Gartner Blog Network


Cloud Security Monitoring: The “Who” Question

by Anton Chuvakin  |  April 10, 2012  |  4 Comments

Another inherently “annoying” feature of security monitoring (apart from its “ongoing, need-to-do-it-forever” nature) is that somebody must actually do it. Yes, the dreaded “who will do the monitoring on a day to day basis?” question, who would be the “the human in the loop”, who will be ever-vigilant about security-relevant events, who will actually use the monitoring tools, etc?

Let me break this bit of news to you: cloud does NOT change it. Somebody still must do it. Now, that somebody might be spread across two or more organizations (your CSP, your MSSP, your own organization, the consultants you hired, etc), but they have to be there.  When planning your cloud deployment – public, internal private, external private, whatever – you should always keep this in mind. Here is brief example from my upcoming research report on cloud security monitoring.

Table 4. Comparison by Monitoring Entity

Where the monitoring data is obtained  (see the row to the right)

From inside CSP environment

From inside enterprise environment

From between the environments

Who looks at the data (see the column below)

CSP

Yes, for their layers of the stack and their management tools

No (CSP does not see the inside of your organization)

No

MSSP (if retained by the customer)

Yes, for cloud user layers using sensors deployed at CSP

Yes, using sensors deployed at the enterprise environment

Yes, using sensors deployed getting data from gateways/intermediaries

CSP-MSSP (if CSP offers MSSP service)

Yes, for all layers (!)

Yes, using sensors deployed at the enterprise environment

Yes, using sensors deployed getting data from gateways/intermediaries

Enterprise

Yes, using data feeds from cloud layers they control and using data shared by the CSP

Yes, using either endpoint or network sensors

Yes, using sensors deployed getting data from gateways/intermediaries

Note that these distinctions apply across all cloud models, but the scope of what constitutes “their layers” changes from SaaS to IaaS.  The comparison also highlights some advantages of CSP-MSSP combination as they can monitor the entire stack, from physical to data and user activities. However, such approach of combined monitoring+hosting makes some people think of Separation of Duty (SoD) issues. So, will YOU trust the MSSP arm to monitor the activities of the same organization cloud arm? There are definitely big advantages here (see table), but also potential risks…

Previous cloud security posts are:

Additional Resources

View Free, Relevant Gartner Research

Gartner's research helps you cut through the complexity and deliver the knowledge you need to make the right decisions quickly, and with confidence.

Read Free Gartner Research

Category: cloud  logging  monitoring  security  

Tags: cloud-security  security  security-monitoring  

Anton Chuvakin
Research VP and Distinguished Analyst
8 years with Gartner
19 years IT industry

Anton Chuvakin is a Research VP and Distinguished Analyst at Gartner's GTP Security and Risk Management group. Before Mr. Chuvakin joined Gartner, his job responsibilities included security product management, evangelist… Read Full Bio


Thoughts on Cloud Security Monitoring: The “Who” Question


  1. Cloud Security Monitoring: The “Who” Question « Tips On Security says:
    April 11, 2012 at 3:13 am

    […] more here: Cloud Security Monitoring: The “Who” Question Comments […]

  2. Cloud Security Monitoring: The “Who” Question | Cloud 2 | Scoop.it says:
    April 11, 2012 at 3:44 am

    […] background-position: 50% 0px; background-color:#222222; background-repeat : no-repeat; } blogs.gartner.com – Today, 11:44 […]

  3. Cloud Security Monitoring: The “Who” Question » Quality and security of information systems says:
    April 11, 2012 at 7:46 pm

    […] Cloud Security Monitoring: The “Who” Question. […]

  4. My Cloud Security Monitoring Paper Publishes! says:
    April 23, 2012 at 5:47 pm

    […] Anton Chuvakin is a research director at Gartner's IT1 Security and Risk Management group. Before Mr. Chuvakin joined Gartner, his job responsibilities included security product management, evangelist… Read Full Bio Coverage Areas: ← Cloud Security Monitoring: The “Who” Question […]



Comments are closed

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.