This article first appeared in Digital Edge, The Edge Malaysia Weekly on November 13, 2023 - November 19, 2023

The acceleration in the adoption of cloud technology has revolutionised the business landscape and, in doing so, significantly altered the cybersecurity ecosystem.

The vast potential of cloud technology, such as its scalability, adaptability and cost-effectiveness, has not gone unnoticed by nefarious entities seeking opportunities for exploitation. As businesses across the Asean region continue their transition to the cloud, they are increasingly confronted with escalating incidents of data breaches, ransomware attacks and insider threats.

Therefore, it is vital for organisations to devise and implement a robust cloud-specific incident response plan. Such a plan can help minimise the impact of security incidents, accelerate recovery time and ensure optimal data protection in this rapidly evolving digital space.

Cloud incident response (IR) today needs to grapple with a radically different set of challenges, including data volume, accessibility and the speed at which threats can multiply within cloud architectures. The interplay of various components, such as virtualisation, storage, workloads and cloud management software, intensifies the complexity of securing cloud environments.

Having said that, cloud IR cannot be done in isolation of the company’s overall incident response activities and business continuity plans. When possible, cloud security tools should use the same SOC (security operations centre), SOAR (security orchestration, automation and response) and communication tools currently being used to secure other company elements. Using the same infrastructure ensures that suspicious and threatening cloud activities receive an immediate and appropriate response.

Creating an effective response plan involves understanding and managing the unique cloud platforms, being fully aware of data storage and access, and adeptly handling the dynamic nature of the cloud. Specifically, this means:

Managing the cloud platform: The administrative console — the control centre of each cloud platform — facilitates the creation of new identities, service deployment, updates and configurations impacting all cloud-hosted assets. This becomes an attractive target for threat actors, considering it offers direct access to the cloud infrastructure and user identities.

Understanding data in the cloud: The cloud hosts data, apps and components on external servers, making it crucial to maintain correct configurations and timely updates. This is vital not just to prevent external threats but also to manage internal vulnerabilities, such as misconfigurations, given the inherent complexity and size of cloud networks.

Handling a dynamic cloud: The cloud is a dynamic space requiring security teams to remain agile and maintain visibility across all services and apps. A lack of familiarity with the environment can lead to an overwhelming volume of data, potentially slowing down threat-hunting, triage and incident investigation processes.

Cloud computing presents new security challenges, requiring a more robust and nuanced incident response plan focused on cloud-specific risks. This includes identifying, analysing and responding to security incidents in a cloud environment to maintain data confidentiality, integrity and availability. Such a plan can shield businesses from financial loss, protect their reputation and maintain regulatory compliance.

Establishing a well-defined, routinely tested and updated plan can effectively reduce the impact of security incidents and foster swift recovery after an attack. It should comprise procedures for responding to various incidents, like data breaches, DDoS attacks and malware infections, including steps for incident containment, investigation and recovery using tools that are already being deployed by the company.

Mastering cloud IR begins with a thorough risk assessment, identifying potential threats, vulnerabilities and risks to the cloud environment. Security teams must thoroughly understand their cloud infrastructure to effectively defend it, considering factors like data sensitivity, legal requirements, access controls, encryption, network security and third-party risks.

Data and tool availability is a key factor in accelerating a security team’s progress during an active security event. Deploying real-time monitoring of cloud resources, network traffic analysis, user activity tracking, intrusion detection systems and automated alerts can ensure swift incident identification and response.

Cloud IR demands efficiency and effective communication. Having pre-set processes and playbooks, defining roles and responsibilities, and maintaining clear communication between team members are essential elements of a cloud IR strategy. Regular drills and simulations to test the IR plan and improve upon it are vital for optimal incident response.

In conclusion, as businesses in the Asean region increasingly embrace cloud technologies, the need for a well-defined cloud IR plan has never been more crucial. By efficiently identifying signs of cloud-based threats, mitigating breaches and limiting or eliminating damage, organisations can secure their cloud infrastructure, enhance their response processes and reduce time to resolution.

Evan Davidson is vice-president of Asia-Pacific Japan at SentinelOne, a cybersecurity solution provider

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.