CSPM tools work by examining the cloud environment and comparing it to best practices and known security issues. CSPM tools alert the owner of a cloud resource when security risks need to be fixed, and in some cases use automation to remediate issues automatically, such as revoking inappropriate account privileges.
CSPM is typically used by organizations adopting a cloud-first strategy and wanting to extend security best practices to hybrid and multi-cloud environments. CSPM was originally used to secure Infrastructure-as-a-Service (IaaS) cloud resources, such as Amazon EC2 compute instances, but can be used to identify misconfigurations in platform as a service (PaaS), such as cloud databases, as well as software-as-a-service (SaaS).
CSPM solutions may rely on several data sources. Typically, the cloud provider APIs are accessed to gain visibility into service configurations. Other sources might include cloud monitoring of events (e.g., AWS CloudTrail), log analysis, or analysis of cloud block storage volumes in order to find vulnerable workloads.
Some CSPM tools can only use best practices defined for a specific cloud environment or service, while others are more flexible, letting the organization specify custom compliance standards or policies. This is important to consider when selecting tools—because specific tools may be limited to detecting misconfigurations in specific cloud environments, and may not work across multiple cloud accounts.
Most CSPM tools support continuous compliance checks according to common regulations and industry standards, including HIPAA, GDPR, and PCI DSS.