Threat Hunting in the Cloud

CHAPTER 2Modern Approach to Multi-Cloud Threat Hunting

What's in This Chapter

• Multi-cloud threat hunting
• The building blocks of the Security Operations Center (SOC)
• Cyberthreat detection, threat modeling, and the need for proactive threat hunting in SOC
• Cyber resiliency and the organization's culture
• Metrics for assessing the effectiveness of a threat-hunting program

Multi-Cloud Threat Hunting

According to Flexera's state of the cloud report from 2020 (https://info.flexera.com/SLO-CM-REPORT-State-of-the-Cloud-2020), shown in Figure 2.1, demand for a multi-cloud strategy has been high compared to single public and single private strategies, and since 2018, the trend is going higher as well.

Figure 2.1: Flexera's state of the cloud report

Multi-cloud environments usually refer to the distribution of cloud assets, software, application, infrastructure, and resources across several cloud-hosting environments/providers. Typically a multi-cloud architecture utilizes two or more public clouds as well as multiple cloud service providers (CSPs) with the aim of eliminating the dependency and achieving a higher level of resiliency within the environment.

Each of the CSPs is responsible for a particular activity; for instance, one serves as an IaaS, another one as a PaaS, and another one is a SaaS service. Considering that each of these CSPs is a third-party vendor, they ...