Widespread use of the cloud continues to transform business, while cyber security solutions race to keep up. Today’s multi-cloud environments introduce complexity and gaps in visibility that open doors for attackers. Given the dynamic nature of the cloud, these blind spots are constantly changing. And given its scalability, simple mistakes like a minor misconfiguration can lead to disproportionately large security incidents.
Enterprises can no longer afford to rely on disparate tools and static, point-in-time views of risk. The cloud is inherently complex, and security tools shouldn’t aim to simplify that complexity, but instead harness it, using its scale and intricacy to its advantage.
In a world where the cloud is highly customizable and every cloud is different, a one-size-fits-all approach to cloud security fails to adapt to the nuances of an individual environment. This blog explores how harnessing AI that learns and understands the unique organization can give security teams the visibility, understanding, and real-time detection and response needed to secure the cloud.
Security hinges on action
Typically, cloud security tends to fall into one of two camps:
- Agentless approaches used by most Cloud Security Posture Management (CSPM) vendors that promise quick and easy installation with minimal disruption of operations, and
- Agent-based approaches that offer finer granularity but may mean a lengthy, time-consuming, and expensive set-up process.
Both approaches have inherent drawbacks. Agentless solutions typically don’t give security teams the real-time awareness needed to detect emerging threats – be that a malicious insider, a zero-day exploit, or something else. On the other hand, agent-based solutions provide limited reach and scalability, usually being deployed in an area of the cloud the security team already knew posed a risk, offering no new insight and leaving blind spots untouched.
So cloud security today seems to be stuck in a dilemma. And another issue for both methods is that these products may be able to alert analysts when something goes wrong, but lack the ability to mount a genuine response. Even newer solutions claiming to provide automated response are usually referring to automating the process of sending alerts and opening tickets.
Rapid response is the holy grail
The same attributes that make the cloud so useful and attractive to organizations – speed, agility, availability, and scale – hold a symmetrical appeal for attackers. When cyber-attacks in the cloud unfold rapidly, it’s not enough to simply open a ticket and wait for somebody on the other end to pick it up. (If anything, having to field too many tickets can actually bog down triage and investigation, and delay rather than hasten response.) The ultimate test for useful response comes down to whether or not the security team is willing to use it. Response capabilities that never get turned on, with security teams fearful of disruption, miss the point entirely.
Effective response requires an understanding of when and how to respond, as well as having the cloud-native mechanisms to carry out the action. We can break this down into three steps:
Step 1: Beyond Visibility: Real-Time Understanding
Today’s static cloud security solutions provide snapshots of your environment prior to integration and installation. Static insights help validate and set up controls before deployment, but the real risks related to cloud migration appear later.
To drive the right response, your security solution must deliver a real-time, holistic view of your organization’s cloud environment, not just a generic sense of what the environment looks like.
Understanding risk related to the cloud requires more than just visibility. It requires understanding the various patterns of behavior across the environment, and knowing the nuances in how applications and workloads are architected. Who has access to what? Which virtual machines typically connect with each other? Is this container behaving as expected? Is this new Lambda function expected?
Darktrace / CLOUD uses Self-Learning AI to see and understand your unique organization at the cloud network, architectural, and management layers. The ability of AI to recognize patterns across vast quantities of data puts it in a unique position to give security teams genuine insight into what’s happening in their cloud environment right now.
Each deployment and specific use of AI is different (based on your unique environment) but always includes an architectural view of your cloud footprint that aligns security and DevOps teams throughout the deployment lifecycle.
One beta customer reported deploying Darktrace/Cloud was:
like flipping on a light switch in a dark room."
Step 2: Detection must apply context
With a true understanding of exactly what’s ‘normal’ in your cloud – which users are connecting to what resources, who has access to specific workloads, groups, overlaps, and privileges — the solution progresses toward response by teaching itself to spot what isn’t so normal.
A static snapshot of your cloud security posture can surface unpatched vulnerabilities and problematic misconfigurations, but the insight ends there. Cloud security solutions based on static views and point-in-time visibility can’t connect the dots to deliver the end-goal: the ability to spot real-time threats.
Darktrace/Cloud delivers meaningful insight into vulnerabilities and misconfigurations, but its real-time understanding also enables detection of emerging threats. And combining with other Darktrace modules like Darktrace / NETWORK and Darktrace/Email, it enriches these findings with business context to find and shut down emerging threats in seconds. This business-wide context to understand your cloud footprint and how it interacts with your on-premises infrastructure, endpoints, and applications
Step 3: Response must be truly autonomous
By understanding your unique cloud footprint within the context of your own business, Darktrace/Cloud uniquely detects when something unusual is occurring that requires a response right now.
The use of AI to understand your environment enables a truly autonomous and precise cloud-native response. The platform can take targeted action to stop only the threatening behaviors as they appear, without disrupting regular business operations.
Because the platform understands your complete cloud architecture, it also knows what cloud-native mechanisms are at its disposal to initiate a real response. Automated real-time responses include cloud-native actions like detaching EC2 instances and applying security groups to contain risky assets.
See it in action
Darktrace is offering 30-day free trials of Darktrace/Cloud that combine easy install with unprecedented understanding of multi-cloud environments. Click here to register your interest and experience the benefits first-hand.
Look out for your first newsletter, coming soon.
