

James shared practical insights from amaysim’s journey, highlighting the benefits of adopting CNAPPs. “With the rapid pace of change in our cloud environment, we needed a solution that could keep up. CNAPPs have enabled us to not only identify vulnerabilities but also understand their context and impact, allowing us to prioritize our efforts more effectively,” he said. This shift has been instrumental in improving operational efficiency and reducing the time to remediate security issues.

The discussion also touched on the importance of continuous improvement in cloud security practices. “Security is not a one-time effort; it’s an ongoing process,” James emphasized. “As our cloud environment evolves, so too must our security strategies. By leveraging CNAPPs and other advanced tools, we can stay ahead of emerging threats and ensure that our security posture remains robust.”

Preswick underscored the collaborative nature of modern cloud security, noting that integrating various security functions into a single platform fosters better team communication and coordination. “CNAPPs break down silos between different security functions, enabling a more holistic approach to cloud security,” he said. “This collaboration is crucial for identifying and addressing threats in a timely manner.”

In conclusion, the evolution of cloud security is a response to the increasing complexity and dynamic nature of cloud environments. By adopting advanced tools like CNAPPs and fostering a culture of continuous improvement and collaboration, organizations can effectively manage their security risks and protect their digital assets in an ever-changing landscape. “The future of cloud security lies in integrating comprehensive, context-aware solutions that empower teams to work together seamlessly,” Preswick concluded. “This approach not only enhances security but also supports the agility and innovation that cloud technologies enable.”

Amaysim’s Cloud Security Strategy

Amaysim’s cloud journey is characterized by a proactive approach to security aimed at integrating best practices into every aspect of their operations. “Our rate of change is immense, with up to 200 production releases a month,” Peter James noted. “This rapid pace necessitates a security strategy that can keep up with our dynamic environment.” To address these challenges, amaysim prioritizes and curates security alerts to ensure critical issues are addressed promptly without overwhelming their engineering teams. “We don’t want security to be a blocker,” James emphasized. “Our goal is to integrate security into our development processes seamlessly, ensuring that our engineers can continue to innovate without being hampered by unnecessary roadblocks.”

One of the key aspects of amaysim’s strategy is the use of Wiz’s Cloud Native Application Protection Platform (CNAPP). “The agentless approach of Wiz was crucial for us,” James explained. “It allowed us to gain real-time insights into our environment without the overhead of managing additional agents.” This approach was particularly beneficial during high-profile security incidents like the Log4Shell vulnerability. “When Log4Shell emerged, we were able to use Wiz to quickly assess our exposure and prioritize our response efforts, significantly reducing the time and effort required compared to our previous manual processes,” he added.

Amaysim’s strategy also emphasizes the importance of context in managing security risks. “It’s not just about identifying vulnerabilities; it’s about understanding their context and potential impact,” James said. “For example, a vulnerability in an EC2 instance might seem critical, but if it’s not publicly exposed or doesn’t have access to sensitive data, the risk is lower. Wiz helps us make these distinctions and focus our efforts where they are most needed.”

The company also leverages Wiz to foster a collaborative security culture. “We believe that security is everyone’s responsibility, not just the security team’s,” James stated. “By providing our engineers with the tools and insights they need to understand and address security risks, we empower them to take ownership of security in their workflows.” This approach aligns with amaysim’s broader goal of integrating security into the fabric of their development processes.

James highlighted the role of continuous learning and adaptation in their strategy. “The cloud environment is constantly evolving, and so must our security practices,” he said. “We regularly review and update our security policies and tools to ensure they remain effective in the face of new threats.” This proactive stance helps amaysim stay ahead of the curve and maintain a robust security posture.

In addition to leveraging advanced tools, amaysim places a strong emphasis on building a security-conscious culture within the organization. “Culture is a huge part of what we do,” James remarked. “We strive to create an environment where security is seen as an enabler rather than an obstacle. By involving engineers early in the security process and using tools that they find helpful, we ensure that security is integrated seamlessly into our development practices.”

James also discussed the importance of scalability in their security strategy. “As our cloud infrastructure grows, so too must our security capabilities,” he said. “Wiz’s ability to scale with us has been invaluable. It provides the visibility and control we need to manage our expanding environment effectively.” This scalability ensures that amaysim can maintain high security standards even as their operations evolve.

In conclusion, amaysim’s cloud security strategy is built on a foundation of proactive risk management, continuous improvement, and a collaborative culture. By leveraging advanced tools like Wiz’s CNAPP and fostering a security-conscious environment, amaysim effectively addresses the challenges of securing a dynamic and complex cloud infrastructure. “Our approach is all about enabling innovation while maintaining robust security,” James concluded. “With the right tools and culture in place, we can achieve both.”

Embracing a Collaborative Security Culture

A critical element of amaysim’s success in cloud security is fostering a collaborative culture between security and engineering teams. “We firmly believe that engineers should own their code all the way through to production,” Peter James stated. “By involving engineers early in the security process and using tools that they find helpful, we ensure that security is seen as an enabler rather than a hindrance.” This philosophy underscores the importance of integrating security into the development lifecycle, making it a shared responsibility rather than a siloed function.

