2024-04-22 12:10
In the sprawling cloud infrastructure of GlobalTech Inc., a meticulously planned ransomware attack was set in motion by a sophisticated adversary, codenamed Vector. Vector’s objective… Read More
Blog Directory > Technology Blogs > Sonrai Security technology Blog >
Sonrai Security Blog
sonraisecurity.com/blog
Tags:
permission
cloud
cloud permissions
cloud permissions firewall
lambda function
privilege
mitre attampck framework
bad actor
lateral movement
function
Sonrai Security delivers an enterprise identity and data governance platform for AWS, Azure, Google Cloud, and Kubernetes. The Sonrai Dig platform is built on a sophisticated graph that identifies and monitors every possible relationship between identities and data that exists inside an organization’s public cloud. Dig’s Governance Automation Engine automates workflow, remediation, and prevention capabilities across cloud and security teams to ensure end-to-end security. Our blog shares expert advise for DevSecOps, DevOps, Cloud Security, and Cloud teams. For more information, visit https://sonraisecurity.com/
2024-04-10 12:59
Sonrai recently launched the first-ever Cloud Permissions Firewall – a new class of solution built to more efficiently protect sensitive permissions and access.
A new solution… Read More
2024-04-02 08:50
Dear Community,
The inspiration behind our groundbreaking solution, the Sonrai Cloud Permissions Firewall, stemmed from a critical gap in the market: managing cloud permissions had become… Read More
2024-03-19 14:54
MITRE ATT&CK Stage: Exfiltration and Impact
This blog is the final publication in a series exploring the most powerful cloud permissions and how they map to the MITRE ATT&CK Frame… Read More
2024-03-05 15:50
MITRE ATT&CK Stage: Defensive Evasion
This blog is the fifth publication in a series exploring the most powerful cloud permissions and how they map to the MITRE ATT&CK Framework… Read More
2024-02-20 15:30
MITRE ATT&CK Framework: Credentials Access
This blog is the fourth publication in a series exploring the most powerful cloud permissions and how they map to the MITRE ATT&CK Frame… Read More
2024-02-06 15:59
MITRE ATT&CK Framework: Lateral Movement & Privilege Escalation
This blog is the third publication in a series exploring the most powerful cloud permissions and how they map to th… Read More
2024-01-23 15:07
MITRE ATT&CK Framework: Persistence
This blog is the second publication in a series exploring the most powerful cloud permissions and how they map to the MITRE ATT&CK Framework. I… Read More
2024-01-10 15:38
MITRE ATT&CK Framework: Initial Access
A cloud permission is never a dangerous thing by nature. In fact, their power is solely defined by the context in which they are used. Whether a… Read More
2024-01-04 17:53
Approximately 10% of the identities in your cloud have full admin permissions – enough permission to ‘delete’ your cloud1 Read More
2023-12-18 14:30
Governance, security and compliance become difficult projects at scale. If you’re an enterprise operating out of Google Cloud, you’re likely looking for ways to manage access, en… Read More
2023-12-13 16:40
Amazon Web Services (AWS) S3, or Simple Storage Service, is a highly scalable object storage service that allows businesses to store and retrieve any amount of data. S3 permissions are the e… Read More
2023-12-07 13:11
What is Azure Policy? Azure Policy is a service within Microsoft Azure that allows organizations to create, assign, and manage policies. These policies define rules and effects over reso… Read More
2023-12-04 15:10
The cloud is all about innovation at a speed never before possible. This can often lead to rapid development sprints and a proliferation of identities and infrastructure – and with tha… Read More
2023-11-15 17:00
Don’t know where to start? Feeling stuck in your goal to secure cloud identities?
We have a simple strategy we guide customers through at Sonrai. It is built to reduce cloud identit… Read More
2023-11-06 14:13
Good security has long been about creating a barrier to entry. It’s been about ‘keeping them out.’ The spotlight, attention, and budget, has been dedicated to that pivotal… Read More
2023-10-25 11:29
Reading Time: 6 minutes
After months of offering our Cloud Identity Diagnostic – a report detailing what identity and privilege risks are leaving organizations vulnerable to data brea… Read More
2023-10-16 14:17
Reading Time: 6 minutes
Sonrai Security hosted the inaugural ACCESS: The Cloud Identity, Access, and Permissions Summit this October. The ACCESS Summit is a free, virtual, and learning-base… Read More
2023-10-13 17:34
Reading Time: 5 minutes
Multi cloud identity management (IAM) is an increasing reality as a majority of enterprises head towards two or more operating clouds. As businesses expand their clo… Read More
2023-10-10 13:17
Reading Time: 8 minutes
You can’t wait to buy a Cloud Infrastructure Entitlements Management (CIEM) solution.
