BlogFor decades, the basic playbook for successful digital transformation has looked like this: first, recognize that technological innovations can and will change everything you know about how to maintain a competitive edge on a dime. Second, leverage digital platforms and the data they provide to drive your business forward.
That fundamental roadmap may still exist, but widespread cloud adoption has upended almost everything else about effective, secure digital transformation strategies. How do you take advantage of technologies and capabilities that offer previously unimaginable scale and elasticity—as well as previously unimaginable risk?
Cyber Digital Transformation for the Cloud
In the SANS Institute's 2019 Cloud Security Survey, respondents from across a wide range of industries and job titles discussed what they view as their biggest concerns, including unauthorized access to data by outsiders, inability to respond to incidents, and lost visibility. Out of challenges like these comes the concept of cyber digital transformation.
In order to succeed in their adoption of the cloud, enterprises need to undertake a cyber digital transformation that leverages cloud-first security solutions to provide coverage in three key areas: visibility, detection, and investigation. Two network traffic-based solutions in particular are uniquely qualified for the job: Network Detection and Response (NDR) and, on a more tactical level, Network Traffic Analysis (NTA).
NTA products analyze all network communications to detect and investigate security threats and anomalous or malicious behaviors in real time. NDR solutions are cloud-first versions of NTA products that leverage traffic mirroring and provide immediate response capabilities through native automations or human control.
Critical Capabilities for Cloud-First Network Detection & Response
East-West Visibility
Larger, more complex cloud and hybrid-cloud attack surfaces create more darkspace where threats can hide. NDR and NTA solutions automatically discover and classify assets across on-premises, cloud, and hybrid infrastructures at scale and in real time. They also provide visibility into the east-west traffic that legacy products can't see, and offer some level of SSL/TLS decryption.
NDR solutions are part of the SOC Visibility Triad, which includes Security Incident and Event Management (SIEM) and Endpoint Detection and Response (EDR) products and is rapidly emerging as the structure of choice for cloud-first security architectures. In addition to supporting NDR, network traffic data can provide visibility, detection, and investigation for SIEM and EDR products.
Behavioral-Based Threat Detection
As enterprises evolve, so do the threats they must protect against—and rules-based detections alone can't keep up. NDR and NTA products combine rules-based and machine learning-powered behavioral detections to identify known threats and unknown variants of known tactics, techniques, and procedures (TTPs).
Machine learning-based detections can quickly identify misconfigurations, unauthorized access, and rogue devices, enabling analysts to prioritize the most critical assets. These detections and alerts can also trigger automated response from SIEM, EDR, and NDR products.
Robust Investigation
Complete visibility and real-time detection are two major components of a stronger cloud security posture, but you need robust investigation to truly protect your cloud investment. Best-of-breed NTA and NDR products should provide packet capture and storage, as well full-stream reassembly. When combined with guided investigation workflows, these capabilities enable analysts to quickly validate, triage, and establish root cause with the flexibility to automate response through trusted orchestration and ticketing products.
Finding Cloud-First Solutions
Thousands of vendors dot the cybersecurity landscape, which can make it difficult to choose cloud-first solutions for the problems you need to solve.ExtraHop has partnered with Optiv Security and others to help you embrace the scale and speed of the cloud by securing and accelerating your investment from the inside out.
