I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (collected from a network: IDS, firewall) to the cloud for storage purposes. Is this good idea? What are the problem/issue he should solve ?
All I could think of is the following
- Trust issues security: He is sending sensitive data to the cloud, will he trust a service cloud provider with this information? Is encryption really enough?
- Real-time response to security incidents: If an organization sends data to the cloud, will that affect its response in real time? Especially, if he needed to perform some operations in the cloud before sending the logs for analytics.
Is it a good decision to do? Did I mention all the problems he should solve if he determined on that decision?