Yes, we mean you can’t wait as in time is of the essence a… Read More
2023-10-03 19:53
Reading Time: 6 minutes
The extensive set of AWS services and resources can make it challenging to manage permissions effectively. Given the substantial variations in use cases and necessar… Read More
2023-09-26 13:09
Reading Time: 7 minutes
What criminal wouldn’t take advantage of a pair of house keys left lying around a cafe table? Those keys give entryway to your home, any valuable possessions i… Read More
2023-09-20 14:29
Reading Time: 5 minutes
So you just bought or renewed with Wiz – well done on kicking off your cloud security journey.
Cloud security is a multi-pronged program, requiring protecti… Read More
2023-09-06 13:33
Reading Time: 8 minutes
Everyone’s goal is the same: protecting enterprise data and resources from malicious attack or exposure. The most efficient way to accomplish that is by managi… Read More
2023-08-30 11:49
Reading Time: 7 minutes
So you’ve identified your most critical assets. You know your super users. Your highest privileged identities. You know the applications that are the backbone… Read More
2023-08-29 14:21
Reading Time: 6 minutes
Amazon Web Services (AWS) stands out as a powerful platform that empowers businesses to scale, innovate, and achieve their goals efficiently. However, cloud compu… Read More
2023-08-22 13:11
Reading Time: 7 minutes
Granting and Denying Access: Identity-Based Policy Vs. Resource-Based Policy
Identity and Access Management (IAM) policies play a pivotal role in controlling acce… Read More
2023-08-16 13:23
Reading Time: 6 minutes
A cloud security risk assessment is an analysis of an organization’s cloud infrastructure to determine its security posture. This is a critical process for any… Read More
2023-08-08 14:43
Reading Time: 4 minutes
TechTarget’s Enterprise Strategy Group released a new report detailing why proper management of identity and access is critical to reducing cloud security risk… Read More
2023-08-01 12:07
Reading Time: 6 minutes
While exploiting identities and privilege isn’t always the way into an enterprise cloud, it is always involved in malicious data access or a cloud takeover. Im… Read More
2023-07-28 16:05
Reading Time: 7 minutes
If you’re reading this, you might be considering a cloud security solution – maybe an identity and permissions-focused one – maybe even Sonrai… Read More
2023-07-25 14:40
Reading Time: 8 minutes
CIEM vs. PAM: Know the Differences in the Cloud Identity Solutions
With so many varying environments – cloud, on-premises, and hybrid – and numerous s… Read More
2023-06-28 17:12
Reading Time: 7 minutes
Let’s establish the problem: practitioners are experiencing alert fatigue – desensitized, overwhelmed, and unable to manage the sheer scale of cloud secu… Read More
2023-06-22 18:05
Reading Time: 6 minutes
TAG Cyber and Sonrai Security have partnered to share a perspective on securing your cloud and your most critical business assets. The rapid adoption of cloud com… Read More
2023-06-20 13:54
Reading Time: 9 minutes
Financial Services Compliance
Any business in the financial services industry faces stringent compliance standards and regulations. Financial services includes in… Read More
2023-06-19 13:09
Reading Time: 6 minutes
When it comes to insufficient cloud security measures, organizations are unaware of the danger they face. Perhaps their organization migrated to the cloud and brough… Read More
2023-06-13 16:43
Reading Time: 4 minutes
Identity management has taken on an entirely new level of criticality when we evaluate it in the context of cloud environments. In fact, identities are the single… Read More
2023-06-08 14:44
Reading Time: 4 minutes
Data. The most fundamental construct of the enterprise today. We collect it from our customers. We buy it from third parties. We aggregate it in our data stores… Read More
