Blog

Total 62

2026/01/07 by. pr@cloudnetworks.co.kr

January 07, 2026

Splunk Named a Leader in the Gartner Magic Quadrant for SIEM for the 11th Consecutive Year, Rated Highest for Ability to Execut

2025/10/17 by. pr@cloudnetworks.co.kr

Splunk Named a Leader in the Gartner Magic Quadrant for SIEM for the 11th Consecutive Year, Rated Highest for Ability to Execut

Splunk has been recognized as a Leader in the 2025 Gartner Magic Quadrant for SIEM (Security Information and Event Management) for the 11th consecutive year. Splunk stated that it was positioned highest for Ability to Execute. This reflects Splunk's product strategy and customer outcomes in helping security teams respond proactively in a rapidly changing threat landscape.✅Our Journey Together: Redefining the Next Era of the SOCIn the mid-2010s, Splunk launched Splunk Enterprise Security with a bold vision: to deliver a SIEM that could take in any data, at any scale, and make it immediately useful for security. This vision soon became reality and redefined how SOCs detect, investigate, and respond to threats (TDIR).From a flexible SIEM that did not require a predefined schema to today's AI-enhanced SecOps platform, this journey has been shaped through collaboration with customers. Real-world challenges such as exploding data volumes, increasingly sophisticated threats, analyst shortages, and alert fatigue have been turning points at every stage. Customer feedback, trust, and partnership have accelerated Splunk's evolution. We have built a movement that goes beyond products, and we are leading security operations into the era of agentic AI.✅A Unified AI-Powered SecOps PlatformAt .conf25, Splunk unveiled the next chapter of Splunk ES (Enterprise Security). As a unified AI-powered SecOps platform, it simplifies the analyst experience and delivers faster, smarter outcomes across the entire threat detection, investigation, and response (TDIR) workflow. Here are some recently introduced innovations based on customer feedback.Simplifying the Analyst Experience with Unified Workflows· Two flexible editions: Enterprise Security Essentials and Enterprise Security Premier - both provide the same unified SecOps platform, adaptable to your organization's needs.· Built-in UEBA : Baselines normal activity across users, devices, and applications and correlates anomalous behavior to detect and stop insider threats. All of this is built in by default.Built-in SOAR for every analyst: Case management, playbooks, and automation are now built into ES, so every analyst can benefit from the speed and efficiency of automation.Expanding Detection and Visibility· Detection Studio: Provides a complete detection lifecycle environment. Test, deploy, and monitor high-performing detections, close gaps against MITRE ATT&CK, and shorten time to coverage.· Integrated threat intelligence: Delivers Cisco Talos intelligence directly within ES, SOAR, and Attack Analyzer, giving analysts richer context and faster decision-making.· Cisco + Splunk collaboration: The Splunk Threat Research Team (STRT) and Cisco Talos work closely together to deliver world-class detections and insights in ES.Accelerating the SOC with AI and AgenticsSplunk delivers AI that works the way the SOC works. In other words, purpose-built AI embedded across the entire analyst workflow, grounded in operational reality and measurable outcomes. Highlights include: · AI Assistant in Security : Generates SPL queries, summarizes results, produces investigation reports, and provides remediation guidance in natural language.· Malware Threat Reversing Agent : Automatically interprets malicious scripts line by line, flags evasive behavior, groups recurring attack patterns, and extracts IOCs, giving analysts actionable insights in seconds rather than hours.· Triage Agent : Prioritizes and explains alerts to filter out noise and surface what matters most.· AI Playbook Authoring Agent : Democratizes automation by turning natural language into functional SOAR playbooks.· Autonomous Response Agent : Executes predefined response actions within security tools to accelerate containment and resolution.· AI-enhanced Detection Library : Continuously improves coverage and resilience through an AI-powered library that helps teams iterate quickly, expand attack surface coverage, and shorten the time from hypothesis to production.· Detection Personalizer : Shortens time to value with out-of-the-box detections. AI-generated explanations and ready-to-deploy simulation scripts streamline workflows, making it easy to tailor detections to each customer's unique environment.✅ConclusionAs we move into the era of agentic AI, Splunk's focus remains unchanged: ending analyst fatigue in the SOC, delivering faster outcomes, lowering risk, and building stronger resilience together. The unified AI-powered SecOps and expanded detection and automation capabilities of Splunk Enterprise Security turn this goal into an actionable reality. Download the report below to learn more about why Splunk was recognized. ▶ Download the 2025 Gartner Magic Quadrant for SIEM Report ▶ Learn More About Splunk Enterprise SecuritySplunk Enterprise Security is a unified threat detection, investigation, and response (TDIR) platform that streamlines security workflows into a unified environment. It integrates capabilities including security information and event management (SIEM), agentic AI and SOAR for automation, and user and entity behavior analytics (UEBA) and AI/ML for improved detection accuracy and response speed. By bringing these capabilities together in a single interface, Enterprise Security reduces inefficiencies, eliminates tool silos, and ensures SOC teams can detect, investigate, and respond to threats more effectively.Drawing on its expertise in big data, CloudNetworks operates a dedicated team specializing in the implementation and technical support of the Splunk platform. For inquiries about adopting and using Splunk, please contact CloudNetworks, an official partner.

October 17, 2025

Protecting Non-Human Identities (NHIs) with Okta

2025/09/22 by. pr@cloudnetworks.co.kr

Protecting Non-Human Identities (NHIs) with Okta

Today, enterprises depend on a rapidly expanding network of non-human identities (NHIs), such as service accounts, bots, tokens, and AI agents, which now outnumber humans by an overwhelming 50 to 1. These identities often operate with excessive and persistent access privileges. They typically lack built-in security controls and are deeply embedded in every environment. When they operate without visibility or governance, NHIs create an invisible yet vast attack surface and become a silent threat that evades traditional identity management systems. This leads to unauthorized changes, uncontrolled access, and security vulnerabilities across critical systems and workflows.Okta brings NHIs into the same unified identity framework as human identities, providing visibility, access control, governance, and remediation across every environment. This end-to-end approach eliminates silos and ensures that every identity is managed and protected in a trustworthy way.☑️ What Are NHIs?NHIs (Non-Human Identities) are digital entities with credentials that can access data and perform tasks autonomously. Types of NHIs include applications, machines, cloud workloads, AI agents, automated processes, service accounts, API keys, OAuth tokens, software bots, and secrets. NHIs often lack MFA, use static secrets, operate with excessive privileges, and are not continuously monitored, making them prime targets for breaches.Okta protects NHIs across cloud infrastructure, SaaS service accounts, on-premises environments, and secrets through consistent, policy-based security and automation.☑️ Okta - NHI Security SolutionToday, securing the entire lifecycle of non-human identities (NHIs) is essential, not optional. The Okta platform protects the ever-growing network of service accounts, tokens, AI agents, and more, unifying NHI security across cloud, applications, and infrastructure. Through a single policy engine, it manages governance, rotation, and access restrictions from tokens to workloads, and provides comprehensive visibility, privileged access management, and application security to turn complex chaos into clear control.· End-to-end visibility : Discovers and monitors all non-human identities across the environment.· Least Privilege Access : Enforces time-bound, need-based access to reduce exposure.· Automated lifecycle management : Provisions, deprovisions, and governs NHIs at scale.· Unified identity framework : Manages all identities, human and non-human, through one secure system.Uncover Hidden Identity Risks Before They Become ThreatsNHIs are one of the biggest blind spots in enterprise security. Okta shines a spotlight on service accounts, tokens, and AI agents that often go unmanaged. Identity Security Posture Management (ISPM) provides unified insights into all identities, revealing risks such as unrotated credentials, excessive access, and orphaned accounts. ISPM continuously discovers and classifies NHIs across multiple environments, helping teams detect threats early and proactively and reduce exposure.Limit the Attack Surface by Enforcing Precise AccessReducing risk starts with limiting access, which should be time-bound and based on actual need. OPA (Okta Privileged Access) protects credentials, rotates secrets, and audits privileged operations so that NHIs do not retain standing access. Secure Identity Integrations (SII) extend these controls to leading SaaS apps such as Google Workspace, Microsoft 365, and Salesforce, ensuring that NHIs access only what they need, when they need it.Scale and Stay Compliant Without OverheadOkta automates provisioning, deprovisioning, and policy enforcement through prebuilt governance workflows, helping teams scale securely without compromising compliance. These workflows reduce overhead and help maintain continuous adherence to security policies. Adoption is easy through the Okta Integration Network (OIN), which provides prebuilt integrations that accelerate deployment and simplify non-human identity management across the enterprise. By unifying visibility, access control, and governance, Okta turns a fragmented, high-risk identity landscape into part of a secure, manageable enterprise identity strategy. This approach enables organizations to reduce complexity, maintain least privilege, and scale securely without sacrificing compliance or operational efficiency.Learn more about how you can securely manage non-human identities with Okta's identity security platform.▶ Okta - Identity Security Platform : Learn MoreOkta is a unified identity security platform that manages and protects various types of identities, including employees, customers, API keys, and AI agents. With a vendor-neutral architecture and unified platform, it covers every stage of the identity lifecycle, from governance to access and privilege control, and authenticates, authorizes, and secures access for applications, devices, and users. For inquiries about the Okta platform, please contact CloudNetworks, an official partner.

September 22, 2025

NHIs (Non-Human Identities), the Blind Spot in Infrastructure Security: A Security Strategy

2025/09/03 by. pr@cloudnetworks.co.kr

NHIs (Non-Human Identities), the Blind Spot in Infrastructure Security: A Security Strategy

We are used to keeping track of every employee: who they are, what privileges they have, which systems they can access, and which systems they use. But there is a growing workforce that mostly goes unnoticed: non-human identities (NHIs). Non-human identities (NHIs) are digital entities with privileges, access scopes, and defined roles that allow applications, services, and devices to authenticate and perform tasks without human intervention.In cloud environments, NHIs typically take the form of cloud-native identity constructs. · AWS IAM roles· Azure Managed Identities· Google Cloud Service AccountsThese identities have granular permissions, but they are created without security oversight, monitored inconsistently, and rarely retired. This leads to identity sprawl, which is usually accompanied by secret sprawl. Let's look at how this happens and how to respond.☑️ NHIs Remain a Blind Spot for Security TeamsNHIs now outnumber human employees, creating visibility gaps and expanding an attack surface that traditional identity management approaches were not designed to address. According to the NHI Management Group, 80% of identity-related breaches involve compromised non-human identity credentials. These credentials are scattered across systems, created in isolated environments, and not subject to the same rigorous management standards as human accounts.☑️ Why Machine Identities Fall into a Management Blind SpotNHI sprawl occurs because there is a fundamental gap in how organizations approach machine identity management compared with their human identity management processes.1. There is no centralized governance. Human accounts are managed through IAM platforms, but non-human identities are mostly created ad hoc by development teams without a system of record.2. Security is often neglected. Developers create service accounts, API keys, and tokens to solve problems immediately. These secrets are hardcoded into configuration files or repositories. This is the fastest way to deploy, but it completely bypasses security measures.3. There is no clear ownership or lifecycle. Human identities follow onboarding and offboarding processes. Machine credentials do not. Secrets created during a sprint can linger long after they have served their purpose.☑️ Preventing NHI Sprawl Starts with VisibilityHCP Vault Radar helps teams keep NHI accounts secure when secrets (passwords or tokens) are accidentally exposed. It scans source code, developer environments, CI/CD pipelines, and collaboration tools to identify AWS keys, JWTs, SSH credentials, and API tokens. Pattern recognition and context-aware scanning reduce false positives and surface the most important findings. With real-time detection through pre-commit hooks and CI/CD integration, it prevents secrets from leaking into production when developers create new machine identities.For broader visibility across the infrastructure, IBM Verify Identity Protection extends the scope of Radar, helping organizations understand how machine identities are used in real time and flag anomalous activity.Manage the Entire Lifecycle of Non-Human Identities (NHIs)Before protecting NHIs, it is important to manage how they are created and which resources they can access. Left unmanaged, NHI sprawl occurs as identities are created without a clear purpose, policy, or lifecycle ownership. HashiCorp Vault plays a central role in how identities are authenticated, authorized, and managed after they are provisioned. Vault enables organizations to apply access rules to existing NHIs, classify them using namespaces, and ensure that credentials are properly scoped. Instead of granting broad access, Vault