Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Cloud Threat Detection Research

By Anton Chuvakin
Historical Archive Note: This post was originally published on the Gartner Blog Network on April 19, 2017 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2017/04/19/cloud-threat-detection-research/ | Archive.org Snapshot

What an amazing coincidence! After all the UEBA / UBA excitement (that is, sadly, still ongoing….) and after my short threat hunting paper (out already!), we are about to revisit the cloud security topic.

If you recall, in 2015 I updated my 2012 paper on approaches to security monitoring in the cloud. It is a great paper, but it has too many tables 🙂 Too damn many tables.

In any case, we are going to modernize the paper a bit, given that cloud usage has grown and “mainstreamed” – and finally more people are actively seeking ways to secure stuff in the cloud.

Also, we want to refocus the paper more towards threat detection and response in the cloud, since security monitoring sounds a bit vague to some.

Now, some of you will see this and say “Ah, I know cloud threat detection – it is spelled C.A.S.B.” Well, you’d be wrong – while detecting threats to your SaaS usage is in fact largely about CASB, the situation across PaaS and IaaS is more complex [and, no, I don’t cover CASB, but we do mention them in the paper]. For IaaS, we now have another 4-letter acronym – CWPP (yes, really, it is called that!). How do you pronounce that?

Another central question for many [still] is: can you bring your legacy detection controls with you in the cloud AND should you? Will you have a good time if you do?

In any case, we will share more of our plans as they crystallize…

BTW, right after this quick foray into the cloud, we will go back into vulnerability management (that we have not touched since 2015). If you are a vulnerability assessment (VA) vendor or a vendor that deals with vulnerability assessment data, please schedule a briefing.

Related blog posts on cloud security: