Auditing all the Things' for Smarter Detection and Faster Incident Response

No ratings

Presented at cloudopen 2014 by

Mark Thomas

Linux is thriving on servers and serves as the underpinning of many cloud software deployments. However, there are concerns at the enterprise level about the security of Linux-based cloud deployments. The Linux OS has many powerful auditing capabilities -- Mark will discuss current audit APIs in the Linux kernel and what exists in terms of its collection ability. He’ll go over the open source tools available to interface with audit data, and the advantages and limitations they have in terms of performance, collection and querying. He’ll explain how to leverage this data as a powerful tool for intrusion detection and incident response. In particular, when deploying in hosted cloud environments where your company doesn’t own the network infrastructure, there must be a level of monitoring and auditing on the host which compliments or exceeds the visibility you get from traditional IDS tools