Palo Alto Networks (NYSE: PANW) today announced that Bridgecrew by Prisma® Cloud has added Multi-Cloud Drift Detection to identify and flag discrepancies between how cloud resources were defined in infrastructure as code (IaC) and how they are currently configured in runtime. With misconfigurations a leading cause of cloud breaches, Drift Detection helps improve cloud security posture and enables teams to effectively manage IT infrastructure (GitOps). The initial deployment of Drift Detection supports Amazon Web Services (AWS), Microsoft Azure, and Google Cloud.
According to Gartner®, “Through 2025, more than 99% of cloud breaches will have a root cause of preventable misconfigurations or mistakes by end users.”1 While DevSecOps helps keep misconfigurations to a minimum by codifying and enforcing security policies, out-of-band changes are inevitable because of maintenance, incident response tasks and ad hoc changes—these out-of-band changes are known as drift. Regardless of why drift occurs, being able to detect and address it when it does is crucial to maintaining GitOps practices and mitigating cloud risk.
“The most effective way to avoid misconfigurations is by adopting infrastructure as code and making all changes through git and a secure continuous integration/continuous delivery (CI/CD) pipeline. That way, misconfigurations are identified and fixed in code before they’re provisioned,” said Idan Tendler, vice president of DevSecOps, Prisma Cloud at Palo Alto Networks. “However, even organizations that follow GitOps best practices have ‘break glass’ emergencies where operations teams need to make quick changes to cloud resources directly in production that can result in drift. Detecting this drift is one of the keys to maintaining a secure cloud infrastructure.”
Bridgecrew Drift Detection is powered by the company’s latest open source project Yor, which automatically tags IaC templates with attribution and ownership details as well as a unique ID that gets carried across to cloud resources. Drift Detection builds on top of Yor’s code-to-cloud tracing abilities by alerting developers when a drift occurs and allowing them to automatically fix it straight from the Bridgecrew platform. Because of the visibility and control that Drift Detection allows, it is an important critical capability for any organization that is shifting security left and embracing DevSecOps.
Availability
Drift Detection is available now as part of the Bridgecrew standalone platform, which can be purchased using Prisma Cloud Credits.