enables least-privilege design through short-lived or dynamic secrets. This limits exposure and reduces the risk of overprivileged machine accounts.Prioritize and Respond QuicklyWhen machine credentials are leaked, every second counts. Vault Radar provides real-time alerts and automated notifications as soon as an exposure is detected. This narrows the attack window and prevents the months- or years-long exposure that makes non-human identities so dangerous. Alerts are integrated directly into existing incident response workflows such as JIRA, PagerDuty, and Slack and delivered to the right teams. Each finding includes contextual insights such as author, source, type, and severity level, helping teams triage secrets and focus their response on the highest-risk items.Effective Governance for DevelopersVault Radar goes beyond simple detection. It builds remediation into development workflows. Vault Radar delivers findings directly to code owners with context and guidance so that problems can be fixed at the source. Once secrets are remediated, they can be imported into Vault for proper lifecycle management. This means rotation, expiration, and compliance reports are managed centrally, and audit logs are recorded to meet requirements such as SOC 2 and ISO 27001. Vault ensures that secrets are actively managed over time.☑️ A Paradigm Shift in NHI Security: From Reactive to ProactiveVault Radar shifts NHI management from reactive to proactive. It discovers frequently overlooked secrets, assesses their risk, and converts them into managed assets. This means stronger security, fewer production issues, faster audits, and workflows that make secure practices the easiest path.Before Vault RadarAfter Vault Radar❓DiscoveryNo centralized visibilityNHI secrets scattered across various tools🔍DiscoveryContinuous monitoring across developer toolsReal-time detection of exposed NHI secrets🚨NHI creationNHIs created without reviewReal-time detection of exposed NHI secrets🛠️NHI creationNHIs created without reviewNo guardrails or review process 🔓Sprawl ManagementNo ownership or expiration Secrets persist indefinitely 🔓Sprawl ManagementSecrets imported into Vault for lifecycle managementFast response enabled through context-based alerting and routingNon-human identities are now an essential, not optional, target for security management. Because they are invisible, risks can spread even faster, and a single exposure can shake the security of the entire organization. HCP Vault Radar detects NHI secret exposure in real time across development and operations environments, and HashiCorp Vault systematizes security across the entire lifecycle, from creation to retirement. Using the two solutions together gives organizations both visibility and control, eliminating security blind spots and keeping infrastructure safe from invisible threats.▶ HashiCorp Vault : Learn MoreHashiCorp Vault is an identity-based secrets and encryption management system that securely manages sensitive information based on authentication and authorization. It allows sensitive information such as tokens, API keys, passwords, encryption keys, and certificates to be managed consistently through a unified interface, and strengthens security with access control and audit logging capabilities. Secrets tend to be managed in a scattered way across platforms, it is difficult to know who is accessing which information, and it is not easy to implement capabilities such as key rotation, secure storage, and detailed logging on your own. To solve these problems, Vault allows access to sensitive data only after verifying and authorizing clients such as users, applications, and systems.Through its dedicated team, CloudNetworks provides implementation and technical support services for the HashiCorp product portfolio, including Vault and Terraform. For inquiries about HashiCorp, please contact CloudNetworks, an official partner.

September 03, 2025

Top 10 SIEM Use Cases to Watch Now : Real-World Applications and Security Operations Benefits

2025/08/28 by. pr@cloudnetworks.co.kr

Top 10 SIEM Use Cases to Watch Now : Real-World Applications and Security Operations Benefits

SIEM (Security Information & Event Management) platforms are at the core of modern security operations. They collect log data from across the organization, identify threats, and help security teams respond quickly. But how do they actually work in practice?From real-time attack detection to automated compliance reporting, SIEM delivers a wide range of high-impact security use cases. In this blog, we explain 10 core ways organizations use SIEM every day, with real-world examples, and introduce the key benefits of each use case.✅ 10 Core SIEM Use Cases1. Gaining Complete Visibility Through Log Normalization and AggregationSIEM collects logs generated by a variety of systems, such as firewalls, servers, applications, and endpoints, and normalizes them into a common format. During this normalization process, important fields such as timestamps, IP addresses, usernames, and event IDs are parsed into structured data. Adopting a SIEM system provides a clear picture of activity across business systems, and logs are tracked so they can be used for investigations when needed. Because collection takes place in a single interface, data aggregation and normalization are easy, which supports advanced data analytics applications and data governance policies.Example An organization collects logs into its SIEM from Windows servers, Linux systems, network firewalls, and cloud environments (AWS, Azure, etc.). This data is normalized into a standardized schema such as Common Event Format (CEF) or Log Event Extended Format (LEEF), making it easier for security analysts to query and correlate events.Benefits· Centralized visibility across heterogeneous environments· Simplified log collection and storage management· Consistent, structured data for efficient analysis and compliance2. Real-Time Threat Detection and Intelligent Alert GenerationSIEM continuously monitors logs and uses correlation rules, anomaly detection, and behavioral analytics to identify threat patterns in real time, such as:· Brute-force attacks· Malware infections· Data exfiltration attemptsSIEM platforms also provide AI-based threat detection. SIEM identifies suspicious activity by analyzing factors such as:· Traffic trends· Network usage patterns· Security policies and rules· Information access· Privilege changesExampleA SIEM correlation rule detects a sequence of activities occurring within five minutes, failed logins → successful login → privilege escalation on a critical server, and triggers a high-risk alert to prompt immediate investigation. In another example, Children's National Hospital was able to detect 40% more threats after adopting Splunk Enterprise Security than before it had a SIEM.Benefits· Early warning of ongoing or imminent security incidents· Reduced attacker dwell time before detection· Improved situational awareness through dynamic alert dashboards3. Automating Compliance Reporting and Simplifying AuditsSIEM stores logs centrally with the retention policies required by regulatory frameworks and automatically generates audit reports to meet compliance requirements. With SIEM, reporting procedures become automated and traceable, and logs can be used transparently even during forensic investigations. These logs become a reliable means of demonstrating compliance with the relevant regulations.Example· A healthcare organization uses SIEM to generate HIPAA compliance reports covering:· Access history for electronic health records (EHR)· Records of configuration changes to medical systems· Evidence of encryption for data in transit and at restBenefits· Automated collection of evidence required for audits· Simplified response to regulatory frameworks such as GDPR, PCI DSS, HIPAA, and SOX· Improved transparency and accountability4. Detecting Anomalies and Responding to Insider Threats Through User Behavior MonitoringSIEM tracks user behavior to identify account takeovers, data misuse, or policy violations. Monitoring covers login locations, access times, data transfers, use of administrator privileges, and more.Modern SIEM solutions detect deviations from normal behavior through user behavior analytics (UBA) and user and entity behavior analytics (UEBA) capabilities.ExampleIf a user who normally connects from a New York IP between 9 a.m. and 5 p.m. accesses a financial server through a foreign IP at 3 a.m., the SIEM detects this anomalous behavior and generates a medium-level alert.Benefits· Improved accountability through session logging and audit trails· Detection of anomalous user behavior (UEBA)· Early warning of insider threats or account takeovers5. Detecting Advanced Persistent Threats (APTs) Through Long-Term Event CorrelationSIEM can identify larger threats by correlating events that appear harmless on their own. APTs are typically long-term, organized attacks carried out by cyber spies, hacktivists, and financially motivated attackers targeting sensitive data.APT campaigns span weeks or months and include stages such as reconnaissance, initial compromise, lateral movement, and data exfiltration. A robust SIEM connects these individual events to identify APTs.ExampleThe SIEM correlates unusual DNS queries, unauthorized database access attempts, and large data transfers over non-standard ports in chronological order, uncovering a slow, stealthy APT campaign attempting to steal sensitive intellectual assets.Benefits· Detection of complex, multi-stage advanced threats· Stronger protection of critical assets· Support for retrospective analysis and forensic timeline creation6. Gaining Visibility into Cloud Environments and Detecting MisconfigurationsModern SIEMs integrate with cloud-native monitoring tools to provide unified visibility across cloud and hybrid environments.As more enterprise data is stored in major cloud environments such as AWS CloudTrail, Azure Security Center, and Google Cloud Operations Suite, SIEMs with cloud integration capabilities enable robust monitoring of all logs in the cloud.ExampleThe SIEM collects AWS IAM access logs, S3 access logs, and Azure Activity logs. It detects the creation of a new IAM user granted administrator privileges outside business hours, followed by access to a sensitive S3 bucket.Benefits· Centralized monitoring of cloud workloads, assets, and accounts· Detection of misconfigurations and unauthorized access· Support for the shared responsibility model of cloud security7. Strengthening Threat Hunting and Forensic InvestigationsSecurity teams use SIEM to proactively hunt for threats by querying logs, searching for IOCs (indicators of compromise), and identifying malicious patterns. This approach uses SIEM more actively, going beyond simply receiving alerts and correlating events.ExampleA security analyst uses the SIEM to investigate connections to a suspicious IP address identified in a threat intelligence feed. In the process, repeated beaconing behavior is discovered on multiple endpoints, revealing a dormant command-and-control (C2) channel. Analyzing the connection patterns with the suspicious IP confirms repeated beacon communication across multiple endpoints, through which the C2 channel is identified.Benefits· Threat detection capabilities that go beyond real-time alerts· Faster incident response and containment· Ability to conduct comprehensive post-incident investigations8. Automating Response Through SOAR IntegrationSIEM integrates with security orchestration, automation, and response (SOAR) technologies to automatically run playbooks when alerts occur. This makes it possible to automate tasks such as:· Isolating hosts· Disabling user accounts· Enriching alerts with threat intelligenceSIEM and SOAR are designed so that alerts are not duplicated between them, reducing alert fatigue, and reducing manual work improves response speed.ExampleThe SIEM detects ransomware activity such as mass file encryption and registry changes. SOAR automatically isolates the infected systems from the network, sends related notifications, and creates an incident in the ticketing system.Benefits· Minimized response time and prevention of threat spread· Automation of repetitive tasks and faster processing· Reduced analyst fatigue and human error9. Correlating Endpoint Activity with Security SignalsBy collecting telemetry from EDR (Endpoint Detection and Response) platforms, SIEM correlates endpoint behavior with network and authentication data. This enables more comprehensive threat awareness.ExampleEDR detects a suspicious PowerShell process. The SIEM correlates this event with anomalous authentication attempts to critical systems, identifying that a compromised endpoint is being used for lateral movement.Benefits· Holistic threat detection across multiple platforms· High-confidence alerts with clear context· Support for rapid response actions through endpoint isolation10. Managing Third-Party Risk by Monitoring External Vendor AccessOrganizations use SIEM to monitor the activity of all users who access internal systems, including external vendors, contractors, and partners. This is central to third-party risk management and is important for verifying that external users comply with security policies.ExampleThe SIEM monitors VPN and SSH login activity by an external maintenance provider. Alerts are generated when access from unexpected geographic locations or at unusual times