Qmulos + Splunk Cloud Platform: Why Do Compliance Any Other Way?

Enterprises continue to embrace cloud technology, some driven by the desire to offload rising hardware costs and operational overhead, others enticed by the promise of scalable, on-demand, practically infinite capacity and capability only a few clicks away. Federal agencies are being mandated to increasingly leverage cloud across the board, with more than a few environments concerned about the pace of change and the scale of transformation involved in transitioning mission-critical functions to the cloud.

As traditional on-premises assets migrate to the cloud or become supplanted by SaaS delivery models, risk and compliance leaders find themselves challenged by the need to maintain continued visibility to risk and threat posture as well as the real-time state of security controls across multiple environments. Many are coming to realize that outsourcing services does not absolve them of responsibility for securing privileged data. The buck stops with the enterprise, not the cloud provider.

Unsurprisingly, any transformative effort of such scale does not come without a few teething problems. According to recent research, cloud misconfiguration is fast becoming a leading entry vector in security breaches, with attackers able to detect configuration vulnerabilities within minutes of deployment, while security teams struggle with discovery and mitigation.

Compliance has been historically deployed as the model for capturing and managing enterprise cyber risk, with a multitude of frameworks and standards, frequently overlapping and redundant, intended to provide a consistent model for managing risk against various threat profiles: PCI-DSS for those dealing with card payments, FISMA for Federal enterprises, and so on.

However, at some point the original intent of compliance – ensuring enterprise resilience – gave way to compliance becoming its own organizational function. As compliance overhead increased, enterprises responded by increasing their compliance throughput capacity which, given the primarily manual workflows, meant ever-growing armies of compliance analysts. More humans, more errors.

Now, the rapid proliferation of cloud adoption across enterprises large and small is making this legacy approach to compliance increasingly obsolete. Simply put, those system owners whose controls data your ISSOs were asking for just last quarter are no longer there, and neither are their systems. Sure, a field trip to datacenter row in Ashburn, Virginia makes for a nice day out, but unlikely to produce much in the way of control posture data.

And data is what a competent, credible, and capable compliance program sorely needs, if it hopes to deliver on its true objective: timely and comprehensive risk visibility that leads to informed decisions about securing the enterprise against most likely threats. Nowhere is the need for real-time accurate risk data more obvious than in the cloud.

Our concept of Converged Continuous Compliance captures Qmulos’ vision for holistic real-time visibility of risk, across all environments, all systems, all types of controls, mandated by various standards, including emerging and future ones. Our strategic partnership with Splunk and our joint vision of cloud-native security and compliance drives our commitment to support and enable cloud transformation with big data analytics and scalable solutions that grow with each enterprise as they navigate their unique cloud adoption journey.

“As customers continue to embrace the cloud, the scope of their compliance and security functions need to extend into their cloud environments to ensure their continued management of information risk across the entire enterprise. The wealth and volume of telemetry available in cloud computing environments presents challenges and opportunities that require strategies around cloud asset and service discovery, continuous controls monitoring and validation, as well as robust analytics. Partnering with Qmulos to help enable compliance for the cloud, delivered in the cloud, provides Splunk customers an opportunity to both further extend the value of their investments and future-proof against rapidly emerging compliance mandates.”
— Jane Wong, Splunk's Vice President of Security Products

Wherever that journey takes you, Qmulos compliance solutions powered by Splunk Cloud Platform are ready to address your needs – today and in the future.

To learn how Qmulos, powered by the Splunk Cloud Platform, can transform your security and compliance programs, visit qmulos.com and request a demo today.

About the Author
This is a guest blog post from Igor Volovich, Vice President of Compliance Strategy at Qmulos.