6 Keys to Resiliency in the Cloud: Advice for CISOs

Enterprise success relies on operational resilience. When you fall, you have to be able to get back up—and quickly. That ability to spring back after a setback requires more than nimbleness. You also must take steps to anticipate and prepare for risks. Today, many of those risks relate to the dynamic, complex cloud and SaaS (Software as a Service) environments integral to day-to-day business. So, if your current business resilience plan doesn’t include cloud and SaaS, you’re missing a vital chapter.

What are the keys to effectively secure cloud environments against evolving threats? Here are seven fundamentals that CISOs and security teams should strive for in their quest for cloud resilience:

1. Build a comprehensive cloud security strategy

Cloud is not the same as on-premises, so the same legacy strategy that provides on-premises resiliency won’t be effective in the cloud. A comprehensive, specific cloud security strategy is essential for managing cloud and SaaS related risks. It begins with understanding your cloud footprint and defining security requirements for cloud and SaaS. It should cover access controls, data protection, governance, and compliance. Teams should regularly review this strategy as your environment evolves.

2. Ensure visibility into cloud and SaaS operations

The ability to see cloud data and logs is crucial for investigation and incident response. Organizations must collect this “evidence” continuously all the time, otherwise, it's not available when it's most needed. Having comprehensive visibility into cloud activity through forensic data collection is essential for detecting and responding to security incidents. Organizations need to harvest, process and retain security and audit logs, telemetry, asset maps and configurations from cloud infrastructures (IaaS), platforms (PaaS) and applications (SaaS).

3. Prepare forensic data from across your full cloud footprint

Traditional security tools are not optimized to prepare the substantial amounts of forensic data needed from cloud sources. The current reality is that even when organizations have the logs for foundational cloud visibility, they either aren’t collecting all the correct data from across clouds and SaaS or don’t understand how to aggregate and process their data in ways that help them investigate it. In addition, cloud and SaaS providers frequently update or change their logs and telemetry to provide added support for detection and response. Organizations often have trouble keeping track of these frequent changes. SecOps teams need the support of tools that aggregate and normalize their cloud and SaaS forensic data to make it actionable.

4. Leverage the support of security automation

As security leaders and teams are learning from experience, the dynamic nature and scale of cloud infrastructure and the volume of activity make manual processes impractical. Automation reduces workloads for overtaxed security teams while enabling continuous verification that configurations match security best practices. Automation also enables teams to dramatically accelerate the time needed to find and contain threats, which is at the core of reducing impact and building resilience.

One way we harness automation at Mitiga is through our Cloud Attack Scenario Library (CASL), which distills the latest global cloud threat intelligence, indicators of attack from active investigations, and years of our responders and researchers experience into a multi-vector cloud database that continuously runs across all our customers’ data to help identify threats. This approach not only massively increases velocity, but also reduces false positives, and makes investigations more efficient by surfacing relevant events.

5. Take an “assume breach” mindset

Certainly, prevention matters. But preventing every cloud attack is impossible. Modern enterprises need to acknowledge that hard truth and bolster their investments in cloud and SaaS detection and response. Current investment strategies are still balanced in ways that do not give proper weight to that side of the equation.

6. Elevate internal cloud security skills

There is a skills gap when it comes to cloud security in general, and especially in incident response for cloud, as many analysts and IR (Incident Response) professionals lack experience dealing with cloud attacks or hybrid environments. Developing cloud security skills through training can help fill this gap. Partnering can also be an important part of building resilience.

‍

By focusing on these fundamentals and working to strengthen each one, organizations can come to a place where a cloud or SaaS incident that could have become a crisis is able to be treated, and effectively addressed, like business as usual.

LAST UPDATED:

September 24, 2024

Ready to start building your organization’s cloud resilience?
Talk with our experts about the best ways you can begin.

Don't miss these stories:

How Threat Actors Used Salesforce Data Loader for Covert API Exfiltration

In recent weeks, a sophisticated threat group has targeted companies using Salesforce’s SaaS platform with a campaign focused on abusing legitimate tools for illicit data theft. Mitiga’s Threat Hunting & Incident Response team, part of Mitiga Labs, investigated one such case and discovered that a compromised Salesforce account was used in conjunction with a “Salesforce Data Loader” application, a legitimate bulk data tool, to facilitate large-scale data exfiltration of sensitive customer data.

Why Visibility Drives Everything in Modern Cybersecurity with Sevco’s Greg Fitzgerald

In this episode of Mitiga Mic, Brian Contos sits down with Greg Fitzgerald, co-founder of Sevco Security, for a candid conversation on the real state of asset visibility, prioritization, and the evolving challenges facing security teams. With nearly three decades in the industry, Fitzgerald brings perspective on how cybersecurity has shifted from endpoint tools to orchestration-wide awareness. And why that shift is critical for cloud, SaaS, AI, and identity defense. Watch the episode or read the full transcript below.

God-Mode in the Shadows: When Security Tools and Excessive Permissions Become Cloud Security Risks

By the time the alarms go off, it’s often too late. A trusted third-party security tool, one that promised to protect your cloud and SaaS environments, has been operating with unchecked ‘god-mode’ privileges. These tools, usually classified as SaaS Security Posture Management (SSPM) or Data Security Posture Management (DSPM), have been granted near-unrestricted access to your data, configurations, and secrets.

How AI Is Transforming Cybersecurity: Detection, Response & Threat Evolution with Mitiga’s Ofer Maor

In this episode of Mitiga Mic, Brian Contos, Field CISO at Mitiga, sits down once again with Ofer Maor, CTO and Co-founder, to break down one of today’s most urgent cybersecurity challenges: the intersection of Artificial Intelligence (AI) and Detection & Response. From the Automated SOC to AI-powered attackers and cloud-based AI infrastructure threats, Ofer outlines the three pillars of AI-DR (AI Detection and Response) and what organizations need to know now and in the near future.

Meet Mitiga in Las Vegas at Black Hat, DEF CON, and BSides

From August 4 to 11, Mitiga will be on the ground in Las Vegas for Black Hat USA, DEF CON, and BSides Las Vegas. If you’re responsible for cloud security, SaaS threat detection, or incident response, this is your opportunity to connect directly with our team.

Why Wi-Fi Isn’t Enough: Joseph Salazar on Wireless Airspace Security

In this episode of Mitiga Mic, we sit down with cybersecurity veteran Joseph Salazar, now with Bastille Networks, to uncover the vast and often invisible world of wireless attack surfaces. From Bluetooth-enabled coffee mugs and smart thermostats to malicious USB cables that launch attacks from parking lots, Joseph walks us through real-world threats that operate outside your firewall and beyond traditional security tools.