The Challenge

This retail product and services company has more than 300 brick-and-mortar locations across the US, additional brands in its corporate portfolio, and a widely dispersed customer and employee base. The CISO suspected that the organization’s quick shift to the cloud during the pandemic led to a layer of shadow IT as other departments enabled cloud services. Without IT’s involvement and oversight, these deployments were unmitigated.

Simplified, wizard-based interfaces make creating cloud-based applications and systems fast and easy. However, cloud infrastructure spun up without involving the internal IT team may not have security at the forefront. This can inadvertently leave sensitive customer and company data, or other proprietary assets, exposed to the internet and at risk of a data breach.

Our Solution

As a trusted PCI (payment card industry) and penetration testing partner, Converge saw increased cloud usage throughout the organization and shared information about the growing risks with the CISO. The CISO knew that shadow IT was playing a role in their cloud presence and needed a clearer view of the organization’s exposure, but the internal team didn’t have the cloud-specific skills necessary for discovery. Converge conducted a Cloud Security Assessment to discover the cloud services used, identify critical data or systems exposed or misconfigured, and uncover related cloud governance, security, and compliance (GRC) issues.

The Result

The client received a detailed report of the findings. Because the assessment was independent, the CISO could approach the concerns and risks around shadow IT without the perception of inter-department biases or bureaucracy.

All software development and cloud deployments were halted until security measures could be addressed. Converge participated in internal workshops designed to integrate and enable security controls into the CI/CD pipeline, put appropriate guardrails in place to prevent and detect cloud misconfigurations, and improve organizational understanding of cloud risks. The outcome of the Cloud Security Assessment led to improvements that embedded and streamlined security controls during accelerated application development.

We listen first, learning your goals and objectives. Then we apply decades of frontline experience, cutting-edge technical knowledge, and top-tier vendor relationships to help you mitigate risk, optimize outcomes, and harden your security posture through shifting threats, regulations and technologies. Contact us today to learn more.