# Enhancing Cloud Security--Proactive Threat Monitoring and Detection Using a SIEM-Based Approach
## 1 Introduction
In other words, organizations still own their data and identities even in the public cloud. Hence, they are ultimately responsible for their security and all other components found under their control. Moreover, various reports and guidelines published by organizations and agencies such as ENISA, the European Union Agency for Cybersecurity [12], and the US National Institute of Standards and Technology (NIST) [13] emphasize that cloud security is a shared responsibility between the involved parties (cloud actors). Each party should understand their roles and obligations and establish clear and transparent contracts and service level agreements that specify the security objectives, controls, and metrics. The NIST Cloud Computing Reference Architecture [13] outlines the five main cloud actors, comprising (1) the cloud consumer--a person or an entity that uses cloud services or resources from a cloud provider; (2) the cloud provider--an entity that provides cloud services or resources to \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Responsibility** & **On-Premises** & **IaaS** & **PaaS** & **SaaS** \\ \hline User access & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Data & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Application & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Runtime Environment & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Middleware & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Operating System & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Virtualization & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Servers & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Storage & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ Networking & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) & \(\blacktriangledown\) \\ \hline \hline \end{tabular} Note: The checkmarks \(\blacktriangledown\) denote the responsibilities retained by the cloud customer, whilst the arrows \(\blacktriangledown\) are indicative of the responsibilities transferred to the CSP.  
\end{table} 
Table 1: Division of responsibility between CSP and customer, adapted from [8]. cloud consumers; (3) the cloud auditor--the entity that conducts independent assessments of the cloud services or resources, such as security, performance, and compliance; (4) the cloud broker--the entity that intermediates between cloud consumers and cloud providers; and (5) the cloud carrier--the entity that transports data between cloud consumers and cloud providers, such as by providing network connectivity or bandwidth. While we acknowledge the significance of all cloud actors, comprehending their responsibilities and developing policies and procedures for their respective aspects of cloud security, this study particularly emphasizes the responsibilities of cloud consumers. NIST has recently introduced a Cybersecurity Framework 2.0 (public draft) as an updated version of its predecessor, aiming to align with the continually evolving cybersecurity landscape and assist organizations in more efficiently managing cybersecurity risks. The framework outlines six core functions to achieve cybersecurity outcomes. These encompass the following [14]: (1) Govern--establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy. (2) Identify--help determine the current cybersecurity risk to the organization. (3) Protect--use safeguards to prevent or reduce cybersecurity risk. (4) Detect--find and analyze possible cybersecurity attacks and compromises. (5) Respond--take action regarding a detected cybersecurity incident.