2023-06-06 19:33
Reading Time: 7 minutes
Mastering Cloud Security Audits: Your Ultimate Checklist & Steps
A cloud security audit is an assessment of whether a cloud environment’s security is… Read More
2023-05-30 16:21
Reading Time: 6 minutes
9 Common IAM Risks and How To Mitigate Them
If Identity and Access Management is on your mind, you’re not alone. Recognizing a weak point and seeking out st… Read More
2023-05-25 13:12
Reading Time: 7 minutes
Cloud Compliance & Passing Audits
Knowing (1) what and who’s in your cloud, (2) what they can access and (3) what they can do, is the underpinnings o… Read More
2023-05-23 13:30
Reading Time: 4 minutes
One of the most common security management objectives we hear every day in our advisory work at TAG Cyber involves enterprise teams trying to prevent malicious attac… Read More
2023-05-22 13:20
Reading Time: 6 minutes
The Shared Responsibility Model in the Cloud
Gartner predicts that through 2025, 99% of all cloud security failures will be the customer’s fault. A statisti… Read More
2023-05-17 13:14
Reading Time: 2 minutes
Sonrai’s Guide to Cloud Security Compliance Pain Points
Passing audits and meeting compliance standards is a beast any enterprise with good security &lsq&hell…Read More
2023-05-04 16:48
Reading Time: 4 minutes
Meeting cloud compliance standards and passing audits is the pain point every enterprise has, but no one wants. Compliance frameworks do right by your enterprise… Read More
2023-04-03 14:50
Reading Time: 4 minutes
This is part 2 from a previous blog, “More Cloud Identities, More Problems’, available here.
In the first part of this blog, I addressed the reality t… Read More
2023-03-27 13:25
Reading Time: 4 minutes
It’s no secret large enterprises are struggling to manage cloud identities. In fact, 84% of organizations faced an identity-related security breach in the past… Read More
2023-03-21 14:45
Reading Time: 5 minutes
You’ve got identity blindspots in your cloud. It’s inevitable. But how did we get there? And what are these blindspots?
The enterprise departure fr… Read More
2023-03-13 16:49
Reading Time: 4 minutes
Your Cloud Can Be Deleted At Any Moment
This blog is the final piece of a three-part series. The series begins here.
As jarring as it sounds, your cloud… Read More
2023-03-09 14:22
Reading Time: 5 minutes
You ‘Shifted Left’ off a Cliff
This blog is the second piece of a three-part series. The first blog is available here.
Your organization has shifte… Read More
2023-03-07 14:09
Reading Time: 4 minutes
Are You Feeling Cloud Security Imposter Syndrome?
The typical cloud is likely less secure than an organization believes it is, and that is because most security p… Read More
2023-03-06 15:17
Reading Time: 5 minutes
Vulnerability management is nothing new to the cybersecurity world, but the paradigms, practices and solutions built for on-prem management are not holding up in the… Read More
2023-03-02 20:18
Reading Time: 5 minutes
Lessons from the LastPass Breach
Below we’ll detail the latest LastPass incident, discuss the implications of this attack, and finally recommend how o… Read More
2023-01-18 14:22
Reading Time: 6 minutes
“Cloud keeps growing, and it is capturing an ever-larger share of information technology spending,” remarked Lee Sustar, from Forrester Inc. “Big b… Read More
2022-12-29 15:22
Reading Time: 5 minutes
The challenge of protecting data lies not in the security of the cloud itself, but the policies and technologies used by organizations to secure it, noted industry A… Read More
2022-12-16 17:16
Reading Time: 4 minutes
When you turn on a security tool, you want it to be intuitive and impact real operations right away. The last thing your organization needs is a solution that is har… Read More
2022-12-08 14:53
Reading Time: 8 minutes
What Does Principle of Least Privilege Mean?
The principle means giving an identity (a person or machine identity) only those permissions which are essential to p… Read More
2022-12-05 17:38
Reading Time: 7 minutes
In March 2017, the first iteration of The New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500… Read More
2022-11-09 16:04
Reading Time: 4 minutes
This past week, Principal Security Architect, Nathan Schmidt, presented a webinar on the value of prioritizing cloud vulnerabilities, why it’s necessary specif… Read More
2022-10-31 15:23
Reading Time: 6 minutes
New IBM X-Force team research supports what we already know to be true: organizations are falling behind on basic security practices in the cloud, exposing them to e… Read More
2022-10-26 20:19
Reading Time: 4 minutes
In the early days of risk detection, if your security team wanted an intimate understanding of their on-prem infrastructure and means to secure it, they needed to br… Read More
2022-10-20 18:56
Reading Time: 5 minutes
If you’re not focused on identity and access controls, then you are running blind to today’s threat landscape. Today, identity is what creates a pathway… Read More
2022-10-13 15:22
Reading Time: 6 minutes
As business leaders recognize the increased revenue growth associated with cloud strategies, Information Security teams must find ways to adapt and, more importantl… Read More
2022-10-11 12:22
Reading Time: 6 minutes
With AWS reInvent a little less than two months away, we wanted to get ahead by organizing a go-to guide to answer all your event questions. If you’re not alre… Read More
2022-10-04 14:58
Reading Time: 9 minutes
Cybercrime Runs Rampant
Cybercrime is not slowing down for anyone. In fact, Q2 of 2022 saw a 32% increase in global cyberattacks YoY. This brought the weekly atta… Read More
2022-09-29 13:29
Reading Time: 7 minutes
To stay ahead in the cloud, you need security solutions that can keep up. so how can you tell if your cloud security tools are beginning to show they need optimizati… Read More
2022-09-27 17:41
Reading Time: 7 minutes
Today, Identity and Access Management is at the forefront of security strategies in the cloud, as organizations big and small migrate to this new frontier. Howev… Read More
2022-09-26 20:56
Reading Time: 7 minutes
Optus, the Australian telecommunications company, is facing a $1 million ransom from a cybercriminal claiming access to over 11 million records from Optus customers… Read More
2022-09-26 17:45
Reading Time: 5 minutes
Recently, one of Sonrai Security’s Principal Solutions Architects, Mindy Schlueter, presented a webinar titled, ‘Continuously Changing Clouds Need Dynami… Read More
2022-09-22 14:24
Reading Time: 5 minutes
The cloud security solutions market is growing rapidly and there are many types of solutions to support your specific security needs. Figuring out the right solution… Read More
2022-09-20 15:49
Reading Time: 7 minutes
In today’s fast-moving cloud workload security environments, decision-makers are grappling with misconfigurations and vulnerabilities in the cloud. Good vulner… Read More
2022-09-19 16:52
Reading Time: 5 minutes
So your company is now operating in the cloud. It’s exciting, isn’t it? So many tools at your disposal, so many new ways to get things done, and pu… Read More
2022-09-17 17:27
Reading Time: 6 minutes
On Thursday, September 15, Uber, the ride-sharing giant, had a security incident after reports claimed a hacker had breached its internal network. Uber joins the ran… Read More
2022-09-15 05:18
Reading Time: 8 minutes
As your organization grows, so does your reliance on cloud services. But with that growth comes the risk of cloud sprawl — when too many cloud services are add… Read More
2022-09-13 16:18
Reading Time: 6 minutes
FS-ISAC 2022 Europe wrapped up day one of workshops, presentations, and panels from experts and leaders in the financial services industry. FS-ISAC 2022 America was… Read More
2022-09-09 16:40
Reading Time: 6 minutes
With the constant threat of data breaches and the ephemeral and fast-paced nature of the cloud, it only makes sense to want to secure your cloud at the most foundati… Read More
2022-09-08 19:32
Reading Time: 5 minutes
Organizations are increasingly moving their operations to the cloud and Microsoft Azure is one of the most popular platforms for cloud computing. However, while… Read More
2022-09-06 18:27
Reading Time: 5 minutes
TikTok, a short-form video hosting service owned by Chinese company ByteDance, is no stranger to controversy. Unfortunately, the social media giant finds itself in t… Read More
2022-09-01 15:57
Reading Time: 6 minutes
