From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations:
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations
Get your copy

Cloud environments offer tremendous advantages in agility, scalability, and cost efficiency. However, their dynamic nature also introduces new security challenges compared to traditional on-premises IT. To build true resilience for the inevitability of breaches in the cloud, organizations need to shift their mindset and priorities—starting with accepting the assumption that breaches will occur.

The Old Cyber Mindset: Breaches as Anomalies

Historically, major security breaches were viewed as exceptional "fire" events. With strong perimeter defenses, breaches were expected to be few and far between. Investments focused heavily on prevention first, detection secondarily, and response as an afterthought. The emphasis was on keeping breaches from happening in the first place.

While logical decades ago when systems and threats were simpler, this mindset is clearly mismatched to today's active cloud threat landscape. Corporate systems have exponentially greater complexity today, while the risks for attackers have continued to drop and the rewards continue to grow. Even with the most advanced preventative controls, some attacks will inevitably succeed.

Accepting The Inevitability of Breaches

Cloud transformation and the hyper-connection of digital environments has given attackers plenty to prey on. And they are. Breaches will happen, despite best efforts at prevention. Rather than an anomaly, breaches are now a near-certainty during any system's lifetime.

With attackers operating freely beyond the reach of law enforcement and across the expanse of the cloud, prevention cannot be relied upon. The economics and asymmetric nature of cyberattacks make some degree of success inevitable. Defense-in-depth and resilience must become the priority for modern enterprises, rather than elimination of breach risk.

Rebalancing Investment Priorities for Resilience

Transitioning to an "assume breach" mindset requires rebalancing how security budgets are allocated. Disproportionate investment in prevention leaves minimal resources for the detection and response capabilities that minimize breach impacts.

The business impact of cyber breaches is driven primarily by response and recovery time. Minimizing this window requires having the right forensic data sources, tools, and cloud IR (Incident Response) expertise ready before an incident occurs. However, few organizations currently invest adequately in preparing an adequate response.

A more optimal investment balance splits resources 50/30/20 between prevention, detection, and response, respectively. Prevention still gets the majority, but response capabilities are funded at least proportionally to reflect the criticality of incident response.

The “Assume Breach” Mindset Mandates Better Response Readiness in the Cloud

Cloud's shared responsibility model requires a new kind of response readiness. Cloud providers secure the core infrastructure, but customers are fully responsible for their data, identities, configurations and everything above the foundation. Yet the standard toolset most organizations rely on for detection and response is still centered around traditional, on-premises focused solutions like SIEMs (Security Information and Event Management). These lack visibility into many cloud service activities and are not purpose-built to run complex forensic investigations.

Thorough cloud breach preparedness requires rearchitecting detection and response capabilities for the cloud's unique characteristics. Key gaps that must be addressed include:

  • Collecting and retaining forensic evidence like audit logs and system activity trails from cloud services
  • Centralizing forensic data in a data lake purpose-built for investigations
  • Using tools optimized for cloud forensic analysis versus simply alert correlation
  • Having experienced cloud response experts since existing IT staff likely lack these skills

By investing in these cloud-focused response capabilities before an incident, organizations can drastically speed up incident investigation, containment, and recovery.

Elevating Your Cloud Incident Response Expertise

Reorienting around an "assume breach" mindset requires most organizations to partner with external experts to implement modern response platforms and skills. The complexity of collecting forensic data across dozens of cloud services and retaining it effectively is beyond most internal IT teams. Even if they have the skillsets, it’s unlikely they can properly allocate the time.

Likewise, cloud-specific response expertise does not exist broadly today. Partnering with an experienced firm who has invested in developing these capabilities allows rapid adoption of a resilient cloud IR posture.

Forward-looking security leaders are accepting the inevitability of breaches and shifting their priorities and investments accordingly. Resilience to minimize breach impacts is the new imperative in the cloud era. By upgrading response capabilities and embracing an assume breach mindset, organizations can thrive even as breaches become a standard occurrence.

LAST UPDATED:

October 17, 2023

Learn how Mitiga’s IR2 can speed your breach response and grow your enterprise’s resilience.

Don't miss these stories:

What CSPMs Can't Do for Your Cloud Security

In recent years, Cloud Security Posture Management (CSPM) tools have become increasingly popular, and with good reason. The posture management capabilities a CSPM provides can help an organization better understand cloud configuration to prevent potential security incidents.

MOAB: A Wake-Up Call for Enhanced Cyber Preparedness

In a digital landscape fraught with uncertainty, the discovery of the "Mother of All Breaches" (MOAB) serves as an unsettling foreshadowing of other challenges that await. With a massive cache of 26 billion records, this digital beast has again brought cybersecurity to the forefront for enterprises and requires security professionals to wrestle with a new set of evolving circumstances.

Mitiga and Kroll Partner to Deliver the Industry’s Most Comprehensive Incident Response

The combination of Mitiga’s leading CIRA offering and Kroll’s global cyber incident response and litigation support ensures today’s hybrid enterprises have access to unmatched resources during critical moments