Security Monitoring in the Age of Cloud
September 14, 2021, 10 AM - 1 PM, EDT
CA$349.00
Overview
Cloud technology has transformed IT and security for organizations across all sectors and industries - with unmatched scalability, flexibility, and abundance of new-age capabilities. However, advent of cloud technologies has presented unique challenges for cybersecurity monitoring and operations management. Security operations teams are struggling to monitor events across their on-prem and cloud infrastructure and applications. The modern SOC is expected to integrate data from multiple disparate on-prem and cloud sources, and provide actionable insights to help minimize impacts of cybersecurity incidents. How do we solve this challenge?
In this "Cloud Security Monitoring" workshop, we will explore some of the methods of monitoring in the cloud and build a foundational knowledge of key monitoring technologies. The workshop will provide hands-on walkthrough of cloud security monitoring tools and explore:
- The unique cloud security operations challenges - and opportunities - covering the three major cloud platforms
- The different log and event sources, and their implications in the cloud environment
- How a modern SOC can integrate with on-prem and cloud resources, and provide enhanced visibility to security teams
- Advanced security monitoring using an end-to-end use case configuration on Microsoft Azure Sentinel
The workshop will demonstrate security operations in the cloud using Azure Sentinel as our "go-to" tool, while demonstrating log collection & integration, use case and alert configuration, security dashboards, as well as basics of SOAR (Security Orchestration and Automated Response). It will also cover the various tools supporting tools such as Azure Monitor, Azure Security Center, AWS CloudWatch & CloudTrail, and others to provide a complete picture of monitoring in the cloud.
Key
Takeaways
Workshop attendees will be able to:
- Gain perspective on the best practices for monitoring for on-prem and cloud environments
- Learn about the common tools and technologies, and how to utilize them for effective monitoring
- Visualize security monitoring in cloud by following along a real-world use case for a hypothetical organization's cloud environment
Participants will be provided with workshop material post delivery of the workshop, which will include the session PowerPoint deck and a PDF on "Cloud Security Monitoring 101".
Who Should
Attend
- People with an interest in cloud security architecture, security operations, SIEM engineering
- SOC analysts who want to expand their knowledge to cloud monitoring
- Risk management and internal audit professionals will find the workshop informative to augment their risk assessment and audit work related to cloud environments.
Prerequisites
- Knowledge of any one of the major cloud platforms (Azure, AWS, or GCP) as an IT or technology analyst, security analyst, architect, business analyst or product owner.
- Participants need not be technically hands-on in these cloud environments, but should possess basic knowledge of GUI-based operations in the cloud environment.
- A basic understanding of security monitoring and Security Operations Center (SOC)
Workshop
Agenda
- Understanding Cloud Security Monitoring (20 min)
- Reviewing various types of log sources
- Mechanisms to integrate log sources
- Challenges in cloud security monitoring
- Fundamentals of Azure Sentinel (20 min)
- End-to-end demonstration of use case configuration and deployment in Sentinel, including:
- Log collection from specific Azure resource (20 min)
- Overview of Azure Monitor (App Insight, Monitoring, Log Analytics, etc.) (10 min)
- Building advanced use case, configuring alert and performing security investigation - additionally covering workbooks, dashboards, watchlists, and Azure Security Center (45 min)
- Overview of SOAR and using runbook for automation (20 min)
- Q&A (15 min)
Workshop
Leader
Nikhil Kaduskar