Palo Alto Networks announced that Bridgecrew by Prisma Cloud has added Multi-Cloud Drift Detection to identify and flag discrepancies between how cloud resources were defined in infrastructure as code (IaC) and how they are currently configured in runtime.
With misconfigurations a leading cause of cloud breaches, Drift Detection helps improve cloud security posture and enables teams to effectively manage IT infrastructure (GitOps). The initial deployment of Drift Detection supports Amazon Web Services (AWS), Microsoft Azure, and Google Cloud.
More than 99 percent of cloud breaches will have a root cause of preventable misconfigurations or mistakes by end users by 2025, Gartner said.
While DevSecOps helps keep misconfigurations to a minimum by codifying and enforcing security policies, out-of-band changes are inevitable because of maintenance, incident response tasks and ad hoc changes—these out-of-band changes are known as drift. Regardless of why drift occurs, being able to detect and address it when it does is crucial to maintaining GitOps practices and mitigating cloud risk.
“Even organizations that follow GitOps best practices have break glass emergencies where operations teams need to make quick changes to cloud resources directly in production that can result in drift. Detecting this drift is one of the keys to maintaining a secure cloud infrastructure, Idan Tendler, vice president of DevSecOps, Prisma Cloud at Palo Alto Networks, said.
Bridgecrew Drift Detection is powered by the latest open source project Yor, which automatically tags IaC templates with attribution and ownership details as well as a unique ID that gets carried across to cloud resources.
Drift Detection builds on top of Yor’s code-to-cloud tracing abilities by alerting developers when a drift occurs and allowing them to automatically fix it straight from the Bridgecrew platform. Because of the visibility and control that Drift Detection allows, it is an important critical capability for any organization that is shifting security left and embracing DevSecOps.
Drift Detection is available now as part of the Bridgecrew standalone platform, which can be purchased using Prisma Cloud Credits.
