TMCloud (in)security:
Your guide to stronger
cloud security with NDRTHE CLOUD STORM

In 2020, digital transformation across all sectors
accelerated at lightning speed out of sheer
necessity — including rapid migrations to thecloud. Now, as we take a breath after the storm
and revisit those decisions, it’s time to takeanother look at the fundamentals of cloud security
for your IT infrastructure.
Once just a subchapter of a larger enterprisecybersecurity strategy, cloud security now is often
the whole book. IDG has found, for instance, that
92% of an organization’s IT environment is at least
somewhat in the cloud today. For the greater goodof cybersecurity, everyone must ask,

HOW CAN CLOUD SECURITY RISE TO THE TOP OF
THE AGENDA OF OR, AT THE VERY LEAST, CATCH UP
IN THE POST-PANDEMIC ENTERPRISE?

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

2

THE CLOUD STORMThis guide will help you take several steps back in order to move
many steps forward on behalf of your enterprise’s holistic efforts
to embrace the business-centric promises of the cloud: scalability,agility, efficiency, improved user experiences, and reduced cost.

Specifically, you will learn the following:ȱCommon cloud security vulnerabilities and challenges

ȱ

How to achieve greater visibility in the cloudȱWhat threat-sharing means for stronger cloud securityȱHow to achieve defensive economies of scale through Collective Defense

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

3

TOP CLOUD VULNERABILITIESWhat are the top
cloud vulnerabilities?
Protecting data, applications, and assets in the cloud starts with understanding common
vulnerabilities associated with cloud security. Although cloud service providers (CSPs) havegone to great lengths to secure cloud infrastructure, adversaries are taking advantage of security
weak spots that enterprises themselves are responsible for tightening up (per the CSP’s shared
responsibility models), including misconfigurations, poor access control, and insecure APIs.

Databreaches

Insecure interfaces
and APIs

Lack of cloudsecurity architecture

Inadequatechange control

Misconfigurationof cloud systems

Rapidcloud migration

Limited visibility
to cloud usage

AccounthijackingPoor

Supplyaccesscontrol
chain risk
IronNet Cloud Security Guide | © Copyright2021. IronNet
Cybersecurity, Inc. All rights reserved.

4

TOP CLOUD VULNERABILITIESTackling a top vulnerability:
misconfiguration
In its guidance to cloud security, the U.S. National Security Agency (NSA)
lists the top four classes of cloud vulnerabilities as:

IronNet partner Unlimited Technologyadvises a “RED PEN” approachto avoiding misconfigurations:1

Misconfiguration

R

2

Encrypt all data
at rest & flight

Shared tenancy vulnerabilities

D4by least privilege

Poor access controlE3

Restrict Access

Disable cloud resourcesthat are not needed

Supply chain vulnerabilities

P

Prevent Accessto privileged accounts

Misconfigurations and weak access controls, however,are just the gates at the cloud. It goes without saying thatyou can’t achieve in-depth cloud security if you don’t knowwhat is in the cloud: complete visibility is critical. NetworkE

Ensure encryption keys
are rotateddetection and response tools that leverage behavioral
analytics provide this missing visibility.

NNeed NDR and HBM for 100%
visibility into Layer 2 and 3

Watch the “Cloud (in)security: Avoiding
common cloud misconfigurations”
on-demand webinar.
5

GAINING BETTER VISIBILITY IN THE CLOUD

Gaining better visibility
in the cloud
What level of visibility in the cloud do you need? You should be able to answer these threequestions at all times to ensure that you can see any anomalous activity in your cloudenvironment (whether public, private, hybrid, or multi-cloud):

1

What’s on your network?

2

Who’s on your network (i.e., are the right people accessing)?

3

What’s happening on your network?

