EP72 What Does Good Detection and Response Look Like in the Cloud? Insights from Expel MDR

Guests:

• Dave "Merk" Merkel, CEO @ Expel
• Peter Silberman, CTO @ Expel

Topics:

• Many MDRs claim to be "security from the cloud", but they actually don't know much about cloud security. What does good looks like for MDR in the cloud (cloud being a full range from IaaS to SaaS)?
• What are the key challenges for clients picking an MDR for their cloud environments? What are the questions to ask your potential MDR?
• Do clients want the same security outcomes done in the cloud vs on-premise?
• Does it mean that MSSP/MDR capabilities must be different for good coverage of the cloud?
• Is MDR technology different for Cloud detection and response as opposed to on-prem D&R?
• How do you communicate with clients about the importance and value of cloud specific detection vs detection for endpoints running in the cloud?
• What are the top threats against client cloud environments that you see, detect and protect from?
• Which clouds (IaaS?) are easiest for MDR to protect? What makes them easier to handle than the other Clouds?

Resources:

• Who Does What In Cloud Threat Detection?
• How to Think about Threat Detection in the Cloud
• Cattle vs Pets reminder
• Expel Blog - Incident report: Spotting an attacker in GCP
• Expel Great eXpeltations 2022: Cybersecurity trends and predictions
• Expel Quarterly Threat Report: Q1 2022