04/16/2021

The Problems, Pitfalls, and Perils of Do-it-Yourself Cloud Governance

By: Tony Karam

The forces pushing organizations toward cloud transformation aren’t easing off; they’re becoming more intense. So is the competition for cloud-native security expertise. The knowledge, processes, and tools that protect legacy IT were developed and honed over decades. In contrast, the move to cloud has been sudden and with little time to create broad institutional knowledge, competency, or comfort. As a result, most organizations are ill-equipped to handle the new security and risk challenges that cloud presents.

How bad are these problems? For starters, 92% of companies now have their cloud credentials for sale on the Dark Web1! At least one cloud breach has afflicted 79% of organizations2. And 37% of all cloud migrations fail because cloud wasn’t part of the business strategy3 to begin with, so a clear cloud risk governance plan was never developed.

Two Options on Cloud Risk Governance

Businesses can take one of two approaches: Do-it-Yourself (DIY) or a Turnkey Solution.

Let’s face it; most organizations start organically with some type of DIY cloud governance. Team A builds a cloud application and then creates policies and controls to govern it. Then Team B builds their cloud application with its own set of policies and controls, and so on. This approach creates a number of shortfalls, including rule gaps, hard-coded controls for each application, and no centralized way to scale cloud governance for enterprise-level visibility and control.

Building enterprise-class cloud security and risk governance in-house can take up to 18 months to develop, test, and deploy. Genuine expertise in cloud tech, security, and risk management is difficult to come by, expensive when found, and hard to retain. Further, the responsibility for resolving regulatory requirements, and creating and maintaining appropriate policies, falls on the organization, as does the need to build and maintain a fully automated cloud governance system. All of which makes the DIY approach to cloud governance much slower, pricier, and riskier.

The right turnkey solution solves many of those problems. Businesses get instant visibility into all their cloud usage without being fluent in cloud technologies. Teams quickly see cloud risks with curated policies and controls, alleviating the need to write and maintain their own. And organizations can govern cloud security and risk at enterprise scale, with a unified and automated platform for defining, detecting, remediating, and reporting on cloud risk.

Concourse Labs’ Innovative Approach

Concourse Labs is setting a new standard for automated cloud security and risk governance, enabling enterprises to scale cloud usage confidently, without slowing innovation. Our pre-built defense-in-depth policies and controls give organizations a single view of all cloud risks in minutes, including hundreds of key risks that other cloud security tools miss. Concourse prevents and continuously controls cloud risk with automated Infrastructure-as-Code analysis, native integrations with existing CI/CD toolchains, and runtime risk assessments. We accelerate risk remediation by delegating responsibility for each application and risk automatically, providing developers actionable guidance to self-service policy violations, and integrating seamlessly with existing ticketing and workflow tools, helping to eliminate problems. And Concourse provides centralized visibility and control so that you can report on your state of cloud risk at any point in time — all while cutting your costs by up to seventy-five percent as compared to doing it yourself.