Continuous auditing and threat detection in multi-cloud infrastructure
| Autor: | Christoph Meinel, Feng Cheng, Muhammad I.H. Sukmana, Kennedy A. Torkura |
|---|---|
| Rok vydání: | 2021 |
| Předmět: |
Configuration management
Cloud computing security General Computer Science Exploit Computer science business.industry Vulnerability 020206 networking & telecommunications Cloud computing 02 engineering and technology Fault injection Computer security computer.software_genre Continuous auditing 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing business Law computer Cloud storage |
| Zdroj: | Computers & Security. 102:102124 |
| ISSN: | 0167-4048 |
| DOI: | 10.1016/j.cose.2020.102124 |
| Popis: | Efficient change control and configuration management is imperative for addressing the emerging security threats in cloud infrastructure. These threats majorly exploit misconfiguration vulnerabilities e.g. excessive permissions, disabled logging features and publicly accessible cloud storage buckets. Traditional security tools and mechanisms are unable to effectively and continuously track changes in cloud infrastructure owing to transience and unpredictability of cloud events. Therefore, novel tools that are proactive, agile and continuous are imperative. This article proposes CSBAuditor, a novel cloud security system that continuously monitors cloud infrastructure, to detect malicious activities and unauthorized changes. CSBAuditor leverages two concepts: state transition analysis and reconciler pattern to overcome the aforementioned security issues. Furthermore, security metrics are used to compute severity scores for detected vulnerabilities using a novel scoring system: Cloud Security Scoring System. CSBAuditor has been evaluated using various strategies including security chaos engineering (fault injection) strategies on Amazon Web Services and Google Cloud Platform. CSBAuditor effectively detects misconfigurations in real-time with a detection rate of over 98%. Also, the performance overhead is within acceptable limits. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect