Not so many years ago cloud security was an oxymoron, with on-premises databases the only way to keep sensitive data secure. Times change fast, and cloud security is now being taken seriously by the biggest names in the business. In a recent interview, Amazon Chief Executive Officer Andy Jassy told theCUBE that with Amazon’s S3 storage, cloud has the competitive advantage over on-prem storage in security. 

Jesse Rothstein (pictured), co-founder and chief technology officer of ExtraHop Networks Inc., has a more equitable view of the current state of cloud security. “Today, there’s a lot more acceptance that the cloud can be just as secure as on-prem or just as insecure,” he said. “[Cloud] relies on the same people, processes and technologies … as we have on-prem.”

Rothstein spoke with John Furrier (@furrier) and Dave Vellante (@dvellante), co-hosts of theCUBE, SiliconANGLE Media’s mobile livestreaming studio, during AWS re:Invent in Las Vegas. They discussed new strategies in cloud security. (* Disclosure below.)

Fighting the cybersecurity battle with machine learning and advanced behavioral models

Trackers such as AWS CloudTrail and intelligent threat detection services like GuardDuty are increasing the security capabilities of cloud-based storage such as S3, according to Rothstein. The lack of available trained cloud security experts, however, and “an inherent opacity in public cloud” are still “a real challenge for security,” he said.

Quoting the 2018 Verizon “Data Breach Investigation Report,” Rothstein pointed out that “there are only nine or so behaviors that count for 90 percent of what [security] breaches look like.”

The trick is looking for actions within the cybersecurity attack chain, such as reconnaissance, lateral movement, or forms of ex-filtration. These are the basics for prevention, but ExtraHop takes it one step further: “We’ve built sophisticated behavioral models; we’re able to understand privilege; we’re able to understand what are the most important systems in your environment, the most important instances and who has administrative control over them,” Rothstein stated.

ExtraHop’s cybersecurity offering Reveal(x) incorporates machine learning, taking it to the next level in intelligent security tools and addressing the root cause of security issues. “Reveal(x) is] a very advanced offering around network behavioral analytics, where we actually can detect suspicious behaviors and potential threats and bring them to your attention,” Rothstein said.

Detection is good, but prevention is better. “You need a very streamlined investigative workflow,” he added.

Leveraging ExtraHop’s broader analytics platform allows clients to be “a click away” from investigating any anomalies detected and establishing if they are a cause for concern, he explained.

Rothstein conceded that the security battle will continue to be fought for many years, although he predicted recent technology advances will be a boost for the good guys. “It’s an arms race. Right now I think we’re seeing some really great advancements on the defense side that will translate into big success,” he concluded.

Watch the complete video interview below, and be sure to check out more of SiliconANGLE’s and theCUBE’s coverage of AWS re:Invent. (* Disclosure: ExtraHop Networks Inc. sponsored this segment of theCUBE. Neither ExtraHop nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE