AWS CloudTrail vs. Cisco IPS Sensor (Discontinued) vs. Cisco TrustSec

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

IPS sensors are more suited for companies that do not have visibility into their network with third-party analyzing tools. Scenarios would be to place IPS sensors at the perimeter firewalls mainly. IPS sensors are less appropriate for companies that have third-party analyzing tools that will mitigate vulnerabilities and malicious traffic and activities already.

Incentivized

• Control access to critical enterprise resources by business role, device type, and location, so policy changes can be made without redesigning the network.
• Easily manage access control and segmentation while maintaining compliance.
• Create and manage policies in an easy-to-use matrix.
• Reduce the need for costly network re-architecture by automating firewall rules and access control list (ACL) administration.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Identifies and blocks malicious traffic.
• Detects unwanted traffic and allows your company to be proactive, let alone reactive.
• Comprehensive Threat protection allows companies to adjust thresholds and policies at will.

Incentivized

• Reduce operational expenses by simplifying network segmentation and defining security groups based on business roles, not IP addresses.
• Limit the impact of a data breach by quickly isolating and containing threats using technology already in your network.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• The web GUI is somewhat slow.
• Sometimes difficult to adjust policies.
• Fail open feature may not work properly all the time.

Incentivized

• Help and solutions if needed, support

Incentivized

Cisco TAC has been great at helping with configurations and issues that may arise

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

IPS sensors provides the necessary network visibility my company needs to satisfy its security appetite. By doing so, we have been able to stay compliant and up to date with today's network security requirements and procedures. We are able to be proactive with vulnerabilities and reactive to malicious traffic and intrusions in our day to day operations.

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Provided less need to purchase third party analyzing tools.
• Needed more dedicated staff to build/review/and maintain policies and such.
• Answers companies need for network security.

Incentivized

• Reduction in IT operational costs

Incentivized