How Do You Improve Cloud Security Remediation Rates?

To really see meaningful remediation, it's crucial to focus on your workflow instead of just scanner coverage. Consider embedding security checks directly into your CI/CD pipeline and automate any low-risk fixes where you can. Prioritization based on actual exploitability makes a big difference too. Getting the DevOps team to take ownership of fixes while security handles policies can also help boost your remediation rates without sacrificing speed.

From my experience, if you're only fixing 15% of the issues, it seems like it might be more about team priorities than just tools. If you get the right buy-in from management, maybe you could implement scripts that automatically eliminate non-compliant resources. It's really about convincing leadership that insecure settings pose too much risk and should be resolved promptly.

As a developer, all our security findings come with due dates, and if we miss them, it escalates quickly! The severity of the finding usually dictates how soon we need to address it. We can sometimes push back the deadline if we prove the danger is low, but it requires thorough documentation to justify any delays. This might be a method worth implementing in your team to keep security on the radar.

I totally get where you're coming from! One approach that worked for us was utilizing AWS Config for remediation tasks. It automates a lot of the fixes, though you have to be careful if you're also using Infrastructure as Code (IaC) since they can conflict. If your infrastructure is primarily managed through IaC tools like Terraform, use static scanners to generate a list of necessary changes. It’s a balancing act, but you might find that many recommendations are just common sense security practices.

Have you looked into specific tools for IaC like cfn_nag? It only works with CloudFormation but can enforce rules and create accountability, like requiring documentation for any rule breakages. It’s also essential to establish a policy that mandates a timeframe for addressing identified issues. Setting strict guidelines from the top can create urgency and ensure that these security concerns are prioritized.