James highlighted the value of early engagement with engineers in the tool selection process. “When we consider introducing a new security tool, we involve our engineers from the outset,” he explained. “Their feedback is crucial in ensuring that the tools we implement are not only effective but also user-friendly. This early involvement helps build buy-in and ensures smoother adoption across the organization.” By prioritizing user experience, amaysim creates a more supportive environment for thriving security practices.

Matt Preswick from Wiz echoed this sentiment, emphasizing the need for security tools to be seen as aids rather than obstacles. “It’s important that security solutions integrate seamlessly into existing workflows,” Preswick said. “When engineers see these tools as helpful rather than hindering, they are more likely to embrace them. Our goal at Wiz is to provide actionable insights that developers can use to enhance security without disrupting their work.” This approach fosters a partnership between security and engineering teams, enhancing overall effectiveness.

The collaborative culture at amaysim is further reinforced through continuous education and communication. “We regularly hold training sessions and workshops to keep our teams updated on the latest security threats and best practices,” James noted. “This ongoing education helps ensure that everyone is aware of the current security landscape and understands their role in maintaining our defenses.” These initiatives help create a continuous learning and improvement culture, essential for staying ahead of evolving threats.

James also stressed the importance of clear and open communication. “Transparency is key to building trust between security and engineering teams,” he said. “We make sure that our security policies and decisions are well-communicated and that there’s always an open channel for feedback and discussion.” This openness helps demystify security processes and encourages a collaborative approach to problem-solving.

Preswick added that the collaborative model extends beyond internal teams to include external partners and vendors. “The security landscape is constantly changing, and it’s crucial to work together with external experts to stay ahead,” he said. “By collaborating with vendors like Wiz, organizations can leverage specialized knowledge and tools to enhance their security posture.” This partnership model ensures that amaysim can access cutting-edge technologies and insights, further strengthening their defenses.

In conclusion, embracing a collaborative security culture is a cornerstone of amaysim’s cloud security strategy. By involving engineers early in the process, prioritizing user-friendly tools, and fostering continuous education and open communication, amaysim creates an environment where security is a shared responsibility. This approach enhances security and supports innovation and agility within the organization. “Our collaborative culture is what sets us apart,” James concluded. “It allows us to integrate security seamlessly into our operations and empowers our teams to build secure, high-quality software.”

Preparing for the Future

Looking ahead, amaysim plans to integrate security into their development workflows further, ensuring that security considerations are embedded from the earliest stages of the development process. “We aim to introduce more preventative measures and guardrails in our deployment pipelines,” Peter James explained. “This will allow us to catch security issues early in the development process, reducing the risk of vulnerabilities making it into production.” Amaysim hopes to create a more robust and proactive security posture by shifting security left.

James emphasized the importance of continuous improvement and adaptation in their strategy. “The cloud environment is constantly evolving, and so must our security practices,” he said. “We regularly review and update our security policies and tools to ensure they remain effective in the face of new threats.” This proactive stance helps amaysim stay ahead of the curve and maintain a robust security posture.

Amaysim also plans to leverage emerging technologies to enhance its security capabilities. “We are exploring the use of AI and machine learning to automate threat detection and response,” James noted. “These technologies have the potential to significantly improve our ability to detect and respond to security incidents in real-time.” By embracing cutting-edge technologies, amaysim aims to stay at the forefront of cloud security innovation.

In addition to technological advancements, amaysim is committed to fostering a culture of continuous learning and development. “We are investing in ongoing training and development programs for our security and engineering teams,” James said. “By keeping our teams up-to-date with the latest security trends and best practices, we ensure that they have the knowledge and skills needed to protect our cloud environment effectively.” This focus on education and development is crucial for building a resilient and adaptable security team.

Matt Preswick from Wiz highlighted the importance of collaboration in preparing for future challenges. “The security landscape is constantly changing, and it’s crucial to work together with external experts to stay ahead,” he said. “By collaborating with vendors like Wiz, organizations can leverage specialized knowledge and tools to enhance their security posture.” This partnership model ensures that amaysim can access cutting-edge technologies and insights, further strengthening their defenses.

Amaysim’s future plans also include a greater emphasis on regulatory compliance and risk management. “As regulations around data privacy and security continue to evolve, we are committed to staying compliant and managing risks effectively,” James stated. “This involves not only adhering to current regulations but also anticipating future requirements and preparing accordingly.” Amaysim aims to mitigate compliance risks and protect its customers’ data by staying ahead of regulatory changes.

In conclusion, amaysim’s forward-looking strategy involves integrating security more deeply into their development processes, leveraging emerging technologies, fostering a culture of continuous learning, and maintaining strong collaboration with external partners. These efforts aim to create a resilient and adaptive security posture that can effectively address the challenges of an ever-evolving cloud environment. “Our goal is to stay ahead of emerging threats and ensure that our security practices evolve with the changing landscape,” James concluded. “By doing so, we can protect our cloud infrastructure and continue to deliver high-quality, secure services to our customers.”