User Review
( votes)
Cloud Security Challenges
Cloud Security Challenges- Cloud computing has given organizations the ability to harness the power of advanced infrastructure without incurring the upfront costs traditionally required for on-premises networks. Provisioning IT resources requires little knowledge of the underlying infrastructure. By allowing users to create resources with a few simple configurations, deployment doesn’t require much more than a few clicks of the mouse.
While beneficial for organizations, superficial knowledge of a specific IT resource can leave it vulnerable to myriad cybersecurity issues. For example, a poorly configured AWS S3 bucket can expose sensitive data, which was the cause behind data breaches for Netflix, Ford, TD Bank, Capital One and thousands of others.
Understanding the Challenges of Securing the Cloud
Full traffic mirroring and packet analysis were the easiest ways of ensuring you wouldn’t miss out on important events and also have full forensics in case of a security issue. For on-premises data, there are no additional costs for mirroring traffic and performing proper logging, but cloud providers such as AWS charge for each VPC mirroring session as well as the bandwidth needed to transfer the data.
In an effort to reduce costs on mirroring, organizations will often eliminate doing it on some data they consider unnecessary. Unfortunately, this is a huge risk as it can also eliminate key elements essential for effective forensics after a cybersecurity event. The impact of missing data can make it impossible to identify vulnerabilities and monitor day-to-day events.
Distributed denial-of-service (DDoS) attacks are still a threat to organizations, as bad actors keep developing better offensive measures. Advanced persistent threats (APT) such as eavesdropping, malware or ransomware can take months to detect and several weeks to contain. Stuxnet is another infamous example of how attackers can remain undetected for long periods of time.
Without proper traffic and logging data, intrusion detection suffers and can lead to massive data breaches costing much more than budgeting for mirroring and data aggregation.
However, even organizations that do integrate proper monitoring solutions face a barrage of false-positive alerts. Too many false positives lead to analyst fatigue, which runs the risk of missing signals of an actual attack.
How SIEM Evolved to Solve These Challenges
Security information and event management (SIEM) was first coined in the 2000s, but logging network traffic and identifying threats have been around for decades. It’s an essential part of cybersecurity defenses that gives organizations a way to quickly contain threats before attackers are able to exfiltrate large amounts of data or inject malware on systems.
