Content ITV PRO
This is Itvedant Content department
Cloud Monitoring and Visibility
Cloud Logging & Monitoring
Learning Outcome
4
Recognize key monitoring metrics and alerts.
3
Understand cloud log collection and analysis.
2
Identify common cloud log sources.
1
Explain cloud logging and monitoring.
5
Explain their role in SOC operations.
A shopping mall has CCTV cameras that continuously record what happens inside the mall, including people entering shops and activities in different areas.
CCTV recordings = Cloud Logs;
Recorded activities = Cloud Events
Security guards watch the live CCTV feeds. If they notice suspicious activity, they immediately investigate and respond.
Live CCTV monitoring = Cloud Monitoring; Suspicious activity = Security Alert
Someone steals from a shop. The guards respond immediately, while the recorded CCTV footage is later reviewed to understand exactly what happened.
Immediate action = Incident Response; Reviewing recordings = Log Analysis and Investigation
Similarly, cloud logging records activities performed by users, applications, and cloud resources, while cloud monitoring continuously observes those activities and system conditions to detect suspicious behavior and support a quick response.
SOC analysts need cloud visibility, IAM, monitoring, and accurate cloud architecture information to know what resources exist, who can access them, and what is happening across the cloud environment.
Introduction to Cloud Environments
Cloud computing delivers services such as servers, storage, databases, networking, software, and analytics over the internet instead of local infrastructure.
What is Cloud Computing?
Importance
On-demand resources
Scalability
Reduced hardware costs
Faster application deployment
High availability
Remote access and collaboration
As organizations move to the cloud, cloud security becomes important for SOC teams.
Cloud Service Models
Provides virtual machines, storage, and networking. Customers manage the OS, applications, and data.
IaaS
Provides fully managed software applications accessed through the internet.
SaaS
PaaS
Provides a managed platform for developing and deploying applications while the provider manages infrastructure and OS.
Cloud Deployment Models
Public Cloud
Private Cloud
Hybrid Cloud
Provider-managed resources shared by multiple customers.
Cloud environment dedicated to one organization.
Combines public and private cloud environments.
Multi-Cloud
Uses services from multiple cloud providers to improve flexibility and reduce provider dependency.
Understanding Cloud Architecture
What is Cloud Architecture?
Cloud architecture defines how cloud resources, services, networking, storage, and applications work together.
Importance
It helps security teams understand where workloads run, how services communicate, and where security controls should be applied.
Cloud Infrastructure Components
Compute Resources: Provide processing power through VMs, CPUs, and compute instances.
Containers: Package applications and dependencies into portable units.
Storage Services: Store files, databases, backups, and application data using object, block, or file storage.
Networking Components: Connect cloud resources using virtual networks, subnets, routers, gateways, and firewalls.
IAM: Controls access to cloud resources.
Databases: Provide managed services for storing and processing data.
Virtual Machines: Run operating systems and applications in the cloud.
Serverless Computing: Runs code without requiring users to manage servers.
Cloud Regions, Availability Zones, and High Availability
Cloud Region
Availability Zone (AZ)
A Cloud Region is a geographic area containing one or more cloud data centers. Organizations select regions based on performance, legal requirements, disaster recovery, and data residency.
Examples: Mumbai, Singapore, London, and North Virginia.
An Availability Zone is one or more isolated data centers within a cloud region with independent power, networking, and cooling.
High Availability keeps services operational even when components or data centers fail. It is achieved by distributing resources across multiple AZs or regions.
High Availability (HA)
Importance of Regions and AZs
Improve availability
Reduce downtime
Support disaster recovery
Reduce network latency
Meet data residency requirements
Increase fault tolerance
For SOC analysts, they help identify resource locations and investigate incidents affecting specific cloud locations.
What is Cloud Visibility?
Cloud visibility is the ability to monitor and understand cloud resources, user activities, configurations, network communications, and security events.
