trademark

5.0 Real-Time Security/Compliance Monitoring (cont.)
5.2.2 How?
• Mine the events in log files to monitor for security, like in a SIEM tool.
• Apply other algorithms or principles to mine events (such as machine learning) to get
potential new security insights.
5.3 Implement front-end systems
5.3.1 Why?
To parse requests and stop bad requests. Front-end systems are not new to security.
Examples are routers, application-level firewalls and database-access firewalls. These
systems typically parse the request (based on, for instance, syntax signatures or behavior
profiles) and stop bad requests. The same principle can be used to focus on application or
data requests in a big data infrastructure environment (e.g., MapReduce messages).
5.3.2 How?
Deploy multi-stage levels of front-end systems. For example, utilize a router for the network;
an application-level firewall to allow/block applications; and a dedicated big data front-end
system to analyze typical big data inquiries (like Hadoop requests). Additional technology,
such a software defined network (SDN), may be helpful for implementation and deployment.
5.4 Consider cloud-level security
5.4.1 Why?
To avoid becoming the “Achilles heel” of the big data infrastructure stack. Big data
deployments are moving to the cloud. If such a deployment lives on a public cloud, this
cloud becomes part of the big data infrastructure stack.
5.4.2 How?
• Download “CSA Guidance for Critical Areas of Focus in Cloud Computing V3.0”
• Implement other CSA best practices.
• Encourage Cloud Service Providers to become CSA STAR-certified compliant.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
28