Tools for Monitoring and Assessing

Cloud monitoring is one of the keys to ensuring that cloud services and resources remain secure and cost-effective. AWS, Azure, and Google Cloud Platform (GCP) offer native solutions that an IT auditor can leverage to monitor and assess cloud environments. Cloud monitoring is a method of reviewing, observing, and managing the health and security of a cloud. Cloud monitoring is performed with the aim of detecting cyber threats, data breaches, and anomalous behavior. Using monitoring tools, organizations can proactively monitor their cloud environments to identify security events before they become security incidents.

We will cover the following topics in this chapter:

• Basic cloud auditing tools within AWS
• Basic cloud auditing tools within Azure
• Basic cloud auditing tools within GCP

In Chapter 6, Tips and Techniques for Advanced Auditing, we went over tools that an IT auditor can leverage to perform monitoring specifically...

Basic cloud auditing tools within AWS

In the sections that follow, as a prerequisite, you may require a minimum level of view or read access to obtain the test evidence independently. Depending upon your specific organization’s configuration and any additional customizations, you may require additional access rights or group memberships to directly access specific content, or you may be required to work with an administrative point of contact for your organization as you observe them pulling control evidence. For reference, any screenshots in the following sections are based on a user with administrative privileges to the cloud environment. In addition, some of the tools may need to be enabled by the cloud customer, if they have not yet been.

We will begin with the basic cloud auditing tools within the AWS platform.

Amazon CloudWatch

The first tool an IT auditor can leverage in AWS is Amazon CloudWatch. Amazon CloudWatch is an AWS native monitoring and management...

Azure

Now, we will review cloud auditing tools that can be leveraged in the Azure cloud platform.

Azure Monitor

One tool an IT auditor can leverage in the Azure environment is Azure Monitor. As per the Azure documentation, Azure Monitor “helps you maximize performance and availability of your applications and proactively identify problems in seconds.”

To launch Azure Monitor, you can easily search for it in a browser or on the Azure console, as seen in Figure 7.16:

Figure 7.16 – Azure Monitor

Overview presents the different options that an IT auditor can utilize from Application Insights, Container Insights, VM Insights, and Network Insights, as seen in Figure 7.17:

Figure 7.17 – Azure Monitor Overview

A useful feature of Azure Monitor is Activity Log, which displays the last transactions executed in the Azure cloud and who initiated the transaction, as seen in Figure 7.18:

...

GCP

Lastly, we will look at cloud auditing tools that can be leveraged within GCP.

Google Cloud Monitoring

IT auditors can leverage Google Cloud Monitoring to gain real-time visibility into GCP. We can get to Cloud Monitoring by simply searching for it on the Google Cloud console, as shown in Figure 7.23:

Figure 7.23 – Google Cloud Monitoring Overview

A useful feature for an IT auditor is Dashboards. This provides us with dashboards for Disks, Firewalls, Infrastructure Summary, and VM Instances:

Figure 7.24 – Dashboards Overview

One valuable dashboard to review is Firewalls. Let us go to the Firewalls dashboard, as seen in Figure 7.25:

Figure 7.25 – The Firewalls dashboard

If we dig deeper, we note that there is an ingress/inbound rule that allows traffic from the internet (0.0.0.0/0). This particular rule should pique an IT auditor’s interest as port 22 (SSH...

Summary

In this chapter, we looked at the tools for monitoring the performance, availability, and security of infrastructure and applications for AWS, Azure, and GCP environments. We covered standard tools and options that exist within each cloud environment, and how an IT auditor can leverage them to monitor and assess the respective clouds.

In our next chapter, we will perform a walk-through demonstrating how to assess identity and access management (IAM) controls.