EP279 Native Cloud Security: Is 'Good Enough' Actually Winning?

The podcast introduces the hosts Evan, Tim Peacock, and Anton Shuvakin, discussing the nature of cloud security controls—either native, third-party, or a hybrid approach. The conversation highlights the evolutionary landscape of cloud security, particularly focusing on a new company, Native Security, which offers a third approach by leveraging cloud provider controls in a way that provides additional value without being a traditional third-party vendor.

Gal Ordo, co-founder and CEO of Native Security, explains their innovative approach to cloud security. Unlike traditional native controls or third-party vendors, Native integrates native cloud controls with additional enforcement mechanisms to mitigate the gaps of cloud provider solutions. They focus on translating policies across cloud environments, ensuring deterministic enforcement, and staying adaptable to updates from cloud providers. The company emphasizes operational sustainability, expert research, and AI-assisted translation to manage the complex multi-cloud security environment.

The discussion explores the challenges in managing multiple cloud platforms such as AWS, GCP, and Azure, each with their own security controls and configurations. Native Security develops complex, engineered solutions that augment native controls when necessary, constantly updating policies to align with new native features and capabilities. They also focus on translating error messages from different environments to provide clarity and maintain consistent security postures across clouds.

The hosts debate whether native controls might improve to a point where vendors like Native Security could become obsolete. Gal Ordo believes that improvements in native controls across providers benefit security vendors by allowing them to focus more on outcomes rather than building infrastructure. The conversation emphasizes that each provider’s controls are most effective when they are the best at their native primitives, and that Native Security’s strategy is built on this core assumption. The need for specialized, evolving security solutions will likely persist regardless of native enhancements.

Listeners learn that most clients have a primary cloud and sometimes spread workloads across additional clouds, not necessarily striving for perfect multi-cloud control but managing complexity. Native Security aims to provide comprehensive coverage in the public cloud infrastructure, with ambitions to expand into Kubernetes and other environments. They also discuss the limited demand for traditional SaaS control across multiple cloud providers, focusing instead on infrastructure security. The importance of outcome-based security strategies and working with the native capabilities of each provider is highlighted.