Oracle Cloud Guard

Organizations increasingly rely on cloud services to run business-critical applications, a shift accelerated by the coronavirus pandemic. This creates a hybrid IT environment with persistent management, security, and compliance challenges because cloud services are often not integrated into established enterprise security processes. As digital transformation drives adoption of DevOps and IaaS/PaaS, organizations benefit from avoiding capital expenditure and procurement delays, but they also expand the need to secure cloud usage, including cloud-based backups of critical data.

Cloud providers secure their underlying infrastructure, but tenants must secure their configurations, identities, and operational practices—an area frequently outside DevOps teams’ skills or attention. Common weaknesses include poorly secured administrative accounts, gaps in governance over cloud identities (leading to excessive privileges and dormant credentials), misconfigured access controls that expose resources publicly, and risky handling of sensitive data, including copying or sharing it with third parties for testing. Tenants may also fail to fully use provider tools, maintain an accurate inventory of cloud assets, or keep their in-cloud stack (network, OS, middleware, applications) properly configured and patched.

CSPM solutions aim to address these issues by discovering in-cloud elements, identifying vulnerabilities, enforcing security policies and best practices, alerting on deviations, and automating remediation. The report focuses on Oracle Cloud Guard, an Oracle Cloud Infrastructure service that ingests activity and configuration data across regions, evaluates it using detector rules, correlates findings, and drives dashboards, metrics, and responder actions. It works with Oracle Security Zones for always-on policy enforcement and logging across resource groups. Cloud Guard scopes monitoring via targets, detects issues via detectors, and responds via responders. It also provides Security Score and Risk Score to evaluate posture strength and overall exposure.

• Oracle Cloud Guard is an OCI service that helps tenants monitor, identify, achieve, and maintain a strong security posture on Oracle Cloud.
• Cloud Guard detects problems by ingesting activity and configuration data from resources in each region and processing it using detector rules.
• Identified problems are correlated at the reporting region and surfaced via dashboards and metrics.
• Cloud Guard can trigger responders to assist in or automate corrective actions.
• Cloud Guard works together with Oracle Security Zones to enforce policy compliance requirements for groups of resources and log violations.
• Targets define the scope of what Cloud Guard checks, and multiple targets can be defined across multiple regions.
• Oracle provides predefined detector checks and responder actions, and tenants can modify them or create their own.
• Cloud Guard provides two posture metrics: Risk Score and Security Score.
• OCI IAM supports two-factor authentication using a password and a time-based one-time password generated by a device.
• Cloud Guard is currently offered without extra charge.

• “While the major cloud service providers go to great lengths to secure the infrastructure of their environments, it is up to the tenant to secure their use of these services.”
• “This hybrid IT delivery environment gives rise to many challenges in the areas of management, security, and compliance.”
• “These vulnerabilities often include poorly secured accounts used by the tenant to administer the cloud service and that provides cyber adversaries with uncontrolled access to the cloud-based assets.”
• “The tenant may not actively manage and secure the complete inventory of cloud resources and assets being used.”
• “CSPM solutions provide the capabilities needed to address these challenges in a consistent way.”
• “They identify deviations from policies providing alerts and automatically remediate issues.”
• “Targets define the scope of what Cloud Guard is to check.”
• “Detectors perform checks and identify potential security issues based on their type and configuration.”
• “Responders define the actions that Cloud Guard can take when a detector has identified a problem.”
• “These help to assess what could be ‘small but insecure’ and ‘large but overall secure’ environments correctly.”