A Clear Understanding of Security in the Cloud

A Clear Understanding of Security in the Cloud

A Clear Understanding of Security in the CloudOne of the most significant benefits of cloud computing is the ability to respond to rapidly changing workloads. While this provides real value, it can also present security challenges. In fact, numerous studies cite security as the number one inhibitor to cloud adoption.

In a traditional data center environment, the IT infrastructure is protected by a demilitarized zone, a DMZ made up of firewalls and intrusion detection and prevention systems. When applications and data are shifted to the cloud, the concept of a single perimeter no longer holds up. How is the security team to see and understand what it going on in the cloud when it’s, well…cloudy? Organizations can adopt an improved cloud security and risk posture with advanced analytics and security intelligence capabilities.

Build in the ability to see through the cloud. Security devices, such as those validating user IDs and passwords, or monitoring network traffic, capture enormous amounts of data needed for regulatory compliance and forensic investigation. The challenge is to find meaningful signals about a potential attack or security risk in the sea of data points. An advanced Security Information and Event Management (SIEM) system extends the traditional SIEM methodology with real-time analytics and correlation – Security Intelligence – providing visibility into both the data center and the cloud infrastructure.

To really understand what is happening in private, hybrid, and public clouds, security teams need to look into communications at a much deeper level. They need to see beyond simply who is participating in an exchange and discover when the content of these interactions include recognizable data patterns, such as social security numbers, credit card numbers, text—including terms like “ID” or “password”—or other protected information.

Because virtualized server traffic cannot be collected using traditional monitoring technologies, organizations need solutions to monitor virtual environments in support of cloud computing. Virtual flow collectors provide application-layer visibility into all virtual network traffic for advanced security intelligence in the cloud.

Application-aware, flow data is obtained from a deep examination and inspection of every packet, which also allows for advanced threat detection through analysis of packet payload content. Correlating this flow information with network and security events, vulnerabilities, identity information and threat intelligence is the optimal way to obtain a complete and accurate view of an organization’s cloud security posture.

A Clear Understanding of Security in the CloudVirtual flow collectors can also analyze port-mirrored traffic for a physical network switch, which helps bridge the gap between physical and virtual devices in the cloud. Collectors that run on a virtual server and do not require additional hardware are a highly cost-effective solution.

Next-generation SIEMs provide advanced incident analysis via correlation of flow data with log data, providing accurate prioritization of incident data and reduction of false positives by correlating security events and network traffic within and between both cloud and traditional environments.

An advanced SIEM should include a dashboard that:

  • Alerts the security team to suspicious port changes;
  • Tracks who is logging into a virtual machine;
  • Identifies when an IP address has been spun up in a new location; and
  • Identifies other potential incidents that need to be investigated.

With advanced security intelligence accessible in real-time, through the single pane of an integrated dashboard, it is possible to see in the cloud.

About the Author

Gretchen Marx is a manager for cloud security strategy at IBM.

Featured

  • ISC West Is Two Months Away

    ISC West Is Two Months Away

    The annual “vacation” to Las Vegas is less than two months away. I anticipate it will be an amazing show, and furthermore, I expect the show hall to be teeming with interested security professionals. Read Now

    • Industry Events
  • Security Today Launches 2023 Government Security Awards

    Security Today Launches 2023 Government Security Awards

    Security Today is proud to announce the launch of the 2023 Government Security Awards. The Govies honor outstanding government security products in a variety of categories. For this year’s awards program, participants can choose from 38 different categories to enter their product(s) into. Read Now

  • Back to the Basics

    Back to the Basics

    Security is a continuous evolution of practices and procedures. The developments in technology and advancements in threats make security difficult at times. Although security from one location may look different from another location, there is a common goal applied to security measures. The common goal is protection. Read Now

  • The Top Three Security Trends in 2023

    The Top Three Security Trends in 2023

    As security technology has become more widely used, the interest in new capabilities and increased security measures has increased. As we head into 2023, these three trends will shape the security landscape. Read Now

Featured Cybersecurity

New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3

  • SAFR® from RealNetworks

    SAFR® from RealNetworks

    A unique feature in SAFR version 3.4 is its ability to automate alerts to security personnel when a spoofing attempt or a fraudulent attempt to gain access is detected. 3