Podcast: Cloud Workload Protection Platforms

Data Security Podcast

In a recent podcast interview with Hillarie McClure, Multimedia Director of Cybercrime Magazine,  Robert E. Johnson III, Cimcor CEO/President, discusses the latest views on cloud workload protection platforms. The podcast can be listened to in its entirety below.

Welcome to The Data Security Podcast sponsored by Cimcor. Cimcor develops innovative, next-generation file integrity monitoring software. The CimTrak Integrity Suite monitors and protects a wide range of physical, network, cloud, and virtual IT assets in real-time while providing detailed forensic information about all changes. Securing your infrastructure with CimTrak helps you get compliant and stay that way. You can find out more about Cimcor and CimTrak on the web at cimcor.com/cimtrak. 

Q: Joining us today as President and CEO, Robert E Johnson, III. Robert has been a pioneer in the development of next-gen system integrity monitoring, self-healing systems, and cybersecurity software. Welcome back, Robert, excited to speak with you today.

A: Thanks, Hillarie. Glad to be back on your show. 

Q: So, Robert, we saw that Gartner released their update to the cloud workload protection platforms, also known as CWP, and this seems like a fairly different strategy for folks to protect their infrastructures. So, just diving on in, as always, I'd love to hear your thoughts on CWPP, cloud workload protection platforms.

A: Yeah, no problem. Yeah, we're pretty excited about that Gartner report because we feel that their definition of CWPP, their cloud workload protection platform, does a great job of helping folks understand the priority of tools as they build their defense-in-depth strategy. So, here's the problem: security budgets are limited. It's a finite resource. You only have so much of it. So, CSOs, these security professionals, need to decide. Okay, with a limited budget, what is the most effective set of tools that I can deploy that will help secure our unique infrastructure? It's like maximizing. What are the tools that I can implement based on the fixed budget? And that's a tough decision to make. But I think that the CWPP really helps because, you know, CSOs, when they make this decision, this economic optimization-related decision, they know of about 35 security products that they can select from. How do you know which ones go to your organization's stack?

I think that the CWPP provides some guidance, because it defines this pyramid, which starts with these foundational items at the bottom, the things that had the most impact, and then it just moves up to the point of the pyramid, which includes those less critical things. And it's interesting when you look at this pyramid in a CWPP Whitepaper because those most important items at the bottom, are those foundational items, as I mentioned. What's interesting is those are the items that you don't hear much about from a marketing perspective. But then, as you move up the pyramid to the peak and look at those least critical tools, ironically, those are the tools you hear the most about from a marketing perspective. Those are the things you see the most at the trade shows. So, there's a bit of disconnect, there. So, I think the CWPP kind of helps counteract the marketing message flooding the channels of information acquisition in helping us, you know, make the right decisions for what makes sense. So, I really like fact that CWPP stresses the importance of having that strong foundation built on system hardening, log management, application whitelisting, and system integrity assurance.

Q: And so those recommendations sound really great. Can any of those be applied to hybrid or on-premise infrastructures?

A: Absolutely. The cloud workload protection platform, even though it includes the word cloud, it's philosophically compatible with your on-premise infrastructures, hybrid infrastructures, containerized infrastructure, serverless technology, operational technology infrastructures, and more. So, the CWPP is flexible and is designed to be applicable to many different types of workloads. So, it's just guidance. Guidance to help change the mindset of the industry in general and illuminate the key types of tools that must be in your security stack and do it in a prioritized manner.

Q: Fantastic. So, what are tools or techniques that can be implemented to add the proper controls required for CWPP?

A: As I described earlier, security professionals have this limited resource that's their security budget, right? So, they need to focus on those foundational items. That should be number one in figuring out where to allocate your budget. So, I think that ensuring your organization has a great SIEM, or log management solution in place, has a vulnerability management strategy in place, are absolutely critical. In addition, CWPP provides guidance at that foundational level. So, you know what's really most important and you get the biggest bang for your security dollar. Those would be things such as application control, whitelisting, change management, system hardening, and system integrity assurance.

So, we feel that our product, The CimTrak Integrity Suite, is the most economical way to implement just a single solution, our CimTrak platform that can help provide many of those foundational components described in the CWPP. Now, no tool is perfect and a hacker may release new malware that somehow escapes the detection of our anti-malware tool, or your EDR, all the things you might have in place. But, by implementing these robust foundational components that we're talking about, such as CimTrak, it makes your entire organization much more resilient to these unexpected situations of failures of tools higher in the stack, unexpected changes, and to cyber attacks. So, we think that's the best way forward and the best way to optimize your security dollar. 

Q: Excellent! Well, very straight to the point, Robert, as always. Thank you so much for coming on, really had so much fun speaking with you. 

A: Yeah, always have a blast on your show and I love your questions. Can't wait to see what you come up with next, and I'll talk to you next time. Thank you.