Importance
Monitor cloud resources
Detect suspicious activities
Identify security risks
Improve incident response
Support compliance
Understand cloud environments
Monitor assets
Detect threats
Identify configuration issues
Improve security monitoring
Support investigations
Goals
Cloud Assets and Resources
Virtual Machines: Host applications and operating systems.
Containers: Run cloud-native applications.
Storage Buckets: Store files, backups, and application data; misconfiguration can expose data.
Databases: Store business-critical information and require access monitoring.
Virtual Networks: Provide communication and network isolation.
Security Groups: Act as virtual firewalls controlling network traffic.
Load Balancers: Distribute traffic across servers and help identify unusual traffic patterns.
What is IAM?
IAM manages digital identities and controls access to cloud resources.
Users: Individuals or services requiring access.
Groups: Organize users with similar responsibilities.
Roles: Define permissions for users, applications, or services.
Permissions: Define allowed actions on resources.
Principle of Least Privilege (PoLP): Provides only the minimum permissions required, reducing unauthorized access and potential impact.
Network Visibility in Cloud Environments
VPC
An isolated virtual network for securely deploying cloud resources.
1
VNet
Provides secure communication and network segmentation.
2
Subnets
Divide virtual networks into smaller segments.
3
Security Groups/NSGs
Control inbound and outbound traffic using security rules.
4
Internet Gateways
Connect cloud resources to the public internet.
5
Cloud Security Risks Affecting Visibility
Misconfigured Resources: Incorrect settings may expose sensitive resources.
Excessive Permissions: Unnecessary permissions increase security risks.
Publicly Exposed Storage: Public access may expose confidential data.
Shadow IT: Unapproved cloud resources reduce visibility.
Unused Resources: Unsecured unused resources can become security risks.
Lack of Asset Visibility: Unknown resources can remain unprotected.
What is Asset Inventory?
A cloud asset inventory is a complete record of an organization's cloud resources.
Importance
Identify cloud resources
Monitor critical assets
Detect unauthorized deployments
Improve security management
Organizations should regularly update inventories to keep resources visible and secure.
Cloud Visibility in SOC Operations
Resource Monitoring:
Detects abnormal behavior and security risks.
Identity Monitoring:
Detects unauthorized access and privilege misuse.
Configuration Monitoring:
Identifies risky or unauthorized changes.
Network Visibility:
Detects suspicious communications and attacks.
Security Event Visibility: Monitors authentication, administrative, and other security events.
Challenges in Cloud Visibility
Dynamic Resources: Frequent creation, modification, and removal make monitoring difficult.
Multi-Cloud Environments: Multiple providers increase complexity.
Limited Visibility: Some services provide limited infrastructure access.
Shadow IT: Unauthorized resources reduce visibility.
Identity Complexity: Large numbers of users, roles, and permissions make monitoring difficult.
Rapid Resource Changes: Continuous scaling requires continuous monitoring.
Best Practices for Cloud Visibility
Maintain Asset Inventory: Keep cloud resource records accurate and updated.
Enable Continuous Monitoring: Monitor resources, activities, and configuration changes.
Apply Least Privilege: Provide only required permissions.
Monitor Configuration Changes: Detect unauthorized or risky modifications.
Review Cloud Resources: Remove unused resources and secure active ones.
Use Native Cloud Security Services: Use built-in cloud security tools to improve monitoring and visibility.
Summary
5
Large log volumes and multi-cloud environments create challenges.
4
Monitoring supports threat detection and incident response.
3
Alerts help SOC analysts identify suspicious activities.
2
Audit logs support compliance and forensics.
1
Cloud logs help detect threats and investigate incidents.
Quiz
Which log source records successful and failed user login attempts?
B. Storage Logs
C. Identity and Access Logs
D. Database Logs
A. Network Logs
Quiz-Answer
C. Identity and Access Logs
Which log source records successful and failed user login attempts?
A. Network Logs
B. Storage Logs
D. Database Logs
Cloud Logging & Monitoring
By Content ITV
