EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud

[chuvakin]

LISTEN TO AN EPISODE

Guest:

• Arie Zilberstein, CEO and Co-Founder at Gem Security

Subscribe at Google Podcasts.

Subscribe at Spotify.

Subscribe at Apple Podcasts.

Subscribe at YouTube

Topics covered:

• How does Cloud Detection and Response (CDR) differ from traditional, on-premises detection and response?
• What are the key challenges of cloud detection and response?
• Often we lift and shift our teams to Cloud, and not always for bad reasons, so  what’s your advice on how to teach the old dogs new tricks: “on-premise-trained” D&R teams and cloud D&R?
• What is this new CIRA thing that Gartner just cooked up?  Should CIRA exist as a separate market or technology or is this just a slice of CDR or even SIEM perhaps?
• What do you tell people who say that “SIEM is their CDR”?
• What are the key roles and responsibilities of the CDR team? How is the cloud D&R process related to DevOps and cloud-style IT processes?

Resources:

• Video version of this episode
• Cloud breaches databases
• EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?
• EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
• EP76 Powering Secure SaaS … But Not with CASB? Cloud Detection and Response?
• 9 Megatrends drive cloud adoption—and improve security for all
• “Emerging Tech: Security — Cloud Investigation and Response Automation (CIRA) Offers Transformation ... (Gartner access required)
• “Does the World Need Cloud Detection and Response (CDR)?” blog