3.6 Flashcards
High Availability across zones
These zones are physical locations that may hold two or more data centers and provide high availability within their zone. They are independent of each other with their own networks. Inside each network, they have their own power and Heating Ventilation and Air Conditioning (HVAC) systems that regulate their own cooling using hot and cold aisles. Applications can be distributed across multiple zones so that if one zone fails, the application is still available.
Resource Policies
These are policies that state what access level or actions someone has to a particular resource. This is crucial for resource management and audit. We need to apply the principle of least privilege.
Secrets Management
Secrets Management is the process of managing digital authentication to secure applications. It could be called a vault where the keys, tokens, passwords, and SSH keys used by privileged accounts are stored. It could be a vault that is heavily encrypted to protect these items.
Integration and auditing
Integration is the process of how data is being handled from input to output. A cloud auditor is responsible for ensuring that the policies and controls that the cloud provider has put in place are being adopted.
Audits may include:
Encryption Levels Access Control Lists Privilege Account Use Password Policies Anti-Phishing Protection Data Loss Prevention Controls
Storage Permissions
Users have a storage identity and are put into different storage groups that have different rights.
Storage Encryption
With cloud storage, you may need to have more than one type of encryption. You would use symmetric encryption as there will be a large amount of data; normally, AES-256 will be used. Microsoft uses RSA 2048 for blob storage. You will also need encryption for data in transit, such as TLS or SSL. Microsoft uses Transport Data Encryption (TDE) to access resources in the cloud using RSA 2048 or 3072.
Storage Replication
Replication is a method wherein data is copied from one location to another immediately.
a. Local Redundant Storage (LRS): Three copies of your data are replicated at a single physical location. Not good for high availability. It is the cheapest solution, but if the power goes then everything has gone.
b. Zone Redundant Storage (ZRS): Data is replicated between three separate zones within your region. It should be used in your primary region; however, if a disaster affects the region, then you have no access to data.
c. GEO Redundant Storage (GRS): Three copies of your data are replicated in a single physical location in the primary region using LRS, then one copy is replicated to a single location in a secondary region.
d. GEO Zone Redundant Storage (GZRS): Data is replicated between three separate zones within your primary region, then one copy is replicated to a single location in a secondary region.
High Availability Storage
High availability ensures that copies of your data are held in different locations.
Virtual Networks
A virtual network is very similar to a physical network in many ways but, for the Security+ exam, we must know the concept of virtualization. To be able to host a virtual environment, we must install a hypervisor on a computer hosting the VMs. A hypervisor is software that runs on a virtual host that lets the host run virtual machines.
Public and private subnets
Our cloud environment needs to be broken down into public subnets that can access the internet directly or private subnets that have to go through a NAT gateway and then an internet gateway to access the internet.
Segmentation
The security of services that are permitted to access or be accessible from other zones has a strict set of rules controlling this traffic. These rules are enforced by the IP address ranges of each subnet. Within a private subnet, VLANs can be used to carry out departmental isolation.
API inspection and integration
Representational State Transfer, known as REST, refers to a new way to write web service APIs so that different languages can be transported using HTTP.
Security Groups
A compute security group profile is allocated by using a security group template that also states the cloud account, the location of the resource, and the security rules.
Dynamic Resource Allocation
This uses virtualization technology to upgrade and downscale the cloud resources as the demand grows or falls.
Instance Awareness
We must monitor VM instances so that an attacker cannot place an unmanaged VM that would lead to VM sprawl and then ultimately VM escape. We must use tools like a Network Intrusion Detection System (NIDS) to detect new instances, and the IT team must maintain a list of managed VMs.
