In our first post, we highlighted the top ways the cloud impacts security operations, but we stayed at a high level and largely avoided getting into specific mechanics.
Diving a little deeper, some additional characteristics of the cloud directly impact SecOps and can guide how we can expand our core capabilities to support program modernization.
Cloud Disruptions The best way to think about cloud computing is as a completely alien technology on the inside that looks the same on the outside.
Yes, the cloud is built on the same technical building blocks as your own data centers, and many of the things we build in the cloud look, on the surface, the same.
However fast you think the cloud moves, it moves faster.
Distribution: An average small or mid-sized organization early in its cloud journey can typically have 10-15 different cloud deployments.
When an attacker steals cloud credentials, you can't stop them with a firewall or by shutting down access to a server.
The internet is always a click away: Public cloud is a place to build things when you might want to make them public.
This is an inherent characteristic of the public cloud.
Combined with the velocity of the cloud, the potential for instantaneous public exposures is quite high.
Cloud providers update constantly: The major cloud providers each support a range of 200 different services.
Knowledge is local: The average cloud application stack will use dozens of a cloud provider's different services, all using tuned configurations.
Operate in real-time: SecOps has never been the domain for the tardy, but the speed of change of cloud combined with the proximity of the internet means issues may need to be detected and managed within minutes or less, not hours.
This will result in configuration changes, not exploiting some zero-day cloud provider vulnerability.
Tools need to track configurations and identify misconfigurations, while the SecOps team needs to treat misconfigurations as potential indicators of attack.
Collaborate: Local teams, those app and cloud teams that manage their own deployments, will have the knowledge to know if something is a mistake, an attack or a required configuration.
Once the attacker gets their hands on cloud credentials, they effectively break out of the matrix and can rewire your infrastructure.
Optimize your Feeds and Speeds: Cloud platforms bring a new range of security telemetry sources.
Response playbooks can be highly automated to prioritize and filter, enrich data, communicate with the cloud team, run default queries and even automate some containment actions.
We've stayed at a high level, but by understanding the impact of the cloud, you can see how these core capabilities allow a SecOps team to operate more effectively and efficiently.
This Cyber News was published on securityboulevard.com. Publication date: Fri, 22 Dec 2023 15:43:05 +0000