is detected.Benefits· Transparent control over external users' access activity· Minimized exposure to supply chain attacks· Stronger fulfillment of contractual security compliance and audit obligations✅ SIEM Use Cases by IndustryThe 10 SIEM use cases introduced above can be applied to almost any company or organization. However, the way SIEM is used varies somewhat by industry. The following are specific SIEM applications by industry.1. Financial ServicesSIEM helps financial institutions monitor high-value transactions and easily access logs and audit trails. There are also a variety of use cases in fintech applications.Use examples:· Fraud detection: Monitors transaction anomalies such as high-value transfers, access from unusual regions, and rapid login attempts across multiple accounts.· Insider trading prevention: Correlates internal communications and trading patterns to detect regulatory violations.· Regulatory compliance: Automates monitoring of SOX and PCI DSS control items and supports audit trail generation and reporting.Real-world example:Progressive Insurance uses Splunk Enterprise Security, a SIEM tool, to protect its $120 billion market capitalization.2. HealthcareSIEM excels at protecting and monitoring sensitive personally identifiable information (PII) and confidential medical information. Use cases suited to the specific needs of the healthcare industry include the following.Use examples:· Patient record monitoring: Detects unauthorized access to electronic health records (EHR) and protected health information (PHI).· Medical device misuse detection: Identifies anomalous patterns arising from IoT-based connected medical devices.· HIPAA compliance: Maintains logs of data access and changes to stay audit-ready.3. ManufacturingManufacturers can use SIEM to automate monitoring tasks and collect logs generated by logistics activities. The following are use cases in manufacturing.Use examples:· ICS security: Monitors access to and configuration changes in SCADA systems and PLCs.· IoT device monitoring: Detects unauthorized devices or anomalous communication patterns.· Intellectual property protection: Tracks access to CAD files, production blueprints, and R&D data.4. Public and Government SectorPublic and government agencies use SIEM to protect classified information and national assets. SIEM is an essential tool for safeguarding national security.Use examples:· National threat monitoring: Integrates national CERT (Cyber Emergency Response Team) data with SIEM to obtain real-time threat intelligence.· Classified access auditing: Monitors logins to classified systems and access to sensitive files.· FISMA/NIST compliance: Automates assessments of control items and incident tracking.✅ The Role of SIEM in Modern Security OperationsSIEM platforms have now moved beyond simple log collection to become core security infrastructure encompassing threat detection, incident response, regulatory compliance, and operational efficiency. In particular, through integration with SOAR, EDR, and other tools, detection accuracy and response speed continue to improve, and their use is expanding across a wide range of industries. For organizations that want to run their security programs with greater precision, SIEM is an essential tool. It can raise threat detection capabilities, improve the speed and accuracy of response to security events, and effectively manage compliance requirements.Splunk Enterprise Security is a leading SIEM solution that meets these needs.It collects and analyzes security data in real time, identifies threats through advanced correlation analysis and user behavior-based detection, and automates response processes. With risk-based alerting (RBA), intuitive dashboards, and asset- and identity-based detection capabilities, it supports a high level of visibility and unified security operations even in complex hybrid environments. It can be applied flexibly across a variety of environments, from on-premises to cloud, and is effective in strengthening the practical capabilities of the security operations center (SOC). ▶ Splunk Enterprise Security : Learn MoreSplunk Enterprise Security is a unified threat detection, investigation, and response (TDIR) platform that streamlines security workflows into a unified environment. It integrates capabilities including security information and event management (SIEM), agentic AI and SOAR for automation, and user and entity behavior analytics (UEBA) and AI/ML for improved detection accuracy and response speed.Drawing on its expertise in big data, CloudNetworks operates a dedicated team specializing in the implementation and technical support of the Splunk platform. For inquiries about adopting and using Splunk, please contact CloudNetworks, an official partner.

