Enhancing Cloud Security—Proactive Threat Monitoring and Detection Using a SIEM-Based Approach

Abstract

With the escalating frequency of cybersecurity threats in public cloud computing environments, there is a pressing need for robust security measures to safeguard sensitive data and applications. This research addresses growing security concerns in the cloud by proposing an innovative security information and event management system (SIEM) that offers automated visibility of cloud resources. Our implementation includes a virtual network comprising virtual machines, load balancers, Microsoft Defender for Cloud, and an application gateway that functions as a web application firewall (WAF). This WAF scans incoming Internet traffic and provides centralized protection against common exploits and vulnerabilities, securing web applications within the cloud environment. We deployed the SIEM system to automate visibility and incident response for cloud resources. By harnessing the power of this employed SIEM, the developed system can continuously monitor, detect security incidents, and proactively mitigate potential security threats. Microsoft Defender for Cloud consistently assesses the configuration of cloud resources against industry standards, regulations, and benchmarks to ensure compliance requirements are met. Our findings highlight the practicality and effectiveness of deploying such solutions to safeguard cloud resources, offering valuable insights to organizations and security professionals seeking sustainable and resilient security measures in the cloud computing environment.

Systematic Literature Review on Cloud Computing Security: Threats and Mitigation Strategies

“…Organizations need to develop an effective cloud computing security system for the early detection of threats and errors. They can use SIEM to detect early threats and ensure overall cloud security [33]. Security information and event management is like a guardian responsible for continuously collecting and analyzing data from different sources within the cloud network.…”

“…This enables them to actively contribute to protecting sensitive resources and information within the organization. A security-conscious culture of an organization is characterized by a collective recognition of the importance of cybersecurity measures, fostering an environment where all employees are encouraged to report suspicious activities [33]. This culture follows security protocols and is integral to maintaining a secure cloud network.…”

Securing the Skies- A Critical Analysis of Cloud Infrastructure Vulnerabilities

“…SIEMs are frequently used to prevent data loss in computer systems and networks. Because of their capacity to instantly detect and address security incidents by monitoring logs and correlating data in real-time, they can be especially helpful in cloud environments [34]. Automating cloud resource visibility is a key advantage of adopting a SIEM-based approach to cloud security.…”

“…Automating cloud resource visibility is a key advantage of adopting a SIEM-based approach to cloud security. A virtual network comprising load balancers, virtual machines, and a web application firewall (WAF) that scans incoming Internet traffic and offers centralized protection against common exploits and vulnerabilities can be used to accomplish this [34]. Organizations can proactively mitigate potential security threats in the cloud environment and continuously monitor and detect security incidents by utilizing the power of a SIEM system.…”

“…An additional benefit of employing a SIEM-based strategy for cloud security is the capacity to guarantee adherence to regulatory requirements. For instance, Microsoft Defender for Cloud can reliably evaluate how cloud resources are configured in comparison to industry norms, laws, and benchmarks to make sure compliance requirements are satisfied [34]. To summarize, a cloud security strategy based on SIEM can offer enterprises a reliable and efficient means of protecting their cloud assets, streamlining visibility and incident handling, guaranteeing adherence to regulations, and enhancing the ease of data organization and storage.…”