Certified Cloud Security Professional (CCSP)Cloud Security OperationsMedium
A cloud security architect is designing a monitoring strategy for a critical, highly dynamic microservices application deployed across multiple cloud regions. The architect needs a solution that can automatically detect deviations from expected behavior without relying solely on predefined static thresholds, which are difficult to maintain in such an environment. Which of the following monitoring techniques would be most effective for this requirement?
- AStatic security policy enforcement
- BPeriodic vulnerability scanning
- CUser and Entity Behavior Analytics (UEBA)
- DLog aggregation and manual review
Show answer & explanationAnswer & explanation
Correct answer: C. User and Entity Behavior Analytics (UEBA)
UEBA systems leverage machine learning and statistical analysis to establish baselines of normal behavior for users and entities. They can then detect anomalies or deviations from these baselines, which is crucial for dynamic environments where static thresholds are ineffective and manual review is impractical. This allows for proactive identification of potential security incidents.
Why the other options are wrong
- A. Static security policy enforcement is important but does not actively monitor for behavioral deviations; it enforces rules at a different layer.
- B. Periodic vulnerability scanning identifies known weaknesses in systems, but it does not monitor real-time behavioral anomalies in a running application.
- D. Log aggregation is a prerequisite for monitoring but manual review is not scalable or effective for detecting subtle anomalies in dynamic microservices.
User and Entity Behavior Analytics (UEBA)
UEBA uses machine learning and statistical analysis to detect anomalies in user and entity behavior that may indicate security threats.
- Establishes baselines of 'normal' behavior.
- Identifies deviations from baselines.
- Effective for detecting insider threats and compromised accounts.
Memory trick: Always monitor behaviors to catch the unusual ones quickly.