1. Cloud Computing Concepts and Architectures - DONE Flashcards
Cloud Logical Model Definitions of Cloud Computing Cloud Service Models Cloud Deployment Models Reference and Architecture Models Cloud Security, Compliance Scope, and the Shared Responsibility Model Areas of Critical Focus in Cloud Security
What are the 4 layers of functionality and applicable security requirements? (traditional and cloud environments)
*Infrastructure layer -Infrastructure security
*Metastructure layer -Virtual environment security
*Infostructure layer -Data security
*Applistructure layer -Application and operating system security
What is the infrastructure layer comprised of?
What are the Security concerns surrounding the infrastructure layer?
In this layer, there are the servers, networking, and storage pools.
Describe the Metastructure layer and how it works.
2.What is the single biggest difference between the cloud and traditional IT
In this layer, you both configure and manage a cloud deployment of any type. It is within the metastructure logical layer that you build the virtual tools required for a virtual world (the cloud)
You’ll perform configuration in themanagement planethrough a graphical user interface (GUI), a command-line interface (CLI), or an API, depending on what the provider offers to interact with its infrastructure.
Want to add a new user for SaaS? You do it here. Want to set up a zero-trust network in IaaS? This is the place to do it.
Describe the Infostructure layer and its security concerns.
This is where the information and data reside. This could be file storage, databases—whatever. Security in this layer doesn’t really change; how you secure things may change, but the principles of data security remain the same.
Describe the Applistructure layer and its security concerns.
Applications and all of the services used to build and support them reside here. Your applications could be running on a Microsoft or Linux server of your own, or they could be running in technologies such as containers, microservices, or serverless networks.
If you take an image of a running system and migrate it into the cloud, nothing changes from a security perspective. In this scenario, operating systems will always need patches, and application security still applies as it always has.
As you start to take advantage of the new technologies the cloud offers, your security is likely to change dramatically.
The web server is part of the applistructure. “installing a firewall agent, that would occur at the applistructure layer.
What is the management plane?
It is part of the metastructure.
The element of a system that controls the management of infrastructure, platforms, applications, and resources through the use of API calls and web consoles
What should your main focus be on when you are migrating your application in a like-for-like fashion
Focus your efforts on the metastructure layer.
Nothing about your assessment of the application itself changes. The controls at the operating system are the same, as are the application security controls.
List the essential characteristics of the cloud.
- Resource pooling
- Rapid elasticity
- Broad Network Access
- On-Demand Self-Service
- Measured Service
Define Resource pooling
Resources (Computer, Network, Storage) are pooled and consumers are granted access.
Multitenancy - A consumer’s access to the pools is tightly isolated from that of other consumers, typically based on policies atthe provider’s side. (“ISO/IEC 17788 refers to multitenancy as a sixth essential characteristic.)
Define Broad Network Access
The service is available over a network (the Internet). There is no special requirement for direct physical connectivity or provider-supplied network connectivity.
e.g. manage an entire IaaS implementation via the browser on your cell phone.
Define Rapid Elasticity
It enables consumers to scale resources based on demand, often automatically.
Scaling up generally refers to using more powerful servers (such as a four-CPU configuration instead of two), whereas scaling out refers to adding more servers (for example, servers to a web farm to service requests).
In addition to adding capacity when demand increases, you need to be able to scale down when demand drops. This aspect is critical, because you don’t want to scale up to respond to a temporary increase in demand.
Define Measured Service
The measured service essential characteristic makes the cloud a pay-as-you-go model of computing: you’re simply charged for what you use.
Another term used in the CSA Guidance is “utility computing,” which is akin to how you consume electricity or water from a utility.
Define On-Demand Self-Service
You can provision resources on your own without human intervention on the provider’s side.
If your provider tells you that your ticket for a new server instance is very important to them and they will act on it in 48 to 72 hours, you’re being cloudwashed.
List the 3 service models of the cloud.
