# Enhancing Cloud Security--Proactive Threat Monitoring and Detection Using a SIEM-Based Approach
## 1 Introduction  
The rapid adoption of public cloud services has prompted organizations to migrate their valuable data from on-premises servers to cloud data centers. Recent reports [1] indicate that a significant portion of global businesses, approximately 70%, currently conduct their daily activities in the cloud, with Microsoft Azure, Amazon Web Service (AWS), and Google Cloud Platform (GCP) emerging as the top three cloud service providers (CSPs) [2]. These providers offer a range of services based on the primary cloud services model, namely Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS). While cloud services offer various benefits, ensuring the security of cloud resources remains a critical concern due to the prevalence of cloud data breaches [3, 4]. Over the past decade, security has consistently emerged as a prominent challenge in the cloud landscape, as highlighted in a series of cloud state reports published by Flexera [2]. Key security issues include data security, confidentiality, and integrity [5]. Industry experts have highlighted [6] cloud platform misconfiguration, sensitive data leakage, insecure interfaces/APIs, and unauthorized access as the primary cloud attack vectors. The latter raises a significant question of who bears the responsibility for configuring and safeguarding cloud resources? In traditional settings, organizations assume full responsibility for securing on-premises systems. However, in the realm of public cloud environments, this responsibility is shared between cloud service providers (CSPs) and their customers. According to this model, cloud customers must ensure that they uphold security, governance, and compliance measures \"in the cloud\", while the CSPs are accountable for the security\"of the cloud\" (physical and infrastructure security) [7]. Table 1 demonstrates the overall structure of the shared responsibility model, which highlights the potential variability in the distribution of responsibilities between CSPs and their customers, contingent on the type of cloud service model employed [8]. However, the exact responsibilities of each party can vary depending on the specific CSP, and each CSP has its own standard security control. It is important for cloud customers to understand the shared responsibility model of their CSP and to take appropriate steps to secure their own data and applications in the cloud. Likewise, as organizations continue to migrate their data in the cloud environment, they still must comply with data and technologies regulations like General Data Protection and Regulations (GDPR), Health Insurance Portability and Accountability Act (HIPPA), and Payment Card Industry Data Security Standards (PCI-DSS) [9]. Those regulations enforce the implementation of policies and practices to protect Personal Identifiable Information (PII) and other standards depending on the organization's service type [10]. Compliance is not synonymous with security; however, it is one of the security processes. Complying with such regulations can help organizations pass IT security audits or any other audit relevant to a particular standardization. Failing to comply can cause an organization to pay high amounts of fines and can cause reputation damage. Irrespective of the type of cloud service deployment, there are responsibilities that the cloud customers always retain. Those include ensuring the security of their data, accounts, endpoints protection, and access management. Thus, the above-explained model shows that the data propriator (the entity that stores data in the cloud) has the responsibility for implementing proper configurations to protect its data and control who can access those data. Furthermore, the EU's GDPR data privacy legislation, which went into effect on 25 May 2018, explains that the responsibilities of securing personal data are on the data owner's shoulders, not the CSP's [11]. They must also ensure that the cloud providers with whom they collaborate support appropriate security and compliance safeguards.