Title

AWS re:Invent 2022 - Using AI to thwart cloud ransomware (PRT075)

Summary

Holly Bittinger from SentinelOne discusses the use of AI in combating cloud ransomware.
Side scanning for vulnerabilities is not effective against real-time ransomware attacks due to its non-real-time nature.
Ransomware attacks are rapid, often taking minutes or seconds, making recovery strategies insufficient.
Cloud Workload Protection Platforms (CWPP) are essential as the last line of defense in a multi-layered cloud defense strategy.
CWPPs detect and respond to threats like ransomware and crypto miners in real-time, providing forensic analysis and persistent telemetry.
SentinelOne uses two types of AI for threat detection: static AI for file inspection and behavioral AI for real-time process monitoring.
SentinelOne's platform, Singularity Cloud, offers runtime security for various workloads and simplifies the security process with a single console.
The platform provides coverage for multiple operating systems, including Amazon Linux 2022, and is available through the AWS marketplace with support for FedRAMP moderate workloads in AWS GovCloud.
Key takeaways include CWPP's ability to stop ransomware and other threats, AI-driven EDR for cloud services, persistent forensic detail collection, and improved security team productivity and stress reduction.

The traditional method of side scanning for cloud security is inadequate for the speed and stealth of modern ransomware attacks, which necessitates a shift towards real-time detection and response mechanisms.
The analogy of Batman's Batmobile versus a Tesla highlights the importance of having advanced, purpose-built tools (like behavioral AI) for specific tasks such as cybersecurity, rather than relying on general-purpose solutions.
The increase in Linux ransomware code variants and the emergence of ransomware as a service indicate a growing threat landscape that requires sophisticated detection tools capable of identifying and mitigating new and evolving threats.
SentinelOne's approach to cloud security emphasizes the importance of a high signal-to-noise ratio in incident detection, which is crucial for security teams to effectively prioritize and respond to genuine threats.
The integration of CWPP into a broader cloud defense strategy underscores the need for a layered approach to security, where different tools and methods work in concert to provide comprehensive protection.
SentinelOne's partnership with AWS and the availability of their solutions on the AWS marketplace demonstrate the trend towards cloud-native security solutions that are designed to work seamlessly with cloud infrastructure and services.