August 28, 2025

Oracle Linux 10 : Supporting Cloud Workloads with High Performance and Enhanced Security

2025/08/14 by. pr@cloudnetworks.co.kr

Oracle Linux 10 : Supporting Cloud Workloads with High Performance and Enhanced Security

Oracle Linux 10 is now generally available for 64-bit Intel and AMD (x86_64) and 64-bit Arm (aarch64) platforms. Oracle Linux 10 delivers cloud-scale business agility along with strong security and outstanding performance for demanding workloads. Key features include the latest cryptographic capabilities, enhanced developer tools, and innovations to strengthen infrastructure resilience, enabling enterprises to build and run applications faster and more securely in distributed and multi-cloud environments.Following the release of Unbreakable Enterprise Kernel 8 (UEK 8), optimized on Oracle's latest long-term support kernel, Oracle Linux 10 includes UEK 8.1. This reflects Oracle's ongoing commitment to delivering industry-leading performance and stability. Oracle Linux 10 also includes an updated Red Hat Compatible Kernel and maintains 100% application binary compatibility with Red Hat Enterprise Linux 10. Keeping its promise to make Linux open and freely available to everyone, Oracle, as a founding member of the Open Enterprise Linux Association (OpenELA), continues to contribute to, maintain, and support enterprise Linux source code.☑️ Key Features of Oracle Linux 10A High-Performance Kernel at the Core of Oracle Linux 10Unbreakable Enterprise Kernel 8 (UEK 8), the default kernel of Oracle Linux 10, is designed for data-centric and compute-intensive workloads. It includes advanced capabilities across memory management, file systems, and networking, with contributions from both Oracle and the upstream community. Customers around the world run their systems on Oracle Linux and UEK in mission-critical distributed environments, including Oracle Database, Oracle Exadata, and Oracle Cloud Infrastructure (OCI). Across a variety of industries, including finance, the public sector, and education, Oracle Linux is trusted as the foundation for a wide range of applications, including OLTP, large-scale data analytics, and AI/ML workloads.Proactively Respond to Threats and Operate Reliably with Zero-Downtime PatchingOracle Linux 10 supports Ksplice zero-downtime patching, provided with Oracle Linux Premier Support. This allows critical updates to the kernel and user space (including glibc and OpenSSL) to be applied without rebooting the system. Automated live patching technology applies critical updates within seconds, keeping systems secure and up to date without interrupting running applications. Oracle Ksplice avoids patch-related reboots and helps improve operational efficiency and reduce costs across on-premises and cloud environments.Enterprise-Grade Security Capabilities for Future Security ChallengesFor enterprise environments that require strong authentication and zero trust principles, Oracle Linux 10 has significantly improved OpenSSH security and usability. Highlights include keystroke obfuscation to prevent side-channel attacks, stronger restrictions on key forwarding and usage, and automatic termination of inactive SSH channels. The SSH daemon has been redesigned to separate connection handling from session management, reducing the attack surface. The FIDO-based authentication system provides a more secure environment through improved hardware key handling and protection against credential overwriting.To support new cryptographic standards and protect data, Oracle Linux 10 introduces Post-Quantum Cryptography (PQC) as a Technology Preview. These are next-generation algorithms designed to prepare for quantum computing-based attacks, and the pkeyutl utility supports encapsulation and decapsulation operations, including the newly defined ML-KEM (based on FIPS 203) algorithm.※ Note: The Post-Quantum Cryptography (PQC) Technology Preview is not intended for use in production environments and is provided for testing and development purposes only.Enhanced Development Tools for Superior Performance and Scalable InnovationOracle Linux 10 delivers upgrades across the tools developers use every day, including the latest compiler toolchains and improved observability. In addition to C, C++, and OpenMP-related features, GCC provides security hardening options, improved diagnostics, and performance optimizations. Valkey, a high-performance in-memory key-value store that fully replaces Redis while offering full compatibility and scalability, has also been introduced. Most applications can use existing Redis configurations and data as is, without modification. In addition, Grafana offers a refreshed UI and enhanced user access control, and the latest APIs for .NET developers expand networking and data access capabilities and support a variety of platforms and architectures.Optimized Programming Capabilities for Next-Generation ApplicationsOracle Linux 10 provides updates to improve performance and increase development efficiency across major programming languages and database technologies. Python runs faster thanks to compiler optimization settings, performance improvements through inlined comprehensions, and more readable type syntax. In addition, Perl, Node.js, MySQL, and others have been upgraded with improvements in security, performance, and developer productivity.▶Oracle Linux : Learn MoreOracle uniquely provides Linux with everything needed to deploy, optimize, and manage applications on-premises, in the cloud, and at the edge. It is more secure, easier to manage, and tuned for demanding cloud-scale workloads. Automation, virtualization, management, high availability, cloud-native tools, Kubernetes, and more are all included and supported under a single Premier Support subscription.Through its dedicated team, CloudNetworks provides Oracle Linux implementation and technical support services. For inquiries about Oracle Linux support services, please contact CloudNetworks, an official partner.

August 14, 2025