Practical Cloud Security

Chapter 7. Detecting, Responding to, and Recovering from Security Incidents

By now, you know what your cloud assets are, and you have put some reasonable protections in place for them. Everything’s good, right?

When you’re two-thirds through a mystery novel and the mystery appears to be solved, you know the story isn’t over. It’s probably not a big surprise that you’re not done with cloud security yet either, since there are still pages left in this book.

All of the previous chapters have dealt with identifying your assets and protecting them. Unfortunately, you won’t always be successful. In fact, in some organizations and industries, minor security incidents are a routine part of life! At some point attackers will almost certainly attempt, sometimes successfully, to gain unauthorized access to your assets. At that point, the trick is to detect them as quickly as possible, kick them out, and do whatever damage control is needed. As part of this, it is helpful to understand what attackers often do and how attacks often proceed.

We’ve seen many high-profile breaches in the past few years. What often distinguishes a bad breach from a really bad breach—there are no good ones—is how long it took to detect what was going on and how effectively the victim responded. One study of 477 companies showed that the mean time to identify a breach was 197 days, and that companies that identified a breach in fewer than 100 days saved more than $1 million compared to those that took more than ...