Cloud Detection and Response

Cloud Detection and Response (CDR) is a branch of cloud security that focuses on detecting active attacks in cloud environments and provides organizations with the information and tools needed for security teams to investigate and respond to these attacks.

The main objective of CDR is to detect cloud attackers who have breached the perimeter controls of cloud resources and applications. By continuously providing security operation center (SOC) and incident response (IR) teams with contextualized data on potential malicious activity in the cloud environment, CDR accelerates investigation and response to cloud attacks.

As organizations increasingly depend on the cloud, many still rely on traditional, on-premises tools to detect and respond to cloud attacks, providing limited insight, missed attacks, and high rates of false positives. CDR helps organizations gain the visibility and awareness of in-progress cloud attacks, accelerate and enhance their response, and limit the scope and severity of incidents.

As with on-premises detection and response, CDR involves four stages: 

1. Detection: Continuous or frequent monitoring for attacks across cloud services feeds with alerting capabilities.
2. Investigation: Review of attack steps, techniques, and timelines, and analysis of available data to determine a needed response to the threat.
3. Response: Capabilities that focus on ensuring cloud threats are contained before they can do damage, such as auto-remediation or automatic forwarding to ticketing systems.
4. Resilience: Organizations conduct a post-mortem investigation, draw conclusions, and focus on potential remediations based on available data. Following threat mitigation, they investigate the root cause, and take actions—patching, encryption, stricter IAM policies—that harden the cloud environment.

Alternative solutions to CDR include: 

• Endpoint Detection and Response (EDR): EDR solutions treat endpoints as potential attack vectors. They use agents to record endpoint activity and identify potential threats, and rely on anomaly detection, machine learning, and other approaches.

• Network Detection and Response (NDR): NDR detects threats by analyzing organizational network traffic. NDRs look for potential threats based on anomalous or unauthorized protocols, port utilization, odd timing and transfer sizes, and more.
• Threat Detection & Response (TDR): TDR typically gathers information most relevant to a current threat. Endpoint TDR tools record data about an identified threat or analyze if an event or process constitutes a threat. Analytical TDRs leverage existing data and apply analytics to identify threats.
• Extended Detection & Response (XDR): XDR platforms detect threats by ingesting endpoint agent data, network level information, and device logs. 

However these solutions don’t offer any actual cloud telemetry like CDR does and are siloed tools without any contextual insight into the existing cloud environment risks. Therefore these tools tend to have a higher rate of false positives since they cannot accurately assess the danger of certain actions.

Orca Security Platform provides around-the-clock monitoring of cloud provider logs and threat intelligence feeds. Orca ingests this information and integrates it with our insights into existing risks across the cloud estate and the location of an organization’s most critical assets. This enables Orca to quickly detect potentially dangerous events that require immediate attention. 

With Orca’s CDR solution, you can detect, investigate, and respond to in-progress cloud attacks:

1. Detect: Get prioritized alerts about events that endanger your most critical assets. 
2. Investigate: Gain quick insights into security events, including whether they’re malicious and if they threaten your critical assets.
3. Respond: Remediate in-progress cloud attacks quickly with automated remediation steps and integrations.