SANS Security Insights

By Matt Cauthorn, VP of Cyber Security Engineering, ExtraHop

Cloud security attacks are on the rise-and a lot of the blame can be placed on one factor: hackers are exploiting misconfigurations to access sensitive data.

Whether customers fail to properly configure Amazon Web Services (AWS) settings for unrestricted external access or elastic block store (EBS) data encryption, 99% of misconfigurations go unnoticed in enterprise infrastructure-as-a-service (IaaS) environments.

Under the Shared Responsibility Model, defending against these types of vulnerabilities is the customer's job when it comes to cloud security. With that in mind, here are the three cloud security control measures that top our list.

Increase Visibility into Hybrid Workloads

It's on the shoulders of customers to manage the security of data in the cloud-cloud service providers are only responsible for the security of the cloud. You can't stop a threat unless you see it quickly and with enough context to act.

Security operations, IT operations, and developers alike need to be able to monitor and assess all cloud-based transactions in the network, without any communication gaps.

Rather than having to jump between products or interfaces, businesses should look for a single platform that provides a universal view across all systems. Silos are broken down, security teams are more comfortable letting DevOps innovate freely, and no one is left in the dark.

Get Proactive About Detection and Response

Prevention is important, but basing your whole security practice around prevention didn't work on-premises and it certainly doesn't work in the cloud.

Pivoting towards a model that prioritizes response alongside prevention means investing in top talent, but even highly skilled cybersecurity professionals can only work as efficiently as the systems that support them.

One way to improve detection and response is to invest in machine learning technologies designed to automatically notice and correlate anomalies-from misconfigurations to malicious data access-and prioritize the threats so security teams know where to focus first.

Another way is to take advantage of the cloud itself. Native services for logging, event processing, compliance, pen testing, and automated actions in an environment can unlock use cases that can be difficult to do in a traditional enterprise environment. By automating actions based on insight-driven events, cloud IR can be streamlined in extremely powerful, even fully automated, ways.

Prioritize Tools That Enable Rapid Investigation

The dynamism of cloud assets and workloads makes it equally important to understand why a security event occurred as it is to detect suspicious behavior. (This is true on-premises as well, of course, but two of the primary benefits of the cloud are rapid development and experimentation-if mistakes aren't recognized early, they'll likely be repeated in many other instances.)

By retracing the steps that led to the issue in the first place, businesses can help drive out future vulnerabilities and improve their security posture. Investigative workflows, however, are not always built with the end-user in mind.

Consider pairing automation tools that score threats with robust investigation tools that enrich detections. Security dashboards should provide context around risk scores, the devices involved, links to outside resources that highlight relevant tactics, and next steps for investigators to take.

Endpoint Detection and Response and logs/SIEM are still important pieces of any cloud security practice, but with the advent of network taps in AWS and Azure, Network Detection and Response is now available to help cloud security teams follow these best practices and more.

Learn more in the free ebook, "Beginners' Guide to Network Detection and Response."

Matt Cauthorn Bio & Information:

As VP of Cyber Security Engineering at ExtraHop, Matt is responsible for all security implementations and leads a team of technical security engineers who work directly with customers and prospects. A passionate technologist and evangelist, Matt is often on site with customers working to solve the complex and mission-critical business problems that Fortune 1,000 and global 2,000 companies face. Prior to ExtraHop, Matt was a Sales Engineering Manager at F5 and before that he started his career in the trenches as a practitioner where he oversaw application hosting, infrastructure, and security for five international data centers.

LinkedIn Profile: https://www.linkedin.com/in/mcauthorn/

Email: matt@extrahop.com