Cloud Based Security Alerting from Scratch

No ratings

Presented at GrrCon2018 2018 by

The current state of monitoring in Google Cloud Platform (GCP) and other cloud based platforms is less than ideal. Established methodologies include significant downsides – for many of these schemes, obvious bypasses exist for attackers and mischievous users, and developers are often inconvenienced. We have examined current alerting mechanisms and will present their strengths and [EXPLOITABLE] weaknesses. More importantly, we have devised alternative strategies that allow administrators to go beyond these limitations in a cheap, effective, and safe way by emulating technologies that exist within AWS and other cloud environments. This talk will prove that administrators can achieve effective monitoring in GCP despite the limited configuration options currently offered.Although we intend to focus on GCP, we will also examine some of the strengths and weaknesses of other platforms, including AWS. We intend to demonstrate monitoring and alerting strategies that will help administrators seeking to enforce policies or detect successful attacks and misuse.