TheCascade-and-filter approachis a method used in cloud security to handle incoming data logs efficiently.
It prioritizes logs for threat detection byapplying multiple sequential filters, where each filter progressively narrows down the data. This approach helps in:
* Layered threat detection:Early filters eliminate non-critical data, while subsequent filters perform more detailed analysis.
* Efficient processing:Reduces the volume of data passed through advanced and resource-intensive filters.
* Improved accuracy:Allows focusing on the most relevant security events.
For example, in a cloud environment, the first filter might check for known malicious IP addresses, the second might look for suspicious file types, and subsequent filters may perform behavioral analysis or anomaly detection.
Why Other Options Are Incorrect:
* B. Parallel processing approach:This method processes logs simultaneously, not sequentially, and is less efficient for prioritizing threats.
* C. Streamlined single-filter method:Uses a single filter for all data, which lacks depth and thoroughness in identifying complex threats.
* D. Unfiltered bulk analysis:This approach is resource-intensive and inefficient, as it does not prioritize or filter logs.
References:
CSA Security Guidance v4.0, Domain 9: Incident Response
Cloud Computing Security Risk Assessment (ENISA) - Log Management and Threat Detection Cloud Controls Matrix (CCM) v3.0.1 - Logging and Monitoring Domain

The Preparation phase focuses on setting up an incident response team and developing plans to handle incidents efficiently when they occur. Reference: [Security Guidance v5, Domain 11 - Incident Response]

Agile security approaches allow organizations to adapt to the rapid changes and emerging threats characteristic of cloud environments. Reference: [Security Guidance v5, Domain 4 - Organization Management]