EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud

Guest:

Arie Zilberstein, CEO and Co-Founder at Gem Security

Topics: 

How does Cloud Detection and Response (CDR) differ from traditional, on-premises detection and response?

What are the key challenges of cloud detection and response?

Often we lift and shift our teams to Cloud, and not always for bad reasons, so  what’s your advice on how to teach the old dogs new tricks: “on-premise-trained” D&R teams and cloud D&R?

What is this new CIRA thing that Gartner just cooked up?  Should CIRA exist as a separate market or technology or is this just a slice of CDR or even SIEM perhaps?

What do you tell people who say that “SIEM is their CDR”?

What are the key roles and responsibilities of the CDR team? How is the cloud D&R process related to DevOps and cloud-style IT processes?

 Resources:

Video version of this episode

Cloud breaches databases

EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?

EP103 Security Incident Response and Public Cloud - Exploring with Mandiant

EP76 Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?

9 Megatrends drive cloud adoption—and improve security for all

“Emerging Tech: Security — Cloud Investigation and Response Automation (CIRA) Offers Transformation Opportunities” (Gartner access required)

“Does the World Need Cloud Detection and Response (CDR)?” blog