A Clear Understanding of Security in the Cloud

A Clear Understanding of Security in the Cloud

A Clear Understanding of Security in the CloudOne of the most significant benefits of cloud computing is the ability to respond to rapidly changing workloads. While this provides real value, it can also present security challenges. In fact, numerous studies cite security as the number one inhibitor to cloud adoption.

In a traditional data center environment, the IT infrastructure is protected by a demilitarized zone, a DMZ made up of firewalls and intrusion detection and prevention systems. When applications and data are shifted to the cloud, the concept of a single perimeter no longer holds up. How is the security team to see and understand what it going on in the cloud when it’s, well…cloudy? Organizations can adopt an improved cloud security and risk posture with advanced analytics and security intelligence capabilities.

Build in the ability to see through the cloud. Security devices, such as those validating user IDs and passwords, or monitoring network traffic, capture enormous amounts of data needed for regulatory compliance and forensic investigation. The challenge is to find meaningful signals about a potential attack or security risk in the sea of data points. An advanced Security Information and Event Management (SIEM) system extends the traditional SIEM methodology with real-time analytics and correlation – Security Intelligence – providing visibility into both the data center and the cloud infrastructure.

To really understand what is happening in private, hybrid, and public clouds, security teams need to look into communications at a much deeper level. They need to see beyond simply who is participating in an exchange and discover when the content of these interactions include recognizable data patterns, such as social security numbers, credit card numbers, text—including terms like “ID” or “password”—or other protected information.

Because virtualized server traffic cannot be collected using traditional monitoring technologies, organizations need solutions to monitor virtual environments in support of cloud computing. Virtual flow collectors provide application-layer visibility into all virtual network traffic for advanced security intelligence in the cloud.

Application-aware, flow data is obtained from a deep examination and inspection of every packet, which also allows for advanced threat detection through analysis of packet payload content. Correlating this flow information with network and security events, vulnerabilities, identity information and threat intelligence is the optimal way to obtain a complete and accurate view of an organization’s cloud security posture.

A Clear Understanding of Security in the CloudVirtual flow collectors can also analyze port-mirrored traffic for a physical network switch, which helps bridge the gap between physical and virtual devices in the cloud. Collectors that run on a virtual server and do not require additional hardware are a highly cost-effective solution.

Next-generation SIEMs provide advanced incident analysis via correlation of flow data with log data, providing accurate prioritization of incident data and reduction of false positives by correlating security events and network traffic within and between both cloud and traditional environments.

An advanced SIEM should include a dashboard that:

  • Alerts the security team to suspicious port changes;
  • Tracks who is logging into a virtual machine;
  • Identifies when an IP address has been spun up in a new location; and
  • Identifies other potential incidents that need to be investigated.

With advanced security intelligence accessible in real-time, through the single pane of an integrated dashboard, it is possible to see in the cloud.

About the Author

Gretchen Marx is a manager for cloud security strategy at IBM.

Featured

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.