Cloud Hosting

Threat hunting -- the process of proactively searching for signs of malware or an unauthorized intruder -- is a critical part of modern cybersecurity programs. Traditional antivirus programs and intrusion detection systems often miss cutting-edge malware, such as Emotet, or the subtle signs of an advanced persistent threat. An informed, manual threat hunting program can help to find these threats in time to prevent the next stage of attacks, such as ransomware installation.

But what happens when threats invade your cloud environment? Effective cloud threat hunting depends on strong threat intelligence: you need good information in order to successfully hunt down invaders. Many organizations have advanced threat intelligence capabilities in their on-premises environment, but when it comes to the cloud, they are nearly blind.

Now is the time to build your cloud threat hunting program. The problem is that, unlike in on-premises environments, defenders do not have ready access to the same wealth of threat intelligence in the cloud. Here are some of the challenges to threat hunting in the cloud, and tips for surmounting them.

Availability. The cloud is just "someone else's computer," goes the joke. When it comes to logging and monitoring, this is often painfully clear. Many cloud providers offer only very limited event logs, such as records of user authentication, and some do not even provide that. Under pressure from customers, some providers are expanding logging and monitoring capabilities, but security professionals are often foiled by decision-makers who see these features as nice to have rather than as required.

Advanced environments, such as AWS and Azure, offer you an enormous amount of control over "your" systems -- but due to the nature of their shared environments, the ability for users to monitor network traffic is limited. In on-premise environments, defenders can collect network flow records and sniff traffic to detect malicious activity. In the cloud, tools for monitoring virtual networks are not as readily accessible. Amazon and Microsoft both introduced virtual network terminal access point (TAP) capabilities in recent years, but few security professionals have experience using these tools, and the Azure virtual network TAP appears to be under development (the feature has not been consistently available).

Aggregation. To hunt for threats efficiently, practitioners need to be able to easily access intelligence from various sources, ideally using one central console. In on-premise environments, it's easy enough to set up a central server orSIEM to collect logs from various applications and pieces of network equipment. When it comes to the cloud, however, aggregating logs is not so simple. Cloud providers may or may not support log export. When they do, the format of data can vary widely -- and it may change without notice, unexpectedly foiling SIEM ingestion.

This brief video outlines threat hunting's objectives and the key ingredients for a fruitful hunting program.

Expense. Detailed logging in the cloud is rarely on by default. In AWS, for example, CloudWatch monitoring is disabled unless explicitly turned on -- and then a pop-up warns, "additional charges apply." In Microsoft's Office 365, exchange mailbox auditing is now on by default for all new commercial instances -- a change that took place in 2019 after a huge number of customers suffered business email compromise breaches and found that they did not have mailbox logs that they needed to investigate. However, the default retention time is limited to 90 days for many tenants, and customers have to pay for longer retention times.

When it comes to aggregating threat intelligence in the cloud, customers may be charged at every step of the way: for turning logging on, for storing log data in the cloud, for the bandwidth or processing power needed to transfer data to another system, and more. For example, let's say you want to collect log data from AWS and send it to a central Splunk server on Azure. Enabling CloudWatch on AWS requires opening a new Simple Storage Service bucket for local log storage, which costs money. You can use the firehose to push data to another source, which means you are charged for processing power. On Azure, you have to pay for the underlying VM that you use to set up Splunk, as well as for the Splunk license itself. All of this adds up.

Analysis Tools. Tools for cloud threat hunting are nascent. More advanced cloud providers, such as Microsoft and Amazon, have built-in analysis tools, but they often have surprising -- and poorly understood -- limitations. For example, security professionals frequently use Microsoft's graphical Security & Compliance Center to pull Unified Audit Logs (UAL) from Office 365 -- not realizing that the results are limited to 5,000 sorted records or 50,000 unsorted records. Incomplete threat intelligence, of course, leads to shoddy results! Instead, hunters need to use third-party products or custom Powershell scripts to recursively extract large volumes of UAL records. For analysis, products such as Splunk, Extrahop or the open-source Kibana are invaluable.

The cloud is the emerging battleground for bleeding-edge cybersecurity threats. Unfortunately, the constant evolution of threat intelligence, difficulty and expense of aggregation, and nascent cloud-based analysis tools are all challenges for today's defenders. The good news is that cloud monitoring and logging is slowly maturing, and security professionals who push for cloud threat hunting capabilities will reap the rewards.

More here:
Uncover and overcome cloud threat hunting obstacles - TechTarget

Its hard to believe, but even motherboard vendors have factory outlet stores (FOS). Straight from AliExpress comes the Shenzhen FOS, which specialises in new motherboards for obsolete server processors.

Dual X79 motherboard - $76.50 from AliExpress(roughly 63/AU$120)Every now and again, eBay and AliExpress are awash with old servers ditched by the world's cloud computing giants. With this competitively-priced motherboard from Shenzhen FOS, you can take full advantage of these server CPU flash sales.View Deal

Shenzhen FOS has managed to carve out a niche based on the fact that, every now and then, tens of thousands server CPUs flood the market as hyperscalers and cloud computing providers (web hosting, cloud storage, website builders, VPN companies etc.) change platforms.

Suddenly, eBay and AliExpress are awash will old (but still useful) servers dumped by the likes of Microsoft, Google and Amazon - and they're extremely cheap. The problem, however, is that they don't have a consumer-focused, user-friendly motherboard to slot into.