To answer these questions successfully, you need to be able to see the raw
network flows to and from the cloud. Although all CSPs offer logging andmonitoring tools to capture a history of all API calls (e.g., the caller’s identity,
source IP address, and request parameters), only fine-tuned detection
capabilities for determining anomalous behaviors within the network traffic
will truly secure what’s in the cloud.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

6

GAINING BETTER VISIBILITY IN THE CLOUD

Seeing the truthin the trafficwith NDR
Network detection and response (NDR) solutions driven by
behavioral analytics enable you to see the truth in the traffic
from network data, including both network logs and sensor-

Understanding shared
responsibility models

99%

based traffic, closing the known visibility gap that plagues
full-on cloud adoption.
With AWS and Azure integrations, for example, IronNet’sIronDefense can access cloud logs to detect and analyze
threats and provide anonymous, correlated context that no
single enterprise would have on its own. This capability gives
the enterprise the visibility it needs to take timely and relevant
action on what they now are able to see with IronDefense,
instead of being left in the dark.

of cloud security
failures through2025 areexpected to be
the customer’s
fault not the CSP’s
GARTNER

Confusion about who is responsible for cloud security can leadto security gaps. Remember this: the security “of the cloud”

Read more

Arrow-rightfalls on the CSP’s shoulders, whereas the responsibility ofsecuring assets and data “in the cloud” falls on the enterpriseitself. Armed with cloud analytics to spot anomalies on thenetwork, enterprises — not the CSP — still must charge ahead
with seizing this approach to fill this visibility gap as expectedof the shared responsibilities models outlined by AWS andAzure, for example.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

7

GAINING BETTER VISIBILITY IN THE CLOUD

Is the cloud moresecure thanon-prem?
With NDR that leverages behavioral analytics, you can actually
boost visibility into your network activities – and potentiallymalicious behaviors – versus on-premise visibility. Behavioralanalytics can reveal two types of visibility:

1

Visibility of user activity inside yourcloud resources (that is, what users
are doing)

2

Visibility of interactions between themachines in the cloud (both thoseIT security
practitioners arelikely to turn to[NDR] to gain better
visibility into theirown cloud traffic.
In fact, 80% ofrespondents noted
their awareness that
NDR technology canbe applied to cloud
traffic. Among those
respondents, 48%
see as its primaryvalue the ability
to detect threats
and anomalies inreal time.”(EMA CloudResearch Report).

within the enterprise’s cloud space
and those interacting outside thecloud), using approaches such as
traffic mirroring

Read more

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

Arrow-right8

GAINING BETTER VISIBILITY IN THE CLOUD

Some would argue that the cloud is, in fact, more secure given that you can see only themachine-to-machine interactions with on-premise infrastructure. In cloud environments, by contrast,
both logs (e.g., AWS VPC, Azure NSG) and sensors (AWS virtual sensor) enhance this visibility.

IronDome

Cloud visibility with IronNet’s
IronDefense NDR solution
COMPANY 2
COMPANY 1

COMPANY 3

CloudConnect
IronDefense
IronDefense Back-end
SplunkIronSensor
PCAP Store

3rd Party Sensors

ExpertSystemAnalytics
EngineCOMPANY 2
NETWORK TRAFFICCOMPANY 3
NETWORK TRAFFICIronAPI

Cortex XSOAR
CrowdStrike
ServiceNow

Bro/Zeek
COMPANY 1
NETWORK TRAFFICQRadarSwimlane
Splunk Phantom

DHCP/Radius Logs
Proxy. DNS Logs

Office 365

Prioritized
Events/Alerts

Hunt
Platform

Palo Alto

COMPANY 1
COMPANY 2
COMPANY 3

In the cloud, regardless of the provider, it is impossible for someone with access to your enterprise’s accountto secretly create something in your account. You have full control over anything created in the account(vs. someone sneaking into the building and installing a device in an on-prem data center). Because of theabstraction between you and CSP data centers, moreover, your enterprise would not be affected should an(highly unlikely) on-prem compromise hit the CSP data center.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

9

FOUR TIPS FOR ENHANCING CLOUD SECURITY

Four tips for enhancingcloud security
1

Cloud security tip #1:
Set a baseline for normal
It is crucial to set baselines around what constitutes normal network behavior
to and from the cloud. Being able to get granular and understand what is truly
moving around your network is the only way you are going to be able to set abaseline in order to catch out-of-place activity down the line such as potential
data access and data leakage after cloud migration.
Armed with this baseline from logs, you can leverage network behavioral
analytics to automatically audit this baseline on a regular basis to check andvalidate this ground level of truth. Threat hunting — informed by data bothwithin and beyond the individual enterprise — adds another layer of validating
potential anomalies against what you expect on the network. It is in this waythat Network Detection and Response solutions that leverage algorithms
based on machine learning and hunt capabilities and enrichments canamplify basic log-based cloud security controls.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

