A Mindset Shift for Cloud Security Resilience: Assume Breach

Originally published by Mitiga

Written by Ariel Parnes.

Cloud environments offer tremendous advantages in agility, scalability, and cost efficiency. However, their dynamic nature also introduces new security challenges compared to traditional on-premises IT. To build true resilience for the inevitability of breaches in the cloud, organizations need to shift their mindset and priorities—starting with accepting the assumption that breaches will occur.

The Old Cyber Mindset: Breaches as Anomalies

Historically, major security breaches were viewed as exceptional "fire" events. With strong perimeter defenses, breaches were expected to be few and far between. Investments focused heavily on prevention first, detection secondarily, and response as an afterthought. The emphasis was on keeping breaches from happening in the first place.

While logical decades ago when systems and threats were simpler, this mindset is clearly mismatched to today's active cloud threat landscape. Corporate systems have exponentially greater complexity today, while the risks for attackers have continued to drop and the rewards continue to grow. Even with the most advanced preventative controls, some attacks will inevitably succeed.

Accepting The Inevitability of Breaches

Cloud transformation and the hyper-connection of digital environments has given attackers plenty to prey on. And they are. Breaches will happen, despite best efforts at prevention. Rather than an anomaly, breaches are now a near-certainty during any system's lifetime.

With attackers operating freely beyond the reach of law enforcement and across the expanse of the cloud, prevention cannot be relied upon. The economics and asymmetric nature of cyberattacks make some degree of success inevitable. Defense-in-depth and resilience must become the priority for modern enterprises, rather than elimination of breach risk.

Rebalancing Investment Priorities for Resilience

Transitioning to an "assume breach" mindset requires rebalancing how security budgets are allocated. Disproportionate investment in prevention leaves minimal resources for the detection and response capabilities that minimize breach impacts.

The business impact of cyber breaches is driven primarily by response and recovery time. Minimizing this window requires having the right forensic data sources, tools, and cloud IR (Incident Response) expertise ready before an incident occurs. However, few organizations currently invest adequately in preparing an adequate response.

A more optimal investment balance splits resources 50/30/20 between prevention, detection, and response, respectively. Prevention still gets the majority, but response capabilities are funded at least proportionally to reflect the criticality of incident response.

The “Assume Breach” Mindset Mandates Better Response Readiness in the Cloud

Cloud's shared responsibility model requires a new kind of response readiness. Cloud providers secure the core infrastructure, but customers are fully responsible for their data, identities, configurations and everything above the foundation. Yet the standard toolset most organizations rely on for detection and response is still centered around traditional, on-premises focused solutions like SIEMs (Security Information and Event Management). These lack visibility into many cloud service activities and are not purpose-built to run complex forensic investigations.

Thorough cloud breach preparedness requires rearchitecting detection and response capabilities for the cloud's unique characteristics. Key gaps that must be addressed include:

• Collecting and retaining forensic evidence like audit logs and system activity trails from cloud services
• Centralizing forensic data in a data lake purpose-built for investigations
• Using tools optimized for cloud forensic analysis versus simply alert correlation
• Having experienced cloud response experts since existing IT staff likely lack these skills

By investing in these cloud-focused response capabilities before an incident, organizations can drastically speed up incident investigation, containment, and recovery.

Elevating Your Cloud Incident Response Expertise

Reorienting around an "assume breach" mindset requires most organizations to partner with external experts to implement modern response platforms and skills. The complexity of collecting forensic data across dozens of cloud services and retaining it effectively is beyond most internal IT teams. Even if they have the skillsets, it’s unlikely they can properly allocate the time.

Likewise, cloud-specific response expertise does not exist broadly today. Partnering with an experienced firm who has invested in developing these capabilities allows rapid adoption of a resilient cloud IR posture.

Forward-looking security leaders are accepting the inevitability of breaches and shifting their priorities and investments accordingly. Resilience to minimize breach impacts is the new imperative in the cloud era. By upgrading response capabilities and embracing an assume breach mindset, organizations can thrive even as breaches become a standard occurrence.