SANS Krakow June 2023

Organizations in every sector are increasingly adopting cloud offerings to build their online presence. However, although cloud providers are responsible for the security of the cloud, their customers are responsible for what they do in the cloud. Unfortunately, the providers have made the customer's job difficult by offering many services that are insecure by default. Worse yet, with each provider offering hundreds of different services and with many organizations opting to use multiple providers, security teams need a deep understanding of the underlying details of the different services in order to lock them down. As the landscape rapidly evolves and development teams eagerly adopt the next big thing, security is constantly playing catch-up in order to avert disaster. The Big 3 cloud providers alone provide more services than any one company can consume. As security professionals, it can be tempting to limit what the developers use to the tried-and-true solutions of yesteryear. Unfortunately, this approach will inevitably fail as the product development organization sidelines a security entity that is unwilling to change. Functionality drives adoption, not security, and if a team discovers a service offering that can help get its product to market quicker than the competition, it can and should use it. Join Brandon Evans as he discusses the inner workings of the Big 3 cloud providers in-depth. This talk will feature content from SANS SEC510, in which students will learn industry-renowned standards and methodologies, such as the MITRE ATT&CK Cloud Matrix and CIS Cloud Benchmarks, then apply that knowledge in hands-on exercises to assess a modern web application that leverages the cloud-native offerings of each provider. Through this process, students will learn the philosophies that undergird each provider and how these have influenced their services.

In this talk, we will delve into the process of building the Cyber Fusion Center of the future, one that is designed to overcome the limitations of traditional Security Operations Centers (SOCs) and bring an integrated, automated, and threat-centric approach to cybersecurity. 

The presentation will identify the common problems faced by traditional SOCs. These include high operational costs, alert fatigue from the overload of alerts and false positives, a shortage of skilled cyber analysts, and the challenge of managing an ever-expanding cyber threat landscape.

Subsequently, we will look at the critical success factors for building a highly functioning Cyber Fusion Center. The focus will be on developing a threat-centric approach that centers on proactive threat hunting rather than reactive threat response. Furthermore, we will emphasize the need for a "purple" focus, combining the defensive strategies of "blue teams" and the offensive strategies of "red teams" for a comprehensive understanding of threats and vulnerabilities. The talk will also stress the importance of being "SOAR-centric". Security Orchestration, Automation, and Response (SOAR) tools are essential for automation and streamlining of threat response, thereby reducing alert fatigue and allowing analysts to focus on high-priority threats. Lastly, we will underline the necessity of an "automation-first" strategy to handle the vast amount of data and alerts in the cyber world. This strategy not only increases efficiency but also frees up human analysts to focus on tasks that require critical thinking and creativity.

By the end of this talk, attendees will have a clear understanding of how to build a Cyber Fusion Center that is fit for the future -- one that is equipped to handle the dynamic cyber threat landscape, is cost-effective, and reduces both alert fatigue and the impact of skill shortages in the cybersecurity industry.