Embracing Ephemeral Environments: Why CIRA is Key for Incident Response 

The dynamic nature of the cloud is one of the biggest appeals for organisations looking at migration. However, it can also pose significant challenges for security teams working hard to secure cloud environments, especially with the increased use of containers and serverless resources. Because ephemeral resources are continuously spun up and down in a matter of minutes, it can be almost impossible for security teams to investigate a potential compromise. In the event the resource is spun down before an analyst is able to gain access to the data, it will unfortunately be gone forever.

What is CIRA?

CIRA (Cloud Investigation and Response Automation) is an emerging category within cloud security to address the cloud-specific challenges security teams are facing when investigating and responding to incidents. CIRA technologies enable security teams to simplify and expedite incident response in the cloud by automating the collection and analysis of forensic data in cloud environments. The category was first coined by Gartner® earlier this year in an Emerging Tech Report: Security — Cloud Investigation and Response Automation Offers Transformation Opportunities and most recently included in the latest Hype Cycle for Workload and Network Security, in which Cado Security was named a sample vendor. 

Gartner Hype Cycle

CIRA Technologies Automate:

• The collection of time-sensitive evidence: As soon as an incident is detected, CIRA platforms immediately collect critical evidence available, including evidence from volatile storage, that may only exist for a short time and would most likely disappear before an analyst would have the time to capture and analyze it. As CIRA platforms integrate directly with cloud service providers APIs, security teams can feel confident that if / when they need to do an investigation, the data will be readily available.
• Isolation of Threats: CIRA also delivers automated isolation capability enables security analysts to quickly contain threats and prevent potential damage or spread while a deep dive investigation takes place in the background.

How Cado can Help

Cado is a CIRA platform that automates as much of the incident response as possible, from data capture to root cause analysis and response, leveraging the power of the cloud. This platform offers rapid access to detailed forensic data in various environments like multi-cloud, containers, and serverless setups. By processing evidence in parallel from sources such as logs, containers and voltile memory, it greatly increases the speed of  investigations. It empowers security analysts by highlighting key incident details and supports quick attack containment.Interested in learning more? Contact our team to see a demo.