Cloud Security Beyond Detection: Why Security State Transitions Matter

Cybersecurity is not just about detecting attacks. It's also about making sure systems recover securely after an incident.

I'm currently working on a cybersecurity research project called Cybersecurity State Transition Integrity (CSTI), which focuses on verifying security state changes across interconnected systems.

The Problem

Traditional security tools can detect threats, monitor vulnerabilities, and identify compromised assets.

But what happens during recovery?

For example, a system might move through these states:

Compromised → Isolated → Cleaned → Reauthorized → Recovered

Even if the system eventually reaches a secure state, an unsafe transition during recovery could introduce additional security risks.

My Approach

With CSTI, I'm exploring how to:

• Track security state transitions across connected assets.
• Identify potentially unsafe recovery actions.
• Verify security policies before allowing transitions.
• Evaluate attack detection and recovery-policy effectiveness separately.

The goal is to improve security throughout the recovery process, rather than checking only the final state.

Why This Matters for Cloud Security

Cloud environments involve interconnected services, identities, applications, and resources.

A security decision affecting one component can influence others. This makes it important to understand not only the security state of individual resources, but also how those states change.

I believe security state transition verification could be useful for strengthening cloud incident recovery.

What's Next?

I'm continuing to develop and evaluate the CSTI prototype, focusing on reliability, detection performance, and secure recovery policies.

I'm also interested in exploring how these ideas could be applied to cloud environments using technologies such as AWS.

This is still a work in progress, and I'm looking forward to sharing what I learn along the way.