Cyber Defense eMagazine October Edition for 2021

To avoid those issues, cloud-focused security teams often rely on logs. However, it's impossible to log
everything in cloud environments, limiting the amount of information incident responders and threat
hunters can use to conduct deeper investigations. Limited information leads to limited insights and less
context. Organizations must collect forensic evidence, preserve the evidence, share information across
teams to establish the root cause, and pull together an actionable plan to contain and eradicate the risk
or exploit from the organization’s digital environment, including cloud hosted assets.
Collect Forensic Evidence
Incident responders, forensic analysts, and investigators working in cloud environments often find
themselves in a challenging position. Most organizations’ security systems only offer an after-the-fact
snapshot of a network intrusion with no context of the breach. The snapshot provides very limited insight
and makes it extremely difficult to analyze the intrusion event accurately and comprehensively. Teams
need richer forensic evidence and technical detail than what is available in logs and data from agents
and firewalls, but those response teams rarely have access to full network packet collection.
The ability to look back retroactively to assess the entire “blast radius” for critical CVEs, exploits, rootkits,
and zero-day attacks is priceless. Collecting and reviewing the comprehensive information about the
threat can highlight potentially vulnerable devices on the network leading both to expeditious remediation
and mitigations of current risk, and a more comprehensive security strategy in the future.
Complete visibility into captured live network traffic allows for analysis before, during, and after intrusion.
For future breaches, packet capture and forensics give SecOps teams the ability to reduce the time
establishing the root cause, the cost of downtime on a system, and the overall impact of the breach.
Collaborate across teams to establish root cause
Remote work has made systems more vulnerable to breaches and communication between team
members more difficult. HP Inc.’s Wolf Security Blurred Lines & Blindspots report found that hackers are
increasingly targeting home workers resulting in a 238 percent increase in global cyberattack volume
during the pandemic. There’s also a growing number of devices on the network and more business being
conducted online, causing a rapid increase in network traffic and providing a larger attack surface for
threat actors.
When forensic analysts and incident responders are able to view metrics and packets from a single
management interface with remote accessibility, the speed to a detection, and then resolution, is
expedited. There’s great value in always-on incident response rather than IR that is focused only on
retrospective investigation of specific security events.
Blocking and containment alone are no longer enough to keep up with the advanced threats that typically
land within an organization and pivot to their higher value targets. There’s a great need for deep
Cyber Defense eMagazine – October 2021 Edition 80
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.