How to Implement UEBA for Cloud Security

Thanks to the recent surge in machine learning interest, user and entity behavior analytics (UEBA) is catching on as a cloud security measure. Why should information technology (IT) teams implement it? How should decision-makers incorporate it into their existing strategies?

What Is User and Entity Behavior Analytics?

UEBA detects anomalies using machine learning technology, statistical models, or behavioral analytics software. It continuously evaluates historical and current data to establish a baseline and identify deviations. To measure risk, it assesses information like activity logs, file access history, network traffic and domain name system records.

This security tool monitors people, devices and servers to establish behavior-based patterns, trends or connections. While a deviation from routine does not automatically indicate malicious activity is underway, it suggests an account may have been compromised or an insider threat is active. Either way, data security and user privacy are at risk.

UEBA aims to detect anomalous activity indicative of an impending breach or cyberattack — things like abnormal access times, unusually large downloads or elevated request volumes, for example. Establishing upper and lower thresholds for “normal” cloud activity allows the IT team to investigate and enact trigger-based incident response measures.

The Benefits of Leveraging UEBA for Cloud Security

UEBA’s flexibility sets its behavior-based detection apart from standard signature-based detection. It can detect subtle behavioral changes, helping IT teams detect threat actors who use compromised accounts, virtual private networks or legitimate credentials as cover. As it absorbs more data, its accuracy improves.

Unlike other anomaly detection methods, UEBA is highly accurate because it considers several factors during analysis. If it categorizes activity as abnormal, the indicators of compromise that appear on the dashboard will be context-specific. Moreover, since decision-makers can specify alert thresholds for discrepancies, it produces few false positives.

Automation is another substantial benefit. Machine learning algorithms function with minimal oversight or intervention, freeing up the IT department’s time to focus on complex or high-risk anomalies. This technology is also capable of real-time analysis, ensuring professionals can respond to security incidents as soon as indicators of compromise appear.

Manually reviewing logs and investigating potential cyberthreats are time-consuming and resource-intensive tasks — especially for organizations operating in a multi-cloud environment. With UEBA, IT professionals don’t need to concern themselves about tedious work. If the tool identifies a critical issue, they will receive a real-time alert.

The State of UEBA in Cloud Environments

This security tool is powerful, but relatively few IT teams have implemented it to secure their cloud environment. While 68% of consumer organizations have invested in a cloud platform, just 14% have made room in the budget for UEBA. Oftentimes, they keep the standard security measures they once used for on-premises systems and applications.

This discrepancy is unexpected, given that most organizations worry about data breaches and cyberattacks. In fact, around 57% of cloud users are concerned about security, resulting in adoption hesitancy. Even those who have already moved to the cloud consider data protection one of their chief concerns.

The cloud forces system processes and data repositories to move off-premises, so the IT department loses comprehensive oversight. At the same time, the attack surface expands because connectivity heightens visibility and reliance on third-party vendors creates gaps. In this scenario, enhancing monitoring and incident response is essential.

Best Practices for Implementing UEBA in the Cloud

Whether firms have a private, public or hybrid cloud, they can implement this tool for security. Following the best practices for incorporating UEBA into a cloud environment ensures success.

1.    Ensure Compatibility and Interoperability

Not all cloud-based UEBA solutions are created equal — they may work perfectly with one provider and lose functionality with another. Whether an organization is set up with Microsoft Azure, Google Cloud or Amazon Web Services influences their software selection process. The trick is to find the tool that works with the environment, not the other way around.

2.    Collect Relevant and Up-to-Date Data

Datasets must be relevant and recent. Since machine learning technology is fundamental to UEBA, these tools are prone to data drift — a process that affects model performance as statistical properties or information concepts change over time. Retraining or periodic cleaning is necessary to prevent suboptimal output.

3.    Encrypt Users’ and Entities’ Behavioral Data

Data is one of the most valuable currencies on the dark web. IT teams must be mindful that storing behavioral data on users and devices may make them a target for additional cyberattacks, conflicting with their goal of improving cloud security. They should encrypt all sensitive information. Cloud storage is scalable, so capacity shouldn’t be an issue.

4.    Automate Low-Level Incident Response

Even though UEBA doesn’t output as many false positives as other anomaly detection tools, no solution is 100% perfect. Decision-makers should consider automating low-level incident response measures like forcing logouts, disconnecting devices, blocking IP addresses, creating backups, quarantining files or revoking access. This way, they save IT professionals’ time.

The Bottom Line of Implementing UEBA in the Cloud

Behavior-based analytics is a proven way to quickly uncover anomalies — even those like compromised accounts that are difficult to catch with conventional tools. IT teams could save time and organizations could save money by incorporating UEBA into their cloud security strategy. As long as they follow best practices, they will see quality performance.

##

ABOUT THE AUTHOR

Zac writes for ReHack as the Features Editor and covers cybersecurity, IT, and business tech. His work has been featured on publications like AllBusiness, CyberTalk, and BLR. For more of his writing, follow him on Twitter or LinkedIn.