How do I tell legitimate cloud traffic from an attacker's rented server?

By looking at who the destination is, how the connection behaves and whether anything in your business explains it. Attackers like rented cloud servers because anyone can create one in a couple of minutes and the address belongs to a reputable provider, so the provider's name alone proves nothing. Better questions: does the destination match a service you use, by its name in the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake or DNS, and is that service in your list of suppliers? Is the connection regular, small and around the clock, like a program checking in, rather than driven by people during working hours? Did it start right after something unusual on that device, such as a new program or a login from abroad? Does a server that normally only receives connections suddenly open them outwards? A legitimate backup or monitoring service usually has a documented destination and a contract; an unknown virtual machine contacted every five minutes by a workstation does not. NetSenX flags the regular check-in pattern, called beaconing, and unusual outbound volume on every plan, with the destination, so you can ask the right owner.

← All 25 questions on Cloud and SaaS securityAll topics