Implementing and Integrating Security Monitoring

Enterprises adopt multi-cloud and use cloud services from different cloud providers. These solutions will be securee, but enterprises want an integrated view of the security status on all of their platforms and solutions. This is what solutions such as Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) do.

In this chapter, we will learn why these systems are a necessity in multi-cloud. First, we will discuss the differences between the various systems, and then we will explore the various solutions that are available on the market today. The big question we’re going to answer in this chapter is, how do we make a choice and, more importantly, how do we implement these complicated solutions?

We’re going to cover the following main topics in this chapter:

• Understanding SIEM and SOAR
• Setting up a Security Operations Center
• Setting up the...

Understanding SIEM and SOAR

All cloud providers offer native services for security monitoring, such as Microsoft Defender for Cloud, AWS Security Hub, and Security Command Center in Google Cloud. However, companies are going multi-cloud using IaaS, PaaS, and SaaS from different providers. Enterprises want an integrated view of their security in all these solutions. If an enterprise is truly multi-cloud, it will need an integrated security solution with SIEM and SOAR.

Next, the enterprise needs a unit that is able to handle and analyze all the data coming from SIEM and SOAR systems and trigger the appropriate actions in case of security events. Most enterprises have a Security Operations Center (SOC) to take care of this. In the next section, we will explain what the differences are between SIEM and SOAR, why an enterprise needs these systems in multi-cloud, and what the role of the SOC is.

Differentiating SIEM and SOAR

Let’s start with SIEM. Imagine that workloads...

Setting up the requirements for integrated security

Before a company gets into buying licenses for all sorts of security tools, security architects will need to gather requirements. That is done in the following four stages that a security team needs to cover:

1. Detect: Most security tools focus on detecting vulnerabilities and actual attacks or attempts to breach systems. Some examples are endpoint protection, such as virus scanners and malware detection, and Network Traffic Analyzers (NTAs). In multi-cloud, architects need to make sure that detection systems can operate on all platforms and preferably send information to one integrated dashboard.
2. Analyze: This is the next phase. Detection systems will send a lot of data, including false positives. Ideally, security monitoring does a first analysis of events, checking them against known patterns and behavior of systems and users. This is the first filter. The second phase in the analysis is prioritization, which is...

Exploring multi-cloud monitoring suites

Companies have a wide variety of choices when they’re looking for a SIEM solution This is a fast-growing market. Each year, market analyst Gartner publishes a list of leading solutions in different IT domains. For a number of years, Splunk, LogRhythm, and Rapid7 have been named as leading products for SIEM by Gartner.

Splunk is a log management and analysis platform that can collect, analyze, and visualize data from a variety of sources, including all major cloud providers.

LogRhythm is a SIEM platform that can collect and analyze log data from cloud environments. LogRhythm provides a set of pre-built connectors and integrations for all clouds, allowing us to collect and centralize log data from these platforms and use LogRhythm’s threat detection and incident response capabilities to detect and respond to security threats.

Rapid7 is a security analytics platform that provides threat detection and incident response...

Summary

Enterprises use a wide and growing variety of cloud solutions. Cloud platforms, systems, software, and data need to be protected from threats and attacks. Likely, a company will also have a variety of security solutions. To create one integrated view of the security of the entire IT environment, companies will have to implement security tooling that enables this single point of view. In this chapter, we looked at SIEM and SOAR systems, tools that can collect data from many different sources and analyze it against security baselines. Ideally, these tools will also trigger automated responses to threats, after calculating the risks and the business impact.

The functionality and differences between SIEM and SOAR have been explained. After reading this chapter, you should have a good understanding of how these systems can integrate with cloud platforms.

In the last section of this chapter, leading SIEM and SOAR solutions were discussed. The chapter concludes this section...

16 Defining Security Policies for Data

Join our book community on Discord

https://packt.link/multicloud

Data is an important asset of any company. Enterprises store their data more and more in multi-cloud. How do they secure data? All cloud platforms have technologies to encrypt data but differ on how they apply encryption and store and handle keys. But data will move from one cloud to another or to user devices, so data needs to be secured in transit, next to data at rest. This is done with encryption, using encryption keys. These keys need to be secured as well, preventing non-authorized users from accessing the keys and encrypted data.

Before we discuss data protection itself, we will briefly talk about data models and how we can classify data. We will explore the different storage solutions the major clouds offer. Next, we will learn how data can be protected by defining policies for data loss prevention (DLP), information labelling to control access, and using encryption.

In this...

Storing data in multi-cloud concepts

If you ask a chief information officer (CIO) what the most important asset of the business is, the answer will be very likely be data. The data architecture is therefore a critical part of the entire business and IT architecture. It's probably also the hardest part in business architecture. In this section, we will briefly discuss the generic principles of data architecture and how this drives data security in the cloud.

Data architecture consists of three layers – or data architecture processes – in enterprise architecture:

• Conceptual: A conceptual model describes the relation between business entities. Both products and customers can be entities. A conceptual model connects these two entities: there's a relationship between a product and the customer. That relationship can be a sale: the business selling a product to a customer. Conceptual data models describe the dependencies between business processes and the entities that...