2.5 Cloud and Data Center Security

Question 1

Benefits of cloud computing model (VM)

Answer 1

• Optimized existing hardware resources.
• Reduces data center costs.
• Increases operational flexibility.
• Maximizes efficiency of data center resources.

Question 2

Cloud computing

Answer 2

A pool of resources that can be rapidly provisioned in an automated, on-demand manner by virtualization.

Question 3

Principles of cloud computing that are contrary to network security best practices.

Answer 3

• Cloud computing doesn’t mitigate existing network security risks.
• Security required isolation and segmentation, cloud relies on shared resources.
• Security deployments are process-oriented, cloud computing environments are dynamic.
• Multi-tenancy a key risk.

Question 4

Key requirements for securing the cloud

Answer 4

• Consistent security in physical and virtualized form factors (application control and threat prevention).
• Segment your business applications using Zero Trust principles.
• Centrally manage security deployments; streamline policy updates.

Question 5

Traditional data security weakness

Answer 5

• Port First limits visibility and control.
• Lack any concept of unknown traffic.
• Multiple policies, no policy reconciliation tools.
• Cumbersome security policy update process.

Question 6

Types of traffic in a virtualized data center.

Answer 6

North-South

Ease-West

Question 7

North-south traffic

Answer 7

Data packets that move in and out of the virtualized environment.

Question 8

East-west traffic

Answer 8

Data packets moving between virtual workloads entirely within the private cloud.

Question 9

Cloud security common practice

Answer 9

• Isolate VMs into different tiers using logical network attributes (VLNA or VXLAN) or logical software constructs (security groups).
• Combination of north-south and east-west protection.

Question 10

Benefits of East-west protection

Answer 10

• Authorizes only allowed applications to flow inside the date center, between VMs.
• Reduce lateral threat mvmt. when front-end workload has been compromised.
• Stops known and unknown threats sourced internally within data center.
• Protects against data theft by leveraging data filtering and blocking anti-spyware communications.

Question 11

Implementing security in virtualized data centers

Answer 11

Phases

1. Consolidating servers within trust levels.
2. Consolidating servers across trust levels.
3. Selective network security virtualization.
4. Dynamic computing fabric (private or hybrid clouds)