Who is responsible for intrusion detection in the cloud?
One thing to confirm right away is who will be responsible, and how they will be responsible, for ID in the cloud. I see the following as basic rules: • Providers will deploy ID in certain locations that feed into their (not your) IDS. • You must have a service-level agreement (SLA) in place that require providers to notify you if you are affected directly (i.e., they see attacks against your VMs) or indirectly (i.e., they see attacks against a hypervisor that is running your VMs). • If and when you deploy ID, it should integrate (in some manner) into your current monitoring and alerting infrastructure. • It is likely that the future will have third parties that provide IDS for the cloud, and that this will just be an add-on cost for those who do not want to manage ID in their cloud instances. Performing intrusion detection in the cloud So now that we know where we should/can perform ID in the cloud, we can ask, “How do we do it?” A traditional host intrusion detection system The first
