From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations:
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations
Get your copy

The Securities and Exchange Commission (SEC) of the United States has adopted new regulations that require public companies to disclose material cybersecurity incidents within four days. To the positive, this initiative seeks to increase transparency and safeguard investors against potential cybersecurity risks. However, it also puts new weight and responsibility on enterprises that may not yet be ready for the challenge. Meeting this stringent 4-day standard means that enterprises now must be able to investigate cyberattacks swiftly and precisely to determine the significance of incidents. This was more feasible when incidents primarily impacted on-premises environments. Now that the threat landscape extends across multi-cloud and SaaS environments, there is an added measure of complexity in meeting the expectation.  

What the SEC Ruling Means for Enterprises IR (Incident Response)

Companies must promptly evaluate the severity of a data breach to determine if it is "material" and requires immediate disclosure. This requires addressing three fundamental concerns regarding the occurrence:  

1. What access did the attacker gain? It is crucial to quickly determine the extent of an attacker's access to an organization's systems. Enterprises must determine whether the intruder obtained unauthorized access, deeply penetrated critical infrastructure, or merely scratched the surface.  

2. What data was compromised? Understanding the scope of data compromised during a cyber attack is crucial for assessing the enterprise’s potential risks and impact on its stakeholders. Identifying sensitive data that may have been compromised can aid in the formulation of an appropriate response.  

3. Where did the attack originate? Determining the attack vector, i.e., the method used by the perpetrator to infiltrate the organization's network, is essential for assessing the sophistication level and potential risk. This data can inform future security measures and aid in the prevention of similar assaults.  

Developing New Capabilities for Rapid Breach Investigations  

To meet the SEC's stricter reporting deadlines, enterprises will not only require new organizational focus but also need to be enabled with the latest incident response capabilities. For example, enterprises must seek solutions that cover them across all their cloud and SaaS environments, offer greater degrees of visibility and breach readiness, and can analyze the forensic data collected to provide swift answers. Because traditional incident response methods routinely require weeks and months to collect data following a breach, it becomes clear how vital innovative approaches are.  

Migita’s CIRA (Cloud Investigation and Response Automation) Solution Supports the New SEC Requirement

Mitiga’s IR2 platform provides an all-inclusive solution for cloud and SaaS environments that supports enterprises, before during, and after an attack through a mix of readiness, threat hunting, and automated response capabilities. We help organizations prepare for potential cyber assaults by proactively constructing a Forensic Data Lake and streaming the necessary forensic data to it from across their cloud and SaaS environments. When breaches occur, investigations can commence immediately. By using the leading-edge IR automation that we term “Forensics as Code,” our responders support team to provide swift answers. This approach significantly cuts response times that used to be measured in days and weeks to hours. Understanding the scope and impact of the breach enables businesses to make informed decisions about the significance of an attack and efficiently report to regulatory authorities, thereby assuring compliance and protecting shareholder interests.

LAST UPDATED:

January 15, 2024

Don't miss these stories:

What CSPMs Can't Do for Your Cloud Security

In recent years, Cloud Security Posture Management (CSPM) tools have become increasingly popular, and with good reason. The posture management capabilities a CSPM provides can help an organization better understand cloud configuration to prevent potential security incidents.

MOAB: A Wake-Up Call for Enhanced Cyber Preparedness

In a digital landscape fraught with uncertainty, the discovery of the "Mother of All Breaches" (MOAB) serves as an unsettling foreshadowing of other challenges that await. With a massive cache of 26 billion records, this digital beast has again brought cybersecurity to the forefront for enterprises and requires security professionals to wrestle with a new set of evolving circumstances.

Mitiga and Kroll Partner to Deliver the Industry’s Most Comprehensive Incident Response

The combination of Mitiga’s leading CIRA offering and Kroll’s global cyber incident response and litigation support ensures today’s hybrid enterprises have access to unmatched resources during critical moments