CCSP Domain 5: Cloud Security Operations Flashcards
BICSI
The Building Industry Consulting Service International issues certification in the area of complex cabling for data systems as well as develops standards for them.
This standard is focused on cabling design and setups and also includes specifications on power, energy efficiency, and hot / cold aisle setups.
IDCA
The International Data Center Authority has established the Infinity Paradigm, which is intended to be a comprehensive data center design and operations framework – i.e. it covers all aspects of data center design.
NFPA
The National Fire Protection Association publishes a large collection of standards regarding fire protection for almost any type of facility – from data centers to offices, vehicles, etc.
Uptime Institute
The Uptime Institute publishes the most commonly used and widely known standard on data center tiers and topologies. It is based on a series of four tiers, with each representing a progressive increase in standards for reliability, redundancy, connectivity, fault tolerance, redundancy, and cooling.
Optimal temperature range in a data center
Temperature: 64.4 - 80.6F or 18-27 C
Optimal humidity range in a data center
Humidity: 40-60 percent relative humidity
Storage communication
Storage traffic should be segregated and isolated on its own LAN. (Ergo, treated as LAN traffic rather than WAN traffic due to importance and heavy network utilization.)
iSCSI is the most prevalent communications protocol for network-based storage; the iSCSI protocol allows for use of SCSI commands and features over TCP (transmission control protocol).
VLAN
VLANs (virtual local area networks) are used to segregate customers or application zones within the cloud service.
Confidentiality of cloud customer data within an architecture that relies on resource pooling and multitenancy is dependent upon network isolation and segregation.
TLS
Transport Layer Security has replaced SSL as the default acceptable method for encryption of data in transit across a network; it uses X.509 certificates to provide authentication and to encrypt communications between parties.
TLS handshake protocol
The ‘handshake’ protocol is what negotiates and establishes the TLS connection between the parties.
At high-level, the handshake consists of three phases:
1) Server parameters: The server responds with parameters the set the constraints for a secure transport layer
2) Key exchange: The client initiates an exchange of shared key material and parameters based on the Server parameters.
3) Authentication: The server is authenticated (and, optionally, the client) and provides key confirmation and handshake integrity.
The handshake in greater detail:
- client > syn > server
- client < syn-ack < server
- > ack >
- < serverHello, certificate, serverHelloDone <
- > clientKeyExchange, changeCipherSpec, finished >
- < changeCipherSpec, finished <
- > application data >
- < application data
TLS Record Protocol
The TLS record protocol is the actual secure communications method for transmitting of data; the record protocol is responsible for the encryption and authentication of packets throughout their transmission between the parties, and, in some cases, it performs compression of the packets.
DHCP
Dynamic Host Configuration Protocol is essential for automation and orchestration within a cloud environment.
Within a cloud environment, DHCP is used to centralize the issuance of IP addresses and maintain them in a static manner, where the IP, MAC address, hostname, and node names are set and not changed, and they are always assigned to the same virtual machine.
DNSSEC
DNS (Domain Name System) SEC is a security extension of the regular DNS protocol and services that allows for the validation of integrity of DNS lookups.
It allows a DNS client to perform DNS lookups and validate both their origin and authority via the cryptographic signature that accompanies the DNS response.
VPN
A Virtual Private Network facilitates the extension of a private network over public networks, and enables a device to operate as it it were on the private network directly.
A VPN works by enabling a point-to-point connection from a device to a private network, typically through software applications, but also can be done via hardware accelerators.
IPsec
IPsec is a protocol for encrypting and authenticating packets during tranmission between two parties, which can be a pair of servers, a pair of network devices, or network devices and servers.
DRS
Distributed Resource Scheduling is used within all clustering systems as the method for clusters to provide high availability, scaling, management, workload distribution, and the balancing of jobs and processes.
From a physical infrastructure perspective, DRS is used to balance compute loads between physical hosts in a cloud to maintain the desired thresholds and limits on the physical hosts.
DO
Dynamic Optimization is the process through which the cloud environment is constantly maintained to ensure that resources are available when and where needed and that physical nodes do not become overloaded or near capacity while others are underutilized.
What are the four key areas of a physical cloud environment?
CPU
memory (ephemeral storage)
disk (persistent storage)
network
Secure Keyboard Video Mouse (KVM)
Secure keyboard video mouse (KVM) switches combine physical and logical protections that assist organizations in protecting against unauthorized and malicious surveillance conducted through electronic emanations.
Video cables can emit significant emanations that, if duplicated, can provide a view of all activity to an unauthorized recipient that resides outside of the system’s otherwise physically protected area.
Secure Shell (SSH)
SSH is an administrative protocol used to manage remote hosts over the internet in an encrypted fashion. The client user can execute shell commands remotely and securely in the same manner that would be done locally.
Remote Desktop Protocol (RDP)
RDP services include encryption, smart card authentication, bandwidth reduction, resource sharing, the ability to use multiple displays, and the ability to disconnect temporarily without logging off. RDP also allows for the redirection of functions such as audio and printing.
Customer Management Console-based Access
Console-based access mechanisms are implemented proprietarily by each CSP vendor, which allows consumers to access, configure, and manage virtual machines. At a minimum access to the platforms should be done administratively through need-to-know management and technically through least-privilege controls. In addition, role-based dual-factor authentication should be required to access a cloud console.
