Towards A “Social Network” of Monitoring and Incident Management in the Cloud?

I recently read a very interesting article called “Log files – are you reviewing yours?”. Organisations often fail to fully leverage and analyse the audit log information that is collected within their IT and business environment …

Things might get worse when more and more organisational services and IT infrastructure is outsources in the Cloud …

This triggered a few thoughts about how assurance could be provided in the Cloud and how this could be done effectively to handle various degrees of risks.

Interestingly, when outsourcing in the Cloud, part of the organisational control on IT and processes is lost. This might include the ability of logging information at the desired level of granularity and timely acting on it, e.g. in case on incidents …

Which mechanisms should be put in place to enable organisations to get timely information, including logs and incidents, from their Cloud Service Providers?

This has an impact not only on SLAs and contractual agreements but also on technical solutions that needs to be deployed to:

- enable Cloud service providers to flexibly collect log information, at different level of abstractions in the IT stack – for specific customers - and provide it to organisations
- enable organisations to deal with mixed sources of log files, with potentially different level of accuracy and trust, to drive their audit & compliance management activities as well as incident management processes

It is going to be a “recursive” issue, as Cloud Service providers might rely on other providers in the Cloud …

I envisage a situation where enterprises’ business and governance requirements will dictate a wider collaboration between various Service Providers in order to collect, process, sanitise and share “logs information” and incidents.

Are we moving towards Federated Monitoring in the Cloud i.e. a sort of “Social Network” of Monitoring and Incident Management in the Cloud? …


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Providing Assurance within Organisations …

I am interested in exploring how organisations effectively tackle the “assurance” angle, i.e. how they can assess the degree of compliance to their (security and business) policies and which evidence they need to assess how loosely they meet their governance objectives.

I believe this is a complex, multi-facet problem as it involves:

• Organisational policies
• Potential threats and related risks
• Processes and controls put in place to mitigate these risks
• Areas that are anyway vulnerable and need further monitoring and introspection
• Technologies and solutions to log, monitor/audit and correlate various information collected within (and potentially across) the IT stack of the organisation
• Relevant metrics to convey issues and problems to a variety of stakeholders, including IT managers, security and risk managers, business managers, etc.
  

Indicatively, the above steps are part of a loop that requires periodic reassessment and modification of policies and strategies, as the environment (people, technologies, objectives and threats) are in continuous evolution.

I am looking for case studies, documents and public material providing instances of how the overall process is actually carried out within organisations.

In particular, I am interested in better understanding the decision making process (carried out by strategic decision makers such as CIOs, CISOs) that is at the base of adopting monitoring controls, in particular “Security Incident Event Management (SIEM)” solutions.

Here are a few specific questions I am interested to explore:

• Which areas are usually perceived being at risk and require further monitoring?
• How trade-offs between investments and costs are actually dealt with by the various stakeholders?
• Which evidence is usually provided to the stakeholders to reassure them that specific risks are mitigated by monitoring specific areas (e.g. with SIEM tools)?
  

Ideally, I’d like to investigate the economic framework. trade-offs and the decision making process that is at the base of making investments in SIEM solutions and how Security Analytics (decision support by means of modelling and simulation) can help in this space …


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---