- IaaS
- PaaS
- SaaS
What is IaaS
IaaS is the underlying foundation that consists of the physical facilities and infrastructure hardware.
or
an IaaS system can be summarized as consisting of facilities (physical data centre), hardware (proprietary or standard), abstraction (virtualization), and orchestration (APIs)
What is a hypervisor?
The most commonly known form of virtualization is a virtual machine, which is generally synonymous with hypervisor (also called a virtual machine monitor (VMM)) technology.
Essentially, the hypervisor acts as the host and allows a single hardware server to host many virtual machines that are referred to as “guests.” The hypervisor is tasked with “tricking” the guest machines into thinking they are directly accessing the underlying hardware, but in reality, they are operating in an isolated virtual environment with their virtual hardware resources. (Put in a more polished way, the hypervisor is an abstraction layer that decouples the physical hardware from the guest operating system.)
What are the different types of hypervisor?
There are two types of hypervisors of note: Type 1 hypervisors are installed directly onto the physical server (such as VMware ESXi, Xen, or KVM), and Type 2 hypervisors are installed on top of the operating system already running on a server (such as VMware Workstation, VMware Workstation Player, or Oracle VM VirtualBox). I can’t imagine any cloud service provider using anything other than a Type 1 hypervisor.
The hypervisor used by the provider can have an impact on consumers and thus should be known in advance of provider selection. Not all hypervisors are created equal from performance and capability perspectives.
Define Orchestration (Iaas context)
The orchestration enables a controller to request resources from the pools of resources, and all this is automated through the use of APIs (mostly RESTful APIs).
Say you want to create an Ubuntu Server instance with two CPUs, 12GB of RAM, 2TB of storage, and two network cards. Describe what happens behind the scenes at the provider side?
The cloud controller contacts the compute controller to request that a new server with two CPUs and 12GB of RAM be created.
The cloud controller contacts the storage controller to allocate 2TB of storage. This storage is connected to the new server instance through a storage network.
The cloud controller requests two virtual network interface cards from the network controller.
After all of this is performed, the cloud controller takes the requested Ubuntu Server image, copies it to the newly created virtual server, boots it, and configures it. Once this is done (measured in seconds or minutes), the controller makes the connection information available to the consumer.
What does the shared responsibility model refer to?
When looking at securing or assessing a cloud environment, you should keep in mind that the CSP is always responsible for implementing and configuring some aspects of the computing environment, and you are responsible for other aspects of the environment.
Describe the security responsibility that comes with Saas.
You’re renting access to a turnkey application. The provider is responsible for the application itself and everything that supports it, down to the physical security. As the customer, you’re limited to what is exposed to you as a configurable item. For example, the provider could enable you to create a new user and assign certain permissions to that account, or it may allow for only one type of user; it’s up to them to create it, and it’s up to you to determine whether it’s acceptable based on your risk tolerance.
Describe the security responsibility that comes with Paas.
In this example, we see a shared responsibility for the application security as well as the network security entries. Consider a scenario where you’re using PaaS to run a custom application that you created. All the security surrounding the application code is on you—it’s your application after all! But why is it shared? It’s shared because the provider is responsible for the platform you’re using to run the application on. As for the network security portion, the provider maintains the network and supplies standard security controls (such as firewalls and intrusion prevention systems), but what if you want certain IP addresses blocked? That part would be on you to integrate into your code, or you could use a web application firewall, for example.
Describe the security responsibility that comes with Iaas.
You’re involved in everything aside from the facilities, physical hardware, and hypervisor. For instance, the provider may offer you operating system images that have all the latest patches installed, but once you launch an image to make your instance, you’re responsible forpatching and securing everything to meet your security policies.
You are responsible for using the network controls the provider makes available (such as a virtual firewall service like a security group). The provider creates the virtual firewall service and exposes that security control to customers so they can configure it according to their requirements. It’s not the provider’s responsibility to configure those for you.
