From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner | Emerging Tech: The Future of Cloud-Native Security Operations...
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations:
From Gartner: Emerging Tech: The Future of Cloud-Native Security Operations
Get your copy

A Mindset Shift for Cloud Security Resilience: Assume Breach

Cloud environments offer tremendous advantages in agility, scalability, and cost efficiency. However, their dynamic nature also introduces new security challenges compared to traditional on-premises IT. To build true resilience for the inevitability of breaches in the cloud, organizations need to shift their mindset and priorities—starting with accepting the assumption that breaches will occur.

More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan

Imagine that you’re a SOC (Security Operations Center) analyst receiving an alert about suspicious behavior from a binary on an EC2 instance. After checking the binary on VirusTotal, you find it was an AWS-developed software signed by Amazon. Further investigation reveals that it communicated only with Amazon-owned IP addresses.

Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan

Mitiga's research discovered a significant new post-exploitation security concept: involving the use of Systems Manager (SSM) agent as a Remote Access Trojan (RAT) on Linux and Windows machines, controlling them using another AWS account. We shared our research with the AWS security team and included some of their feedback to this advisory.

Why the Implementation of CIRA is so Important for Incident Response

Incident response for cloud and SaaS (Software as a Service) requires new capabilities. Gartner® has released its recent report entitled “Emerging Tech: Security — Cloud Investigation and Response Automation Offers Transformation Opportunities.”

Mitiga Security Advisory: Lack of Forensic Visibility with the Basic License in Google Drive

After gaining initial access to any platform, data theft (exfiltration) is one of the most common attack vectors used by threat actors.

How Okta Passwords Can Be Compromised: Uncovering a Risk to User Data

Mitiga's research team uncovered a data risk to Okta users due to passwords that can be present in logs. This article outlines the risk and attack method.

Samsung Next Invests In Mitiga, Brings Total Funding to $45M

Mitiga, the cloud and SaaS incident response leader, today announced the completion of a Series A Round bringing total funding to $45 million led by ClearSky Security, with participation from Samsung Next and existing investors Blackstone, Atlantic Bridge and DNX.

Mitiga Security Advisory: Insufficient Forensic Visibility in GCP Storage

As part of Mitiga’s continuous research into cloud attacks and forensics, we have been examining potential data exfiltration techniques in GCP (Google Cloud Platform) and how to identify and investigate them. During this research, we discovered a significant forensic security deficiency in Google Cloud Storage that enables a threat actor to exfiltrate in a covert manner.

Google Cloud Platform Exfiltration: A Threat Hunting Guide

If you’re wondering if the cloud era is here, you need only look at the latest stats. 67% of enterprise infrastructure is now cloud-based and 94% of enterprises use cloud services.1 It’s no wonder that public clouds like Google Cloud Platform (GCP) have become a new playground for threat actors. There is a lot to exploit.