Internal document, for peer review
Cloud-Provided IMaaS Implementation
Download 106.79 Kb.
|
- Navigate this page:
- 4.2.1Intrusion Management Infrastructure
- 4.2.2Policy Implementation
- 5References and Useful Links
- 5.1References
4.2Cloud-Provided IMaaS ImplementationAs most of the guidance in the architecture section includes both potential architecture options at each layer within the target environment as well as necessary protections provided, this section need only provide guidance for implementation of those capabilities as a cloud-provided service. As indicated in the Introduction to this guide, since the market is immature and there is a lack of significant best practices or common architectures for implementing IM, let alone as a SecaaS, this version of the implementation guide provides only structural considerations for IMaaS and leaves room for additional guidance in future versions. 4.2.1Intrusion Management InfrastructureIM Infrastructure would include the distributed and/or cloud-based capabilities for management of policies, devices, and resultant data as well as the mechanisms for central collection and reporting and interfaces to event correlation served by all sources for context aware management and dynamic response. This may be an overlap or merely an interface to the SIEM service solution. Infrastructure also may include features such as configuration and signature management and should incorporate appropriate policy and process for the management of the detection of and response to intrusion as fed by SIEM or manual intervention. It is critical to rectify integration concerns related to data management, policy or signature deployment, and roles and responsibilities for authorizing or approving changes to the system. Access to, format of, and data flow from log files and other system-based information are critical to success of centralized management and cloud delivery. 4.2.2Policy ImplementationIMaaS solutions need to provide proactive, policy-based monitoring and protection to help organizations secure their physical and virtual server environments, as well as the business critical applications, databases, directories and file stores whether they reside within cloud-based servers or on systems outside the cloud infrastructure. Cloud based solutions should provide a protection policy library containing prevention and detection policies that can be used and customized to protect critical hosts.
IMaaS should have both policy management and policy enforcement processes and communications channels in order to integrate with customer systems and infrastructure to centrally report and potentially execute the following capabilities:
5References and Useful LinksAs stated in section 1.2 Scope, this implementation guide does not cover the specifics of detection algorithms or prevention schema, nor can it fully convey the complexities of all possible architectures and rather focuses on the considerations, standards, infrastructure, and processes required to implement a SecaaS Intrusion Management service set. Therefore, to account for a rapidly changing industry segment, the following reference information and useful links are provided for further research as well as maintaining up to date information about the content found in this implementation guide and related topics. 5.1ReferencesGarfinkel, T., & Rosenblum, M. (n.d.). A Virtual Machine Introspection Based Architecture for Intrusion Detection. Computer Science Department, Stanford University. 5.2Useful LinksCloud Security Alliance Guidance https://cloudsecurityalliance.org/guidance/csaguide-dom12-v2.10.pdf Cloud Security Alliance is a global vendor-neutral standards body aimed at providing significant advancement of cloud security through standards and guidance. Version 2.10 of the CSA Guide on Security categories provides the basic tenants of each of the major domains of cloud security and is the framework within which this and other guides provide further detail. Other guides such as this one are available for download from the CSA website as they become available and are updated. NIST Guide to Intrusion Detection and Prevention Systems (IDPS) http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf The National Institute of Standards and Technology is a US Federal agency responsible for providing standards under which the US Government will use and employ technology. The IDPS guide is a comprehensive set of standards for the deployment of intrusion detection and prevention systems within and in support of the Federal enterprise. Intrusion Detection http://en.wikipedia.org/wiki/Intrusion_detection_system Intrusion Prevention http://en.wikipedia.org/wiki/Intrusion_prevention_system Directory: wp-content -> uploads -> 2012 2012 -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It? 2012 -> Aa and na members Dying from Tobacco 2012 -> [Baby Crying] 01: 04 [Ching 2012 -> Unit Name / Nom de l’unité uic / ciu dates 2012 -> What We Owe Jehovah’s Witnesses 2012 -> Oceans Challenge Badge 2012 -> Canadian cycling olympians 2012 -> Greg landry, june olkowski and tom lysiak 2012 -> William goldman 2012 -> Does translocation and restocking confer any benefit to the European eel population? A review Download 106.79 Kb. Share with your friends:
|