34% of organizations lack cloud cybersecurity skills
Incident response today is too time consuming and manual, leaving organizations vulnerable to damage due to their inability to efficiently investigate and respond to identified threats, according to Cado Security.
The incident response challenge is further complicated as enterprises rapidly deploy cloud and container-based technologies and embrace a multi-cloud strategy.
The report, which explores the critical role and challenges of incident response, reveals widespread shortcomings that leave organizations vulnerable to delays in resolving incidents and an inability to comply with and meet regulatory demands. The primary contributing factor is a lack of visibility and control over cloud environments.
“A robust incident response program – especially one that extends to the next generation of technologies – is critical to safeguarding organizations against emerging threats,” said James Campbell, CEO at Cado Security. “Yet, as revealed in our latest report, organizations still lack streamlined incident response strategies for cloud environments. The findings reinforce that organizations urgently need to adopt new approaches to swiftly investigate and respond – not only to better address risk, but also to comply with the complex and ever-changing incident response reporting mandates across the globe.”
Organizations struggle with expanding regulatory scope
90% of organizations suffer damage before containing and investigating incidents. Organizations report that 23% of cloud alerts remain uninvestigated due to various challenges and complexities.
A primary contributing factor to investigation delays was the lack of visibility and control over cloud environments, fueled by the following operational challenges: 82% of organizations report the need to use multiple platforms and tools to perform investigations in the cloud. Further, 34% of organizations report limited cybersecurity skills specific to cloud technologies.
As regulatory reporting requirements evolve, organizations are challenged with the increasing scope and staying abreast of new regulations. 42% of organizations report that the main compliance challenge beyond cloud adoption is the lack of visibility into data, and 34% of respondents have been fined for not meeting regulatory requirements.
Future strategies for cloud investigation and response
As organizations migrate to the cloud, they must adopt new technologies to better secure against evolving threats. The report uncovered that organizations have slightly improved their ability to handle cloud investigations, with respondents reporting that 23% of cloud alerts are never investigated, compared to over 33% in 2021.
The visibility challenges associated with investigation and response in the cloud have organizations increasingly turning to forensics tools. To this end, 83% have allocated a budget for cloud forensics, emphasizing the growing importance of forensics capabilities in managing cloud security.
As organizations attempt to lean on existing tools, such as SOAR (Security Orchestration, Automation, and Response) platforms, to gain visibility into cloud-based threats, the report found that incident response automation is twice as effective when compared to SOAR for cloud investigations. While prioritizing the implementation of automation is essential, this automation must be customized explicitly for incident response rather than applying general automation solutions.
Fill out the form to get your free eBook: