Cloud environments offer tremendous advantages in agility, scalability, and cost efficiency. However, their dynamic nature also introduces new security challenges compared to traditional on-premises IT. To build true resilience for the inevitability of breaches in the cloud, organizations need to shift their mindset and priorities—starting with accepting the assumption that breaches will occur.

The Old Cyber Mindset: Breaches as Anomalies

Historically, major security breaches were viewed as exceptional "fire" events. With strong perimeter defenses, breaches were expected to be few and far between. Investments focused heavily on prevention first, detection secondarily, and response as an afterthought. The emphasis was on keeping breaches from happening in the first place.

While logical decades ago when systems and threats were simpler, this mindset is clearly mismatched to today's active cloud threat landscape. Corporate systems have exponentially greater complexity today, while the risks for attackers have continued to drop and the rewards continue to grow. Even with the most advanced preventative controls, some attacks will inevitably succeed.

Accepting The Inevitability of Breaches

Cloud transformation and the hyper-connection of digital environments has given attackers plenty to prey on. And they are. Breaches will happen, despite best efforts at prevention. Rather than an anomaly, breaches are now a near-certainty during any system's lifetime.

With attackers operating freely beyond the reach of law enforcement and across the expanse of the cloud, prevention cannot be relied upon. The economics and asymmetric nature of cyberattacks make some degree of success inevitable. Defense-in-depth and resilience must become the priority for modern enterprises, rather than elimination of breach risk.

Rebalancing Investment Priorities for Resilience

Transitioning to an "assume breach" mindset requires rebalancing how security budgets are allocated. Disproportionate investment in prevention leaves minimal resources for the detection and response capabilities that minimize breach impacts.

The business impact of cyber breaches is driven primarily by response and recovery time. Minimizing this window requires having the right forensic data sources, tools, and cloud IR (Incident Response) expertise ready before an incident occurs. However, few organizations currently invest adequately in preparing an adequate response.

A more optimal investment balance splits resources 50/30/20 between prevention, detection, and response, respectively. Prevention still gets the majority, but response capabilities are funded at least proportionally to reflect the criticality of incident response.

The “Assume Breach” Mindset Mandates Better Response Readiness in the Cloud

Cloud's shared responsibility model requires a new kind of response readiness. Cloud providers secure the core infrastructure, but customers are fully responsible for their data, identities, configurations and everything above the foundation. Yet the standard toolset most organizations rely on for detection and response is still centered around traditional, on-premises focused solutions like SIEMs (Security Information and Event Management). These lack visibility into many cloud service activities and are not purpose-built to run complex forensic investigations.

Thorough cloud breach preparedness requires rearchitecting detection and response capabilities for the cloud's unique characteristics. Key gaps that must be addressed include:

  • Collecting and retaining forensic evidence like audit logs and system activity trails from cloud services
  • Centralizing forensic data in a data lake purpose-built for investigations
  • Using tools optimized for cloud forensic analysis versus simply alert correlation
  • Having experienced cloud response experts since existing IT staff likely lack these skills

By investing in these cloud-focused response capabilities before an incident, organizations can drastically speed up incident investigation, containment, and recovery.

Elevating Your Cloud Incident Response Expertise

Reorienting around an "assume breach" mindset requires most organizations to partner with external experts to implement modern response platforms and skills. The complexity of collecting forensic data across dozens of cloud services and retaining it effectively is beyond most internal IT teams. Even if they have the skillsets, it’s unlikely they can properly allocate the time.

Likewise, cloud-specific response expertise does not exist broadly today. Partnering with an experienced firm who has invested in developing these capabilities allows rapid adoption of a resilient cloud IR posture.

Forward-looking security leaders are accepting the inevitability of breaches and shifting their priorities and investments accordingly. Resilience to minimize breach impacts is the new imperative in the cloud era. By upgrading response capabilities and embracing an assume breach mindset, organizations can thrive even as breaches become a standard occurrence.

LAST UPDATED:

January 23, 2025

Learn how Mitiga’s IR2 can speed your breach response and grow your enterprise’s resilience.

Don't miss these stories:

From Rogue OAuth App to Cloud Infrastructure Takeover

How a rogue OAuth app led to a full AWS environment takeover. And the key steps security leaders can take to prevent similar cloud breaches.

CORSLeak: Abusing IAP for Stealthy Data Exfiltration

When people talk about “highly restricted” cloud environments, they usually mean environments with no public IPs, no outbound internet, and strict VPC Service Controls locking everything down.

Defending SaaS & Cloud Workflows: Supply Chain Security Insights with Idan Cohen

From GitHub Actions to SaaS platforms, supply chain threats are growing. Hear Mitiga’s Idan Cohen and Field CISO Brian Contos explore real-world compromises, detection tips, and strategies to strengthen your cloud security.

Inside Mitiga’s Forensic Data Lake: Built for Real-World Cloud Investigations

Most security tools weren’t designed for the scale or complexity of cloud investigations. Mitiga’s Forensic Data Lake was.

Measurements That Matter: What 80% MITRE Cloud ATT&CK Coverage Looks Like

Security vendors often promote “100% MITRE ATT&CK coverage.” The reality is most of those claims reflect endpoint-centric testing, not the attack surfaces organizations rely on most today: Cloud, SaaS, AI, and Identity.

How Threat Actors Used Salesforce Data Loader for Covert API Exfiltration

In recent weeks, a sophisticated threat group has targeted companies using Salesforce’s SaaS platform with a campaign focused on abusing legitimate tools for illicit data theft. Mitiga’s Threat Hunting & Incident Response team, part of Mitiga Labs, investigated one such case and discovered that a compromised Salesforce account was used in conjunction with a “Salesforce Data Loader” application, a legitimate bulk data tool, to facilitate large-scale data exfiltration of sensitive customer data.