Cloud and Platform Agnostic Security Posture Management (xSPM)
summary
Humana builds a homegrown cloud posture engine that codifies blueprints/manifest files, runs targeted checks (top 10–50) via Azure Event Grid, Azure Functions/Lambda and PowerShell, and dashboards results in Power BI; the platform detects and remediates some issues in under two minutes versus commercial tools at ~9–10 minutes. Use cases: MFA compliance and database AES‑256 encryption checks. Focus is risk‑based, API/event integration, and incremental expansion into DSPM/ISPM/SSPM.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:50Defining xSPM and de-jargonizing security posture management
- 3:18SPM solution types
- 7:20CSPM vs SSPM vs ASPM vs DSPM vs ISPM
- 12:45Data collection and detection differences
- 17:51Cloud security terms
- 20:16xSPM implementation principles
- 23:27Steps to operationalize security posture management
- 27:19Custom xSPM architecture
- 31:40In-house vs commercial SPM
- 34:07MFA monitoring in Azure AD
- 37:41Database encryption validation
- 39:45Top 10 CSPM use cases
- 40:30Key takeaways
- 45:27Q&A
related talks
31mA Comprehensive Approach to Cloud Security Posture Management
16mLevel Up Your Cloud-native Security
50mArchitecting a secure cloud framework
43mWalking on Broken Clouds
53mAzure Security Center - Your CSPM & CWPP
18mCloud security is a shared responsibility: What does that really mean?
40mSecurity Policy Management in the Hybrid Cloud
42mFederal Compliance Panel Discussion