Cybersecurity Executive Order 2021: What It Means for Cloud and SaaS Security

In response to malicious actors targeting US federal IT systems
and their supply chain, the President released the “Executive Order on Improving the Nation’s
Cybersecurity^[1]
(Executive Order).”

Although directed at Federal departments and agencies, the
Executive Order will likely have a ripple effect through the
Federal technology supply stream. Private companies and enterprises
will look to the Executive Order to build their best practices.

At a high level, the Executive Order includes
information-sharing requirements, a push toward cloud and Zero
Trust architectures, and enhancing transparency throughout the
software supply chain.

Understanding the fundamentals of the White House Executive
Order on Improving the Nation’s Cybersecurity

The bulk of the Executive Order focuses on administrative tasks
associated with it, including redefining contract language, setting
timelines, and defining agency roles and responsibilities. For
enterprises that don’t supply technology to the federal government,
the Executive Order may feel unimportant.

In reality, several of the basic tenets could be used by
companies operating outside the federal IT supply chain,
including:

• Better intelligence sharing
• Modernizing agency infrastructure with cloud and Zero
  Trust
• Securing the federal IT software supply chain

What the Executive Order Says

The text of the Executive Order is long and comes with all the
regulatory jargon associated with the law. Breaking it down into
bite-size chunks gives a good overview, though.

Better information sharing

The short, succinct point of this one is that “everyone needs to
play nicely and stop hiding behind contracts.” In a nutshell, the
Executive Order looks to create a more meaningful
information-sharing opportunity for agencies and vendors when
threat actors find and exploit a vulnerability.

Move to cloud and create Zero Trust Architecture

Although this one mostly speaks for itself, the requirements in
the Executive Order created a bit of panic across the federal space
because a lot of the timelines are super short. For example, within
60 days, federal agencies need to:

• Prioritize resources to move to the cloud as rapidly as
  possible
• Plan to implement Zero Trust Architecture (ZTA)
• Get things as secure as possible and remediate cyber risk

Finally, within 180 days, they all need to adopt multi-factor
authentication (MFA) and encryption both at-rest and in-transit.
With agencies adopting Software-as-a-Service (SaaS) applications to
modernize their IT stacks, identity, and access control
configurations, including multi-factor authentication, act as a
primary risk mitigation strategy.

Secure the supply chain

Without even needing to list the recent supply chain hacks and
breaches, this is the least surprising of all the requirements.
Surprising very few people, this section includes several key
bullet points:

• Create criteria for software security evaluation
• Establish standard and procedures for secure software
  development
• Establish a “Software Bill of Materials” that lists all the
  technology “ingredients” developers use

What the Executive Order Means for Enterprises

For agencies, this is going to take a bit of work. For
enterprises, this is likely a harbinger of things to come. The
problem is that while the Executive Order is a great start, the two
primary requirements for putting Zero Trust into effect, MFA and
encryption, don’t really close all cloud security gaps.

According to the 2021 Data Breach Investigations
Report^[2] (DBIR) misconfigurations
remain a primary threat vector for cloud architectures. The
increased use of Software-as-a-Service (SaaS) applications actually
trigger two different attack patterns:

• Basic Web Application Attacks: focused on
  direct objectives, ranging from access to email and web application
  data to repurposing the web application to distribute malware,
  defacement, or Distributed Denial of Service (DDoS) attacks.
• Miscellaneous Errors: unintentional actions,
  usually by an internal actor or partner actors, including sending
  data to the wrong recipients.

According to the DBIR, the basic web application attacks include
things like credential theft and brute force attacks. Meanwhile,
the Miscellaneous Errors subset also included things like
cloud-based file storage being placed onto the internet with no
controls.

These attack vectors show the importance of SaaS security
management to cloud security as a whole. Many enterprises lack
visibility into their configurations, and the proliferation of SaaS
applications makes manual configuration monitoring nearly
impossible. As enterprises continue on their digital transformation
journey, configuration monitoring and management will only become
more difficult.

Cloud security, even with a focus on establishing a Zero Trust
Architecture, needs to incorporate SaaS application security. As
agencies and enterprises in their supply chain incorporate SaaS
apps, the security risk that misconfigurations pose needs to be
addressed.

The Enhance SaaS Security Playlist

As agencies and enterprises start looking for solutions,
enhancing SaaS security should be on the “proactive steps to take”
list.

Integrate all applications: Travel the Long and Winding
Road

Doing the business of your business requires many applications,
especially across remote workforces. Despite a potentially long
purchase cycle, adding applications to your stack is relatively
easy. Your IT team creates some connections to your cloud
infrastructure using APIs, then adds the users. People can get down
to business.

Learn more about how to prevent
misconfiguration risks in your SaaS app estate^[3]

Managing SaaS app security for the long term is the big
challenge. You have a lot of applications, and each one has unique
configurations and language. No organization can have an expert in
every application language and configuration. If you can integrate
all your applications into a single platform that creates a
standardized approach to configurations, you’re taking the first
step down the long and winding road to securing your cloud
infrastructure.

Verify access and enforce policies: Stop Believin’

While Journey might say “don’t stop believin,'” a Zero Trust
Architecture means not believing anyone or anything until they
provide the right proof. For example, MFA doesn’t work on a system
that uses legacy authentication protocols like IMAP and POP3. If
you need to secure your SaaS stack and meet these short timelines,
you need visibility into all user access, especially Privileged
Access holders like super admins or service accounts.

Enterprises need unified policies across all SaaS applications,
ensuring continuous compliance. This means the ability to analyze
every user’s access across all your SaaS platforms by role,
privilege, risk level, and platform with the ability to mix and
match as you search, so you have the insights you need, when you
need them.

Eliminate SaaS misconfigurations^[4]

Monitor SaaS security continuously: You Oughta Know

The hardest part of SaaS security is that it continuously
changes, like employees sharing documents with third parties or
adding new non-company users to collaboration platforms. The
problem is that the Executive Order and most other compliance
mandates assume that you oughta know about your risk posture
because you’re continuously monitoring your security.

You need always-on SaaS security that provides real-time risk
identification, context-based alerts, and risk prioritization.

Automate remediation activities: Never Gonna Let You Down

No single human being can manage SaaS security manually.

Manually managing the risks arising from so many users, so many
applications, and so many locations will leave the IT department
running on espresso and energy drinks and, unfortunately, most
likely, missing a critical risk.

Automating the SaaS security process in a single cloud-based
platform is the most efficient way to manage the process. SaaS
platform management solutions meet your security where it lives, in
the cloud, so you can automate your security at cloud-speed, reduce
risk, and strengthen your security and compliance posture.

Adaptive Shield: SaaS Performance Security Management is the
Missing Link

Adaptive Shield^[5]
provides full visibility into one of the most complex issues in
cloud security. This SaaS security posture management solution
enables enterprises to monitor for misconfiguration risks across
the SaaS estate continuously: from configurations that cover
malware, spam, and phishing to suspicious behavior and incorrectly
configured user permissions.

Adaptive Shield aligns technical controls with CIS Benchmarks
and can map controls’ compliance to NIST 800-53 as well as other
frameworks.

The Adaptive Shield SaaS security platform management solution
also natively connects with Single-Sign-On (SSO) solutions, like
Azure, Ping, and Okta, to help track MFA use across the
organization.

With SaaS applications becoming the rule rather than the
exception for modern businesses, cloud security relies on
continuously monitoring for risky SaaS misconfigurations.

Learn more about how to prevent
misconfiguration risks in your SaaS app estate^[6]