My journey deep into cloud security monitoring continues, with a brief detour into “faith-based monitoring” (as in “we believe our cloud provider takes care of monitoring“).In any case, let’s try to review what types of data we can leverage for security monitoring of resources deployed in each of the cloud service provider (CSP) types: SaaS, PaaS and IaaS.
| Cloud model |
Security monitoring data |
| IaaS |
· Logs: OS, database, applications, etc
· Network monitoring: local host traffic only, no promiscuous sniffing
· Host / endpoint activity: HIPS logs, antimalware logs, other agent, etc
· (if lucky and your CSP likes you) Some data from lower layers of the infrastructure such as hypervisor logs, change logs, etc
· (if all access to cloud is through such) Proxy/gateway data
|
| PaaS |
· Logs: applications (if written by you – then as long as you engineered and enabled logging)
· Some logs from lower layers of the infrastructure such as select platform logs, error logs, etc
· (if all access to cloud is through such) Proxy/gateway data
|
| SaaS |
· (if CSP provides this) Application logs such as access (often), changes (sometimes), etc
· (if all access to cloud is through such) Proxy/gateway data
· (if applicable) Client-side or browser based monitoring data
|
To learn more and to read the entire article at its source, please refer to the following page, Cloud Security Monitoring for IaaS, PaaS, SaaS- Gartner
Article Tags