Tenable on Tuesday released Tenable.cs, which aims to help security teams replace a hodgepodge of tools, delivering a single platform for cloud security that promises visibility into security risks from the earliest design phases, automating security controls throughout the entire application lifecycle.
The company said it planned to extend the Accurics platform it recently acquired, saying that today’s move was its first step in making it possible for security teams to assess and secure cloud infrastructure before it’s deployed and at runtime.
“Tenable.cs eliminates tool soup, simplifies configuration, provides consistent enforcement and minimizes blind spots,” said Tenable in a blog post. “Compared to traditional approaches, using a single, integrated platform such as Tenable.cs can deliver more effective security, faster response, and lower operational costs.”
Single-pane-of-glass solutions can create issues of their own because once there are enough of them, they themselves need their own single-pane-of-glass, said Casey Ellis founder and CTO at Bugcrowd.
“The biggest challenge in security in this area isn’t the presentation of data, as much as it is ensuring that CISO’s have sufficient context to prioritize which issues need to be solved,” Ellis said. “As adversaries get more active, and the attack surface gets more complex, this need for contextual insight to enable risk-driven vs. capability driven decision-making continues to get much more urgent.”
Melinda Marks, a senior analyst at the Enterprise Strategy Group, added that as developers increasingly use Infrastructure as Code (IaC), it introduces security risk because there’s a high chance for mistakes as developers are pulling code from templates.
“A simple mistake, such as an open S3 bucket, could be difficult to catch without security tools in place to help developers test and fix IaC issues before they deploy it,” Marks said. “This solution should help developers catch and fix issues earlier, while giving the security team a view into testing status and the ability to automate security controls to help prevent issues. In runtime, by monitoring cloud environments for misconfigurations, it also helps speed up response time, with some auto-remediate capabilities included.”