Techniques for cloud security monitoring and threat intelligence
Systems and methods for cloud security monitoring and threat intelligence in accordance with embodiments of the invention are disclosed. In one embodiment, a process for monitoring and remediation of security threats includes generating a threat model using a first portion of activity data, identifying, based upon the threat model, a threat using a second portion of activity data, selecting a security policy to implement in response to the identified threat, identifying cloud security controls in a remotely hosted cloud application server system to modify in accordance with the selected security policy, establishing a secure connection to the remotely hosted cloud application server system using login credentials associated with a tenant account with the cloud application, and sending instructions to the remotely hosted cloud application server system to set the identified cloud security controls with respect to the tenant account in accordance with the selected security policy.
1. A method comprising:
accessing, by a cloud security system, security configuration data from a plurality of cloud provider systems, wherein the security configuration data comprises information describing security controls that govern access to the plurality of cloud provider systems;
receiving, by the cloud security system, a security policy to be applied to a user of a plurality of cloud applications that are hosted across the plurality of cloud provider systems; and
sending, by the cloud security system, values for the security controls at the plurality of cloud provider systems to govern the user's access to the plurality of cloud applications that are hosted across the plurality of cloud provider systems, wherein a uniform security policy is enforced across the plurality of cloud provider systems by the cloud security system.
2. The method of claim 1 , further comprising:
monitoring, by a cloud security system, activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems;
identifying, by a the cloud security system, a threat based on a correlation of one or more of the activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems; and
selecting, by the cloud security system, the security policy based on the threat.
3. The method of claim 1 , further comprising:
generating, by the cloud security system, security controls metadata comprising normalized descriptors for the security controls from the plurality of cloud provider systems, wherein a normalized descriptor in the security controls metadata is mapped to corresponding security controls at the plurality of cloud provider systems.
4. The method of claim 3 , wherein sending the values for the security controls at the plurality of cloud provider systems comprises:
assigning a value for the normalized descriptor; and
mapping the value to the corresponding security controls at the plurality of cloud provider systems.
5. The method of claim 1 , wherein
the plurality of cloud provider systems provide a plurality of tenant accounts; and
a tenant account in the plurality of tenant accounts provides a user account for the user.
6. The method of claim 1 , further comprising:
monitoring values of the security controls;
detecting a drift in a value in the values of the security controls over time; and
generating a risk event based on the drift in the value.
7. The method of claim 1 , further comprising:
monitoring values of the security controls;
detecting a change in a value in the values of the security controls that is different in the other values of the security controls; and
generating a risk event based on the change in the value.
8. A system comprising:
one or more processors; and
one or more memory devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
accessing, by a cloud security system, security configuration data from a plurality of cloud provider systems, wherein the security configuration data comprises information describing security controls that govern access to the plurality of cloud provider systems;
receiving, by the cloud security system, a security policy to be applied to a user of a plurality of cloud applications that are hosted across the plurality of cloud provider systems; and
sending, by the cloud security system, values for the security controls at the plurality of cloud provider systems to govern the user's access to the plurality of cloud applications that are hosted across the plurality of cloud provider systems, wherein a uniform security policy is enforced across the plurality of cloud provider systems by the cloud security system.
9. The system of claim 8 , wherein the operations further comprise:
monitoring, by a cloud security system, activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems;
identifying, by a the cloud security system, a threat based on a correlation of one or more of the activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems; and
selecting, by the cloud security system, the security policy based on the threat.
10. The system of claim 9 , wherein the operations further comprise:
generating a threat model using one or more of the activities by the user, wherein the correlation is determined based on profile information of the user, the user being associated with a tenant account that provides access to the plurality of cloud applications that are hosted by the plurality of cloud provider systems.
11. The system of claim 8 , wherein the operations further comprise:
establishing connections with the plurality of cloud provider systems to access a tenant account provided by the plurality of cloud provider systems, wherein the connections are established based on credential information for the tenant account; and
accessing one or more activities by the user for across the plurality of cloud applications.
12. The system of claim 8 , wherein the operations further comprise:
determining, using the security policy, a remediation action for at least one of the plurality of cloud applications.
13. The system of claim 12 , wherein the remediation action comprises preventing the user from accessing the at least one of the plurality of cloud applications.
14. The system of claim 8 , wherein the operations further comprise:
providing a user interface that displays the security controls for the plurality of cloud provider systems, wherein the security controls are editable through the user interface.
15. A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause one or more processors to perform operations comprising:
accessing, by a cloud security system, security configuration data from a plurality of cloud provider systems, wherein the security configuration data comprises information describing security controls that govern access to the plurality of cloud provider systems;
receiving, by the cloud security system, a security policy to be applied to a user of a plurality of cloud applications that are hosted across the plurality of cloud provider systems; and
sending, by the cloud security system, values for the security controls at the plurality of cloud provider systems to govern the user's access to the plurality of cloud applications that are hosted across the plurality of cloud provider systems, wherein a uniform security policy is enforced across the plurality of cloud provider systems by the cloud security system.
16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
monitoring, by a cloud security system, activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems;
identifying, by a the cloud security system, a threat based on a correlation of one or more of the activities by the user across the plurality of cloud applications that are hosted by the plurality of cloud provider systems; and
selecting, by the cloud security system, the security policy based on the threat.
17. The non-transitory computer-readable medium of claim 15 , wherein the security controls comprise a password requirement and an authentication process.
18. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
generating normalized activity data by normalizing activities by the user across the plurality of cloud applications.
19. The non-transitory computer-readable medium of claim 15 , wherein:
the user is associated with a user account that is one of a plurality of user accounts in a tenant account;
the tenant account operates each of the plurality of cloud applications hosted by the plurality of cloud service provider systems;
the plurality of cloud service providers operate computer systems that are separate and distinct from each other; and
the cloud security system operates on a computer system that is separate and distinct from the computer systems operated by the plurality of cloud service providers.
20. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
identifying a subset of the security controls that are pertinent to the security policy, wherein values are sent to the subset of the security controls at the plurality of cloud provider systems to govern the user's access to the plurality of cloud applications.