Six Cloud Threat Protection Best Practices from the Trenches

By Ajmal Kohgadai, Product Marketing Manager, Skyhigh Networks

As enterprises continue to migrate their on-premises IT infrastructure to the cloud, they often find that their existing threat protection solutions aren’t sufficient to consistently detect threats that arise in the cloud. While security information and event management (SIEM) solutions continue to rely on rule-based (or heuristics-based) approach to detect threats, they often fail when it comes to the cloud. This is, in large part, because SIEMs don’t evolve without significant human input as user behavior changes over time, new cloud services are adopted, and new threat vectors are introduced.

Without a threat protection solution built for the cloud, enterprises can suffer data loss when:

• Malicious or careless insiders download data from a corporate sanctioned cloud service, then upload it to a shadow cloud file sharing service (e.g. Anthem breach of 2015)
• An employee downloads data onto a personal device, regardless of being on or off-network, at which point control over that data is lost
• Privileged users of a cloud service (such as administrators) change security configurations inappropriately
• An employee shares data with a third party, such as a vendor or partner
• Malware on a corporate computer leverages an unmanaged cloud service as a vector to exfiltrate data stolen from on-premises systems of record
• A user endpoint device syncs malware to a file sharing cloud service and exposes other users and the corporate network to malware
• Data in a sanctioned cloud services is lost to an insecure and unmanaged cloud service via an API connection between the two services

However, even the most advanced cloud threat protection technology can be rendered ineffective when it’s not being used to its fullest potential. Below are some of the proven best practices and must-haves when implementing a cloud threat protection solution.

1. Focus on multi-dimensional threats, not simple anomalies – a user logs in from a new IP address, or downloads a higher than average volume of data, or changes a security setting within an application. In isolation, these are anomalies but not necessarily indicative of a security threat. Focus first on threats that combine multiple indicators and anomalies together, providing strong evidence that an incident is in progress.
2. Start with machine-defined models, then refine – aside from accuracy limitations, it’s difficult to get started with threat protection by configuring detailed rules with thresholds for which you have no context. Start with unsupervised machine learning – that is software that analyzes user behavior and automatically begins detecting threats. Augment with feedback later to fine tune threat detection and reduce false positives.
3. Monitor all cloud usage for shadow and sanctioned apps – cloud activity within one service might appear routine because threats are often signaled by multiple activities across services. Correlate activity across other apps and a pattern will start to appear if a threat is in motion. That’s why it is important to start with visibility into both sanctioned and unsanctioned cloud services to get the full picture.
4. Leverage your existing SIEM and SOC workflow – events generated by a cloud threat protection solution should flow into existing SOC/SIEM solutions in real time via a standard feed. This capability will allow security experts to both correlate cloud anomalies with on-premises ones while also allowing the integration of cloud threat incidence response with incident response workflows within their existing SOC/SIEM.
5. Correlate cloud usage with other data sources – looking at a single data source to detect threats is inadequate. It is necessary to bring in additional information for context. That data can include whether the user is logging in using an anonymizing proxy or using a TOR connection, or whether her account credentials are for sale on the Darknet.
6. Whitelist low-risk users and known events – a general rule of thumb is to allow the threat protection system to generate as many threat events as the security team has the bandwidth to follow up on. One way to do it is to test the system by increasing thresholds. Another way is to whitelist events generated by low risk (trusted) users. This capability can protect your IT security from being inundated with false positives.