With 84% of companies experiencing an identity-related breach in the previous year, you’re making the right choice by seeking out azure identity governance and… Read More
2022-09-01 08:12
Reading Time: 5 minutes
Microsoft Azure is one of the safest and most flexible cloud platforms on the market. Azure contains a range of configurable security tools and supports numerous typ… Read More
2022-08-29 18:15
Reading Time: 5 minutes
We all remember the SolarWinds attack taking up residency in the media headlines back in 2020. If you don’t remember it, in short, the company was targeted by… Read More
2022-08-25 18:38
Reading Time: 11 minutes
According to the Identity Defined Security Alliance (IDSA)’s study, ”Identity Security: A Work in Progress,” 94% of organizations experienced a da… Read More
2022-08-24 12:32
Reading Time: 8 minutes
AWS and Azure privilege escalation attacks are one of the many dangers of managing identities in the cloud. Identity is the new stepping stone for bad actors to expl… Read More
2022-08-23 12:00
Reading Time: 9 minutes
Introduction to Azure Cloud Governance
As with any new technology, it is vital to have the proper cloud governance in place when using Microsoft Azure. The cloud… Read More
2022-08-23 10:30
Reading Time: 8 minutes
There’s no question that AWS Lambda remains the incumbent leader for serverless computing. Lambda’s recent enhancements, including the ability to allocat… Read More
2022-08-18 15:13
Reading Time: 8 minutes
The global cloud computing market will grow by $461 billion by the last quarter of 2025, according to predictions. With the cloud adoption rate increasing and well o… Read More
2022-08-16 14:43
Reading Time: 9 minutes
According to Gartner, through 2025, 90% of the organizations that fail to control public cloud use will inappropriately share sensitive data. The real challenge exis… Read More
2022-08-10 18:09
Reading Time: 3 minutes
Recently, a dating app dedicated to pairing up anti-vaccination individuals experienced massive data exposure due to an alleged ‘hasty set-up’ and absenc… Read More
2022-08-09 16:18
Reading Time: 7 minutes
Data breaches are becoming increasingly common and expensive. IBM estimated that the average data breach costs $3.86 million dollars. Organizations of all sizes and… Read More
2022-08-03 19:09
Reading Time: 7 minutes
Every day we see new vulnerabilities being reported that could allow an attacker access to your data, which means it’s time for you to take action. This articl… Read More
2022-07-29 16:00
Reading Time: 6 minutes
If you missed AWS re:Inforce and you are looking for the highlights, or just simply want a refresher on the major themes, we’re going to review what stood out… Read More
2022-07-27 01:12
Reading Time: 6 minutes
The unstoppable forces of cloud and agile development are driving momentous changes in how enterprises build, deploy, and run applications. All in all, the cloud has… Read More
2022-07-21 14:47
Reading Time: 3 minutes
CIEM is at the peak of its ascent, according to Gartner. The analyst’s ‘Hype Cycle for Workload and Network Security, 2022’ was published recently… Read More
2022-07-20 17:02
Reading Time: 4 minutes
Gartner recently published a report titled, “Emerging Tech: CIEM Is Required for Cloud Security and IAM Providers to Compete,” and there are two overarch… Read More
2022-07-15 18:43
Reading Time: 8 minutes
Data is the most valuable commodity in your business, so why aren’t you treating it like it is important? Every business runs on data. Bad actors and hackers t… Read More
2022-07-12 17:10
Reading Time: 2 minutes
The Shanghai Police has potentially had its most significant known data breach in the country’s history. The prevailing theory about how the information wound… Read More
2022-07-07 17:18
Reading Time: 3 minutes
One of the largest hotel conglomerates in the world experienced another data breach, this time potentially affecting up to 400 individuals and 20GB. In recent years… Read More
2022-07-07 01:38
Reading Time: 2 minutes
The leak of 1 billion Chinese nationals’ personal details is just the latest in a series of cloud security data breaches. A misconfigured server has led to thi… Read More
2022-07-06 19:21
Reading Time: 8 minutes
Beyond learning what privilege escalation is – an identity, whether it is a user or piece of compute, gaining access to rights or privileges beyond what’… Read More
2022-06-30 15:44
Reading Time: 8 minutes
The frequency of cloud attacks are increasing, in fact, one report found that 79% of companies experienced at least one cloud data breach in the past 18 months betwe… Read More
Subscribe to Sonrai Security
Get updates delivered right to your inbox!