A Comparative Analysis of Honeypots on Different Cloud Platforms.

Area of Science:

• Cybersecurity
• Cloud Computing Security
• Network Security

Background:

• Cloud computing adoption is widespread, with cloud data centers processing most workloads.
• Storing vast amounts of private and personal data in the cloud raises significant security concerns.
• Understanding adversarial activities is crucial for cloud infrastructure protection.

Purpose of the Study:

• To monitor and analyze adversarial activities targeting major cloud platforms.
• To compare the nature, volume, and origin of attacks across different cloud providers.
• To identify targeted services and vulnerabilities exploited by threat actors.

Main Methods:

• Deployment of multiple honeypots across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure in various regions.
• Collection and comparative analysis of security logs over a three-week period in May 2020.
• Visualization of collected data to identify patterns in adversarial behavior.

Main Results:

• Heterogeneous attacker activity observed across different cloud providers in terms of attack volume and origin.
• Threat actors targeted popular services, including remote desktop sharing, commonly used for remote work during the COVID-19 pandemic.
• Attacks originated from both commonly identified sources (China, Russia, US) and less common locations (Vietnam, India, Venezuela).

Conclusions:

• Cloud security threats vary significantly between major providers.
• Attackers exploit widely used services, highlighting the need for robust security measures for remote work infrastructure.
• Insights into adversarial activity can enhance organizational situational awareness and cloud security strategies.