Threat detection for not so common cloud services features Suresh Vasudevan, CEO of Sysdig, discussing challenges in threat detection for uncommon cloud services. They explore traditional threat detection methods, uncommon service attack vectors, and problems with threat detection in the cloud. The podcast also covers prioritization approaches and bridging cloud and applications.
Traditional methods of threat detection may not be effective in the cloud due to the speed of attacks and variety of cloud data sources.
Effective threat detection in the cloud requires collaboration between SecOps and cloud ops or DevOps teams.
Deep dives
Challenges of Threat Detection in the Cloud
In this podcast episode, the speaker discusses the challenges of detecting threats in the cloud. They highlight how traditional methods of threat detection, which focus on endpoints, logs, and response actions, may not be effective in the cloud context due to the speed of attacks, the volume and variety of cloud data sources, and the need to connect the dots across different event types. The speaker emphasizes the importance of real-time streaming detection and the role of collaboration between SecOps and cloud ops or DevOps teams in implementing effective threat detection strategies.
Uncommon Services and Detection Complexity
The podcast explores the concept of uncommon services in threat detection and the increased complexity they present. The speaker uses an example of a crypto mining attack, where the attackers obfuscated their activities by utilizing cloud services like SageMaker and Azure Machine Learning to provision compute resources for launching a miner. This highlights the need for detecting threats in nuanced and hidden layers within uncommon services. The speaker emphasizes the importance of identifying and monitoring the data sources specific to these uncommon services for effective threat detection.
Leveraging Streaming Detection in the Cloud
The speaker discusses the limitations of traditional log-based threat detection in the cloud and suggests an alternate approach using streaming detection. They argue that storing and processing raw logs for detection is not timely enough and can be costly. Instead, they propose a paradigm shift towards real-time streaming detection and event-based propagation of log events. The speaker highlights the role of tools like Falco in enabling streaming detection and emphasizes the need for organizations to identify and filter the most important log sources for efficient and effective threat detection.
Creating a Bridge Between SecOps and Cloud Ops
The podcast emphasizes the importance of collaboration between SecOps and cloud ops or DevOps teams in order to achieve effective threat detection in the cloud. The speaker suggests that organizations should bring these teams together to quantify threat scenarios, identify the most important data sources, and author detection rules. They stress the significance of partnerships and knowledge sharing between these teams to improve threat detection capabilities in the cloud context.
Threat detection is often limited to popular cloud services, so whats happening to all the "not so popular or commonly known" cloud services in your environment? We are speaking to Suresh Vasudevan, CEO of Sysdig about challenges typically companies find with this space and what should be the approach for threat detection. If you feel you are looking at threats from all cloud services you might want to hear this episode to know you actually are. Thank you to our episode sponsor Vanta and Sysdig