Chapter 4

Question 1

Cloud computing Risks by deployment model

Answer 1

To prepare for cloud migration and the requisite contract negotiation (and for familiarization with CCSP CBK content), it is useful to review the risks particular to each of the cloud deployment models. These include the private, community, public, and hybrid cloud models.

Question 2

Cloud computing Risks: Private cloud

Answer 2

Personal Threats
Natural disasters
External attacks
Regulatory non compliance
Malware

Question 3

Cloud computing Risks: Community cloud

Eg: Online gaming as a community cloud

Answer 3

1.Resiliency thru shared ownership: this introduces additional risks because each node is its own point of entry and a vulnerability in any one node can result in an intrusion on the others

2.Shared costs: Overhead and cost of the infrastructure is shared among the members of the community, but so are access and control.

3.No Need for Centralized Administration for Performance and Monitoring:
Although this removes many burdens of centralized administration, it also removes the reliability of centralized and homogenized standards for performance and security monitoring.

E

Question 4

Cloud computing Risks: Public Cloud

Answer 4

Vendor Lock-in
Vendor lock-out
Multitenant environment

Question 5

Vendor lock-in

Answer 5

There are several things an organization can do to enhance the portability of its data:

1. Ensure favorable contract terms for portability.
2. Avoid proprietary formats.
   3.Ensure there are no physical or technical limitations to moving.
3. Check for regulatory constraints.

Question 6

Vendor lock-out

Answer 6

consider the following factors when selecting a cloud provider:

provider longevity
core competency
jurisdictional suitability
supplychain dependencies
legislative env

Question 7

Mulit tenant env

Answer 7

conflict of interest
escalation of privilege
information bleed
legal activity

Question 8

Cloud computing risks by service model

Answer 8

Another consideration in cloud migration and contract negotiation is the risks inherent in each of the cloud service models.

Question 9

Cloud computing risks - IaaS

Answer 9

Personal threats
External threats
Lack of specific skillsets

Question 10

Cloud computing risks - PaaS

Answer 10

interoperability issues
Persistent backdoors
Virtualization
Resource sharing

Question 11

Cloud computing risks - SaaS

Answer 11

Proprietary formats
Virtualization
Web app security

Question 12

Virtualization risks

Answer 12

1. Attacks on the hypervisor: type1, type2:
   Attackers prefer Type 2 hypervisors because of the larger surface area.
2. Guest escape:
3. Information bleed
4. Data seizure

Question 13

Guest Escape / VM Escape

Answer 13

An improperly designed or poorly configured virtualized machine or hypervisor might allow for a user to leave the confines of their own virtualized instance. This is referred to as guest escape or virtual machine (VM) escape. A user who has successfully performed guest escape might be able to access other virtualized instances on the same host and view, copy, or modify data stored there. Worse, the user might be able to access the host itself and therefore be able to affect all the instances on the machine.

Question 14

Information bleed

Answer 14

This is another risk stemming from malfunctions or failures. The possibility exists that processing performed on one virtualized instance may be detected, in whole or in part, by other instances on the same host.

Question 15

Data Seizure

Answer 15

Legal activity might result in a host machine being confiscated or inspected by law enforcement or plaintiffs’ attorneys, and the host machine might include virtualized instances belonging to your organization, even though your organization was not the target.