Operational Security
Operational security is mostly involved with the application of system-wide, global security measures. In this context, the following issue will be addressed:
- Log and event management for the GK services in the cloud, including the possible utilization of a Security Information and Event Management (SIEM) System
Log and Event Management
It is always beneficial to utilize a log and event management system to monitor and audit distributed services in the cloud, and to gain an insight into the security status of these services. The following issues should be addressed in this regard:
- Utilization of log and event management systems in such a way that potentially large amounts of logs, generated by GK services in enterprise domains, can be handled.
- How to guarantee the security and privacy of the logs and events generated by different enterprises (with regards to multitenancy).
- Possible utilization of log and event management systems provided by the Cloud provider.
A diagram illustrating the proposed log and event management architecture, including the log and event collector agents and management systems to be used, is shown below:
The dashed lines show the flow of the collected logs and events. The logs generated by the GK services in each enterprise VPC (Virtual Private Cloud) are collected by the log collector agents. These agents should collect the operating system, web server, virtual machine and POS-specific logs and send them to the log management server located in the enterprise VPC. The logs generated by the API gateway in the enterprise VPC should also be collected and sent to the log management server for analysis.
The tool Logstash (https://www.elastic.co/products/logstash) can be used as (a part of) the log management server in each enterprise VPC. Logstash includes built-in log collector agents for different types of software and also most third-party log collector software is compliant with the tool Logstash.
Another alternative tool that can be used for centralized storage and management of the log data generated through multiple heterogeneous systems and different cloud subscriptions is Azure Log Analytics. Information about the Azure Log Analytics can be found at https://azure.microsoft.com/en-us/services/log-analytics/.
In the above diagram, the events (alerts) generated by the security gateway in an enterprise VPC and the analyzed, abstracted logs (possibly log statistics) from the log management server are sent to the security information and event management system located inside the enterprise VPC.
Both the log management server and the security information and event management system inside an enterprise VPC are connected to the external world via the security gateway in the enterprise VPC. In this regard, the security gateway should contain the appropriate filtering rules and policies to allow access to the log management server, the security information, and event management system from administrator consoles only. All other traffic to them should be blocked.
SIEM System
The Security Information and Event Management (SIEM) system is a specialized software built on top and enhances the power of traditional log monitoring tools. Centralized logging and translation into standardized events is a basic requirement for having a SIEM system.
A SIEM system can help to detect suspicious event correlations and provide appropriate alerts. For example, a port scan from a particular IP address and then a login attempt to an SSH service – these two events need to be correlated and alerted.
SIEM systems are optional components in the system landscapes.
Security-Related Logging and Tracing
GK/Retail components do not provide any special security-related logs or traces.