Over the last 90 days, many storage services has been exposed in the cloud services environments, and the security team does not have the ability to see is creating these instance. Shadow IT is…

Question

Options

• ACompile a list of firewall requests and compare than against interesting cloud services.
• BImplement a CASB solution and track cloud service use cases for greater visibility.
• CImplement a user-behavior system to associate user events and cloud service creation events.
• DCapture all log and feed then to a SIEM and then for cloud service events

• A
  15% (6)
• B
  8% (3)
• C
  72% (28)
• D
  5% (2)

Explanation

The core problem stated is that the security team cannot see WHO is creating unauthorized cloud service instances - the issue is user attribution, not just service discovery. A user behavior analytics (UEBA) system ingests identity-aware events (login activity, API calls, console actions) and correlates them with cloud resource provisioning events, directly surfacing which users are spawning shadow IT instances. This addresses the attribution gap with relatively low ongoing administrative overhead once instrumented. Compiling firewall requests manually (A) is labor-intensive and indirect. A CASB (B) provides cloud visibility and policy enforcement but focuses on access and data governance rather than mapping creation events to specific user behavior patterns. Feeding raw logs to a SIEM (D) requires significant tuning, correlation rule development, and ongoing maintenance, representing higher administrative effort.

No community discussion yet for this question.