10

FOUR TIPS FOR ENHANCING CLOUD SECURITY

2IronNet and AWS

Cloud security tip #2:
Invest in cloud-specificanalytics

working together toimprove cloud security
IronNet offers a set of CloudTrail
Analytics that complement andenhance the offerings of Amazon
GuardDuty account compromise

Not always included in the CSPs’ analytics platforms,
cloud analytics can strengthen your cloud security postureeven more. For example, the IronNet cloud analytics usedin the IronDefense NDR solution can differentiate between
bot traffic and human traffic, as well as detect suspicious
human activity such as privilege escalation. Visibilityof the raw traffic adds a layer to a defense-in-depth
approach, eliminating the huge blind spot that deters
many from embracing the benefits of cloud computing.

analytics. GuardDuty offers
a number of network traffic
analytics that are only for the AWS
instance, while IronNet focuseson increasing the enterprise’s
visibility into their enterprisenetwork while offering anenhanced set of analytics throughthe IronDefense offering.

Get the details

Arrow-rightGet the details

Arrow-rightSuperior behavioral detection for Microsoft Azure
IronDefense scales from small companies to Fortune100
companies to deliver unmatched behavioral detection
across Azure, on-premise, or multi-cloud environments.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

11

FOUR TIPS FOR ENHANCING CLOUD SECURITY

3

Cloud security tip #3:
Improve your threat responsewith real-time threat sharing
The visibility enabled by behavioral analytics can be expanded throughreal-time threat sharing. IronNet’s Collective Defense platform builds a dynamic,
comprehensive picture of the threat environment, much like radar for cyberspace,based on real-time, anonymized alert correlation across any participating
member environments. These correlations are the basis of the dynamic threat
picture that makes much greater visibility possible at any given time.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

12

FOUR TIPS FOR ENHANCING CLOUD SECURITY

4

Cloud security tip #4:
Speed up response timewith crowdsourced
peer insights
A Collective Defense approach allows community members
to share threat context, prevalence, and expert commentary
about how to triage and respond (much like Waze but forcyber). By banding together and working together withpeers in real time, Collective Defense communities are
better able to pool and optimize resources so they canachieve “defensive economies of scale.”87%
99%
of organizations
willing to sharethreat information
with industry peers
To improve cloudsecurity, mostorganizations
that usethreat intelligencefeeds to identify
and secure threats
are open to sharing if
doing so improves
their own ability todetect cloud threats.
EMA CLOUDRESEARCH REPORTIronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

13

CLOUD WITH CONFIDENCE

With cyber criminals andIn other words, it is up tonation-state adversaries

the enterprise — the CSP

waiting to pounce on cloudcustomer — to secure theirsecurity gaps, no company canenvironment in the cloud withafford what essentially was athe same level of vigilance as“cross-our-fingers” approachon-prem computing environments.

to cloud security. Adapting
perimeter defenses and on-premiseCollective Defense, poweredcontrols as a quick fix will neverby behavioral analytics, gives

work for either an immediate or acompanies the missing visibility

long-term cybersecurity posture.

that has deterred many from taking

Nor can companies rely on trusted,

the leap to the cloud, empowering

public cloud security providers

them to approach their digitalto cover cloud security for them;transformation with confidence,that onus is one shared with thewith cloud as a business enabler

enterprise as explained by CSP

instead of the great unknown.

shared responsibility models.

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

14

CLOUD WITH CONFIDENCE

IronNet has partneredwith AWS, Azure, and AWS
GovCloud as part of its
broader security ecosystem.

Learn more about our cloud partners

Arrow-right

Connect with IronNet today to discover
the power of Collective Defense
informed by behavioral analytics.
IronNet.com Arrow-rightTM

IronNet Cloud Security Guide | © Copyright 2021. IronNet Cybersecurity, Inc. All rights reserved.

15