Video: 10 Minute IT Jams - Radware VP on the challenges of cloud security

Cloud security is on everyone's mind.

In the wake of the Covid-19 pandemic, businesses have been forced to rapidly accelerate their digital transformation, bringing both opportunity and significant risk. Janna Poffman, Vice President of Sales at Radware, an IT security company headquartered in Tel Aviv with offices around the globe, joined us to discuss the challenges organisations face as their critical applications move to the cloud.

"Covid-19 has accelerated and emphasised the importance of the digital transformation that many organisations have been making," Poffman said. With workloads migrating away from traditional on-premises data centres into public and private clouds – and often, a combination of the two known as multi-cloud – the benefits are obvious: speed, agility, reduced capital expenditure, disaster recovery, and automatic updates among them. 

Yet, as Poffman was quick to note, cloud migration comes at a cost. "Applications are scattered across multiple environments, each with its own interface, set of tools and delivery methods," she said. "This affects many personas within the organisation as they need to master new solutions, with new variants per cloud environment, to deliver a consistent service."

As the range of platforms and deployment scenarios expands, so too does the so-called threat landscape. "The threat landscape is getting broader as applications are now distributed across multiple environments – more challenging to protect," Poffman explained. Not only are cybercriminals given more points of entry, but managing security becomes more complex and costly, especially as organisations require increased expertise to keep pace.

Many people believe cloud security and on-premises security are similar, but Poffman insists the reality is very different. "Many people are asking me sometimes, is the cloud less secure than their own prem? I say it's different," she said. In traditional environments, administrators, developers, and DevOps teams are physically close to their network resources. If a breach occurs, the response can be hands-on and immediate – someone can literally walk down the hall and pull a server from the network if needed.

But public cloud changes this equation entirely. "In the public cloud, workloads are hosted outside of the organisation, not at the same network, not at the same location," she said. That separation means a stolen credential can lock an entire organisation out of its own resources. "When your inside is out, the outside is in and the whole world becomes your insider threat – and that's the difference," Poffman said.

The vulnerabilities facing cloud applications reflect these new realities. "Excessive permission is the number one threat in the cloud," Poffman explained. In order to realise the promised speed and flexibility, IT professionals grant broad permissions, but most users never need or use most of their granted rights. If credentials are compromised, malicious actors can wreak havoc by exploiting unnecessary access.

Visibility and control are also difficult to maintain as environments multiply. "How do you protect what you cannot see, right?" she said. The rapid pace of cloud operations increases the risk of simple errors, with misconfigurations being among the most common and damaging mistakes that can expose sensitive data to the public internet. "Most common one is misconfiguration that can result in exposure of the outside world," she warned.

Beyond these, the very nature of the cloud means application security attacks can be more severe and require a higher level of attention. "We already saw some significant data breaches to global leading financial organisations through SSRF attacks, or we see that APIs are fast, new growing vertical for cyber attackers due to the weak security," Poffman said, noting how self-documenting APIs provide information that can be exploited by attackers.

Asked how Radware seeks to address these concerns, Poffman pointed to a dual approach. "We protect both sides, meaning the application surface that is public-facing to the clients, with solutions such as cloud WAF and Kubernetes WAF, whatever required to integrate into the architecture of the organisation," she said. "But also API protection, anti-DDoS – and this is only half of the solution. In the cloud you need to protect your back end, now the remote access."

Radware, she explained, has introduced a solution called Cloud Native Protection to shield organisations against misconfiguration, excessive permission, and cloud-based attacks. "That's how we approach this challenge," she said.

With the proliferation of cloud security firms and solutions, what makes Radware stand out? According to Poffman, it is their comprehensive vision. "We are the only vendor that provides a 360-degree, comprehensive cloud application protection. And we do it in a single vendor, single technology stack, and unified approach with best-of-breed solution," she said. "That's our value proposition, that's our differentiation and uniqueness in my opinion."

For organisations seeking guidance in an ever-changing landscape, Poffman's advice is clear. "I think organisations need to realise that the issue of cloud security is a different and separate issue from anything they have known so far," she said. This means investing in the right tools and finding trusted partners to help navigate the complexities – and ensure the company's name doesn't become synonymous with the next big breach.

"We are here as Radware to help them," Poffman said. "That's my advice and definitely it's much tougher than that, and we'll be happy to, and we are sitting with our customers to help them design and protect against malicious actors."