Cloud adoption is on the rise. And thanks to the pandemic, the rate of adoption is accelerating. Worth an already impressive $445.3 billion in 2021, the global cloud computing market is expected to grow to $947.3 billion by 2026. That’s more than double the size in five years!
Naturally, as cloud adoption increases, so too will cloud-based security incidents. After all, hackers tend to go where the data is. According to a recent survey, 80% of companies have experienced at least one cloud security incident in the last year, and 27% of organizations have experienced a public cloud security incident—up 10% from last year.
The use of threat modeling tools is also on the rise. According to Cision, “The global threat modeling tools market is expected to grow from an estimated USD 0.8 billion in 2022 to USD 1.6 billion by 2027 at a Compound Annual Growth Rate (CAGR) of 14.9% from 2022 to 2027.”
So, cloud adoption is growing, cloud incidents are growing, and the use of threat modeling tools is growing. Seems like threat modeling cloud deployments would be a natural fit to stem the increase in cloud-based incidents. And it would be too, except for one thing: dynamic cloud environments.
Dynamic Cloud Environments
Cloud environments never stop changing because they are dynamic. The cloud takes advantage of dynamic environments because they offer a lot of benefits:
- Provide ways to optimize how cloud resources are used.
- Reuse provisioned resource pools on an on-demand basis.
- Track how provisioned cloud resources are used.
- Provide the status of the provisioning process.
- Verify the credentials of cloud resources before provisioning them.
With all these benefits, is there any downside to cloud deployments? It’s hard enough to protect static environments from motivated attackers. It becomes exponentially more difficult when that environment is constantly changing.
The reason it’s so challenging is because a constantly-changing cloud environment dramatically reduces the efficacy of most security tools and techniques. Oh, most will work in the cloud, for a moment in time, and then they’ll be out-of-date with reduced effectiveness. They’ll need to be “updated.” Constantly. And that applies to threat modeling tools as well.
It sure would be nice to be able to use a threat modeling tool in live cloud environments. For it to do that, it would need two very specific capabilities. First, it would have to automatically do its job (i.e., no human intervention required) and second, it would have to monitor the cloud environment continuously for changes and make updates accordingly.
Does such a threat modeling tool exist? As things turn out, the answer is yes. CloudModeler by ThreatModeler.
Live Cloud Environments and Threat Modeling
CloudModeler was purpose built for the very challenge describe above. It works with AWS and Azure and takes about 15 minutes to identify both resources and properties of resources in the cloud environment.
From there it generates the architectural diagram, where you can envision flow and apply context to issues. But more importantly, it continues to monitor the environment and alerts you of any changes.
If you’d like to learn more about how CloudModeler helps you threat model in live cloud environments, reach out to ThreatModeler here.