The slides from Eugene Kogan's talk on cloud security monitoring at Auth0, presented at Security BSides Seattle, 2017. More details at our blog: https://auth0.engineering/cloud-security-monitoring-at-auth0-ff5e87ad1141

1. Cloud Security
Monitoring
Security BSides Seattle
Eugene Kogan - @eugk - February 4, 2017
(for startups, mostly)

2. 1. Who
2. Why
3. What
4. How
5. When

3. 1. Who

5. CloudSecurityAlliance.org

7. 2. Why

12. 3. What

14. –President Ronald Reagan
Trust, but verify.

15. Awareness
Visualization
Misuse detection
Change detection
Incident detection
Incident response

16. Splunk
Graylog
Elastic Stack
Loggly
Logentries
Fluentd
Sumo Logic
AWS
G Suite
Dropbox
GitHub
GitLab
Slack
Zendesk
Salesforce
Jenkins
Syslog
Webhooks

17. 4. How

22. _sourceCategory=cloudtrail_aws_logs* | json auto | where event_name
matches "*Trail" or event_name matches "StartLogging" or event_name
matches "StopLogging" | lookup awsaccountname from /shared/
awsaccounts on recipient_account_id = awsaccountid | count as count
by event_name, recipient_account_id, awsaccountname, user_name,
principle_id, accesskey_id

29. github.com/auth0/audit-droid

30. github.com/a2o/snoopy

31. github.com/nccgroup/Scout2

32. 5. When

33. You should be doing
cloud security monitoring
today.

34. Action items
Know which cloud services your organization uses
Have a modern platform for collection, analysis, alerting
Collect the right data from cloud and internal systems
Use this data wisely
Ensure your staff has the right skills to do all of the above

35. The end 🖖
auth0.engineering/tagged/security
twitter.com/eugk