Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

There are several tactics that threat actors can use to access cloud environments, services, and data. A common example is lateral movement, which involves techniques that enable a threat actor to pivot from one host to the next within an environment. This type of activity often uses other tactics, such as initial access and privilege escalation, as part of a larger attack flow.

Windows event logs are a key source of important information about your Windows environments, including detailed records of user activities, system performance, and potential security issues. However, with the sheer volume of logs modern environments generate, it can be overwhelming for security teams to efficiently detect, triage, and respond to threats in real time.

We’ve just released the 2024 State of Cloud Security study, where we analyzed the security posture of thousands of organizations using AWS, Azure, and Google Cloud. In particular, we found that: In this post, we provide key recommendations based on these findings, and we explain how you can use Datadog Cloud Security Management (CSM) to improve your security posture.

Reliable access to financial data is critical for organizations and individual consumers alike, making resiliency key for financial institutions responsible for managing this information. While cloud computing can strengthen your app’s resiliency, it can also open up new security risks and require more complex continuity planning.

Detection as code (DaC) is a methodology that treats threat detection logic and security operations processes as code. It involves applying software engineering best practices to implement and manage detection rules and response runbooks. This approach addresses many of the pain points associated with traditional security operations.

Healthcare organizations face unique challenges in managing and processing vast amounts of personal information, such as medical records, insurance information, Social Security numbers, and more. To accelerate patient care, these organizations are under pressure to rapidly share this information among providers, insurers, and patients—all within the landscape of a rapidly evolving cloud environment.

Endpoints, whether physical devices or cloud resources, are critical targets for potential cyberattacks. SentinelOne is an endpoint detection and response (EDR) solution that provides real-time detection of and response to endpoint threats. Using both static and behavioral detections, SentinelOne Singularity Endpoint helps protect against a range of threats, including malware, zero-day exploits, advanced persistent threats, and more.

Millions of enterprise users rely on Slack every day as their primary tool for instant communications and information sharing. Because of its central role in operations, Slack inevitably handles sensitive data and critical business information—which also makes it a high-value target for attackers. For this reason, it’s critically important for security teams to detect and respond to security threats against Slack.

Implementing a security incident and event management (SIEM) system can be complex and often requires considerable expertise. Teams need to configure a variety of data sources and ensure their SIEM can scale with growing data volumes. In addition, users need time to learn the system, which can delay value realization. And SIEMs also need continuous maintenance to ensure threat intelligence, detection rules, and integrations are up to date.

Security teams today normally perform ongoing vulnerability remediation as a key part of their efforts to secure applications. This process entails applying updates to remove known flaws, typically published as Common Vulnerabilities and Exposures (CVEs), that are discovered in third-party libraries within application code. While “applying updates” might sound like a straightforward task, in practice, eliminating vulnerabilities has become increasingly challenging in the current environment.