Avi Shua On The Power Of Unified, Cloud-Native Security 

Organizations around the world are increasingly adopting cloud technologies—whether simply by leveraging SaaS applications for improved productivity and collaboration, or by moving all their workloads and data centers to the cloud. But while the cloud offers scalability, cost savings, productivity, and efficiency, it can also make an organization vulnerable to a host of new threats. 

“Attacks in the cloud are a modern version, or the cloud version, of the attacks that we’ve been seeing on-prem for many years,” says Avi Shua, Chief Innovation Officer and Co-Founder at Orca Security—a leading cloud security platform that identifies, prioritizes, and remediates security and compliance issues so businesses can leverage the power of the cloud, with confidence. 

“At the end of the day, attackers look for the weak link for initial access, and then move forward. That’s always the path—you try to get a foothold and later move inside the organization.” 

With over 25 years in the industry, Avi is a seasoned cybersecurity innovator. Prior to his role at Orca, Avi held key positions within the Israeli Defense Forces, and later at Check Point Software Technologies. He brought Orca’s cloud security platform to market as CEO and Co-Founder from 2019-2023, before transitioning to his current role, in which he is responsible for Orca Security’s SideScanning technology and Unified Data Model. 

In an exclusive interview with Expert Insights, Avi discusses the top cloud challenges today, why we’re seeing an increasing desire for unified or converged security stacks, and the benefits of cloud-native security over “lifted and shifted” security. He also shares his predictions on how the threat landscape will evolve as we move further into 2023 and beyond, and how Orca Security will continue to support their customers throughout that evolution.

You can listen to our full conversation with Avi on the Expert Insights Podcast. 

The Drive For Better Cloud Security

Two of the main pressures that security teams find themselves facing in the cloud-era are economic challenges—including having to do more with fewer security tools—and increasing compliance requirements to protect sensitive data. While both of these challenges present difficulties, ultimately, they can represent critical motivation for teams to implement better security approaches, Avi explains. 

Globally, economic strain is putting pressure on security and IT teams to do more with less—leading to consolidation of tools both to save costs, and to reduce time spent managing alerts and visibility across multiple products. 

While the economic instability that has catalyzed this convergence of tools is difficult to navigate, the convergence itself is something that the cybersecurity industry should be welcoming, says Avi. 

“In cloud security, context is king,” Avi says. “At the end of the day, organizations have millions of alerts across different technologies, and they cannot fix everything. And if you try to look at each dimension of the problem separately, you are most likely not going to fix all the important issues. 

“Let’s take, for example, an organization that follows a so-called “best in breed” approach—they have the world’s best vulnerability management tool, the world’s best identity entitlement tool, the world’s best data classification tool, and so forth. And you have a team in which each one of them looks at each tool and tries to fix the top issues. This team will never be able to understand the critical attack path, which involves an exposed server that is vulnerable and is key to accessing the database. For that, you need a holistic understanding across the stack.”

By unifying their cybersecurity toolset and reducing the number of different products and vendors they’re working with, IT and security teams can focus on the most important and immediate threats, rather than having to correlate alerts across multiple systems and filter through them to work out which issues need addressing. 

“This convergence not only reduces the number of vendors, but also makes better use of the most important resource, which is the team,” says Avi. 

“And at the end of the day, nobody wants to have a dozen tools. It’s not economical, both from cost and maintenance point of view.”

Compliance Is A Good Thing… And It Doesn’t Have To Be Difficult 

Many industries are facing an increase in both the strictness and variety of compliance regulations that influence how teams have to think about security and cloud technologies, including a swathe of new regulations across different states in the US. And the best way to keep up with these ever-evolving data protection standards, says Avi, is through automation.

“We definitely see [increasingly] tight regulations and organizations need to adhere to more compliance regimes, and I believe that the best way to do that—in fact, the only good way to do it—is using automation in the cloud. 

“The cloud is software and there’s nothing preventing organizations from automating all of the data collection and verifying compliance continuously—not only when the auditor is coming—and guiding all of these data points in a relatively easy way, using the right tools and techniques. That way, it’s becoming much easier to comply with the different regulations. 

“It’s true that more and more organizations now handle security due to compliance. This is the main driver and, at the end of the day, it’s a good thing. You do want organizations to secure their customer data and if they need regulation that essentially forces them to do that, so be it.”

“Lifted And Shifted” Security Can Walk; Cloud-Native Security Can Run 

We’re living through an exciting period of innovation when it comes to cloud security, as organizations are beginning to understand that the best way to secure cloud resources is not by “lifting and shifting” their on-premises security suites, but by truly embracing the power of the cloud and implementing cloud-native security tools. 

“The cloud enables us to do security much better than we used to do before. Everything can be automated, everything is code. We can actually improve efficiency while maintaining security. And this is what I see: I see many of the old security paradigms dying and people reimplementing security in a way that is ideal for the cloud.”

One of the ways in which this change will be brought to fruition is through the more widespread availability of cloud-native security tools to protect cloud-native technologies and applications, Avi says. 

“When talking about building workloads for the cloud, for a certain time we tried to lift and shift to the cloud, and it worked, to an extent. It worked, but it was expensive, burdensome, and you didn’t really leverage the values of the cloud for an organization. So, yes, you can lift and shift, but you probably don’t want to do that. You need to restructure the application in a way that is ideal for the cloud. 

“We shouldn’t make the same mistake for security. If you lift security to the cloud, it will walk to a certain extent, but it’s far from ideal. You should restructure it in a way that makes sense for the cloud.”

Listen On Spotify:

Listen On Apple Podcasts:

About Expert Insights

Expert Insights provides leading research, reviews, and interviews to help organizations make the right IT purchasing decisions. You can find all of our podcasts here.