Enter the Shenzhen FOS and a handful of other craftspeople, who fulfil that specific need at a very competitive price.

For example, take this dual X79 motherboard, which can accommodate a pair of Intel Xeon CPUs, supporting E5-1600/E5-2600 Series V1/V2 processors.

You can get a pair of them for sometimes as little as $10 (about 8, AU$12), delivering up to eight cores. Add in the motherboard, which costs $76.50 excluding delivery (about 63, AU$120), and you have a decent barebones system.

If this product comes from mainland China, it will take at least a month to reach either the US or the UK (and potentially more). You may be levied a tax either directly or through the courier.

Have you managed to get hold of a cheaper product with equivalent specifications, in stock and brand new? Let us know and we'll tip our hat to you.

However, we havent tested this motherboard and the usual caveats apply, especially when the website's opening statement reads: Due to different batches of productions, there might be some difference between the pictures you've seen and the motherboard you get. Retail boxes, colors of DIMM slots, SATA ports, PCI or PCI-E Slots and other ports, are subject to change without prior notice.

TL,DR: you may end up with a motherboard that's rather different from the one you thought you were ordering.

Read the original:
This extraordinary motherboard is being used by server CPU scavengers - TechRadar India

VMware and Dell have revealed version 2.0 of their combined on-prem cloud, and upgraded it to handle meatier workloads.

VMware Cloud on Dell EMC sees the latter ship customers a rack full of servers based on the VxRail hyperconverged infrastructure products, running VMwares best private cloud bits vSphere, VSAN and NSX. Users are expected to let Dell techs into their data centres and watch as the hardware is installed switched on, then leave it all alone because Dell owns the rig and is responsible for managing every aspect of its operations including software updates. Buyers can pay as they go, as if it were a public cloud.

Users get a cloud console with which to manage workloads, and more-or-less the same experience as using a public cloud in terms of not having to worry about hardware ops or the underlying software. The product therefore includes dark nodes spare servers that kick in if one of the main nodes has a problem. The dark nodes are included as recognition that stuff sometimes breaks, techs cant teleport in to perform repairs and fixing stuff takes time.

Version 1.0 came in half-height rack and was aimed at the edge and/or important-but-not-enormous workloads.

Version 2.0 ups the ante with new and more powerful host types, full-height racks and the addition of a tech preview of the HCX cloud migration tool, all in the service of taking on more demanding applications, or just more applications. Theres a little more flexibility in that adding nodes is now a scaling option. Support for VMware Horizon VDI and Dells PowerProtect data management products are new additions, while Veeams backup wares have also been certified for the systems.

Also new is a tweak to the cloud console so that it can manage the on-prem VMware Cloud on Dell EMC and VMware Cloud on AWS.

As is VMware's wont, the product presents as vanilla vSphere, so can be stretched into hybrid clouds across the many clouds that run Virtzilla's stack.

Kit Colbert, veep and CTO of VMwares Cloud Platform business unit told The Register customers have asked for bigger rigs, so VMware and Dell has delivered. He said the product will keep evolving, envisaging future variants that employ GPUs or FPGAs.

Sponsored: Webcast: Simplify data protection on AWS

Read the original here:
VMware, Dell level up their combined on-prem cloud with much more computing grunt - The Register

Inefficient and inconvenient information access prompted Uber India to look for a solution that could organise its business data on a central, secure and easy-to-use platform. It was essential for Uber India to integrate the solution into its existing cloud-based infrastructure for different departments and branches to share and retrieve information easily. Hence, on the advice of Canons team, Uber India implemented Therefore Online, a cloud-based information management solution designed to securely store, manage and process all types of business information.

We evaluated several solutions, but found them too complex to deploy, and they were unable to meet the security standards that we needed. With Therefore Online, the cloud-based information management solution allowed us to manage our documents more efficiently without additional expenditure on server infrastructure, greatly improving our operational workflow, Brish Bhan Vaidya, Head of Strategic Sourcing, APAC Uber India.

As a notable player in the industry, Uber India is expected to collect, store and appropriately use the data of its users via a secure platform. A large part of Uber Indias processes involves conducting background checks of the drivers it on-boards and retaining their records, which could then be provided to regulators and authorities, when needed.

Before Canons solution, Uber India was depended on several external vendors performing the background checks to store the records separately, and provide the detailed reports upon requests. Maintaining high volume of paperwork and large amount of sensitive information at the vendors repository also appeared to be risky on top of the labour-intensive task of retrieving information. The cab aggregator had to spend precious time searching for current and updated versions of the reports, as the vendors did not provide version search capabilities for the records.

Canon also helped to create a cloud-based folder that allowed the upload of records to Therefore Online automatically by simply dropping files into the folder. The solution cut down considerable time and effort spent on storing and calling up reports, boosting productivity across the board.

Uber India found a scalable, cost-effective and value-adding total solution with Therefore Online. The information management solution integrated seamlessly with Uber Indias existing cloud-based infrastructure. Instead of purchasing expensive servers, the company opted for a pay-per-use subscription that could be upgraded as and when required. The solution also helped Uber generates real-time reports on usage workflows, providing useful data to inform and improve business processes.

If you have an interesting article / experience / case study to share, please get in touch with us at editors@expresscomputeronline.com

The rest is here:
Uber India deploys Canon information management solution- Therefore for operational workflow - CRN.in