Cloud Application Security (Chapter 6) Flashcards
What are the Common Cloud Application Deployment Pitfalls?
- Performance
- Scalability
- Interoperability
- Portability
- Availabiltiy and Reliability
- API Security
Common Cloud Application Deployment Pitfalls: Explain Performance pitfalls.
Cloud software development often relies on loosely coupled services. That means that designing for performance and ensuring performance goals are met can be complex, as multiple components may interact in unexpected ways, even in relatively simple designs.
The same complexity that can lead to performance issues can also allow developers to operate at almost any scale without maintaining infrastructure for the highest use cases, even when the solution is not being heavily used.
Common Cloud Application Deployment Pitfalls: Explain Scalability Pitfalls.
One of the key features of cloud environments is the ability to scale, allowing applications and services to grow and shrink as need and demands fluctuate.
It needs to be able to run across many instances at once, to retain state regardless of which instance or server is handling requests, and to handle faults with individual servers cleanly.
At the same time, developers need to ensure that data remains secure in transit at rest in an environment that is scaling as needed.
Common Cloud Application Deployment Pitfalls: Explain Interoperability Pitfalls.
Interoperability, or the ability to work across platforms, services, or systems, can be very important for cloud environments.
If you are providing a service, being able to interoperate with the systems that customers rely on can be a business advantage. If you are running your own services, being able to work on multiple platforms or in different cloud provider environments can help control costs and increase your options for hosting and service provider choice.
Common Cloud Application Deployment Pitfalls: Explain Portability Pitfalls.
Designing software that can move between on-premises and cloud environments, or between cloud providers, requires that the software be portable.
Portability concerns in cloud software development typically center around avoidance of components specific to certain cloud vendors, like APIs or internal tools.
At the same time, avoiding use of those APIs and tools can require additional work or may make it harder to leverage the advantages that the cloud environment can offer to applications and services that leverage their native tools.
Common Cloud Application Deployment Pitfalls: Explain Availability and Reliability Pitfalls.
At the same time, cloud providers do experience outages, and those outages can have a widespread impact. Even an outage that impacts a different cloud service provider than your own, or one that is centered in a different region or availability zone, can cause issues for your infrastructure or applications.
The interwoven and complex nature of cloud services means that understanding dependencies and how they may impact the reliability and availability of your own services can be challenging. In fact, they may be close to impossible to fully document in many organizations.
Why is Cryptography important in the cloud scenario?
Cryptography is a key element of [[3. Cloud Data Security|data security in the cloud]], and application designs and architecture need to take into account where cryptography will be used throughout the [[3.1 Cloud Data Lifecycle|data lifecycle]].
What kind of encryptions do you have in the cloud?
- Encryption of Data at Rest
- Encryption of Data in Transit
- Whole-Instance Encryption - Full Disk Encryption
- Volume Encryption
Explain encryption of data at rest.
Data at rest, whether it be short-term or long-term storage, should be protected from potential issues created by the use of shared infrastructure (multitenancy) in cloud environments.
Encrypting data at rest is a great way to prevent unauthorized access to data and to prevent breaches if inadvertent access occurs or if remenant data is accessible to future users of the shared infrastructure.
What is the primary requirement for security for any encryption scheme?
Keep in mind that the primary requirement for security any encryption scheme is the safe storage and management of the keys used to encrypt and decrypt.
Explain Full-Disk Encryption and Whole-Instance Encryption.
Also known as full-disk encryption (FDE), whole-instance encryption involves encrypting a complete system’s disk or storage.
Full-disk encryption protects data on the device in the event the device itself is lost or stolen, including if a shutdown instance or snapshot is stolen or breached.
Explain Volume Encryption.
Much like encrypting an entire device, volume encryption refers to encrypting only a partition on a hard drive or cloud storage that is presented as a volume, as opposed to an entire disk.
This is useful when the entire disk does not need to be encrypted because only the protected sections have data of any value, such as underlying operating system files that do not contain sensitive data.
Explain Encryption of Data in Transit.
Encryption of data in transit helps prevent attacks on the network path between systems or users.
The most common means of protecting data in transit is via Transport Layer Security (TLS), a protocol designed to ensure privacy when communicating between applications.
Is SSL and TLS the same?
You may here TLS referred to as SSL (Secure Sockets Layer), the protocol was used before TLS. In almost all modern cases, references to SSL actually mean TLS; but as a security practitioner you will have to make sure you check. SSL is outmoded and shouldn’t be in actual use!
What does the term unencrypted protocol describe?
The term unencrypted protocols describes systems that attempt to encrypt traffic whenever they can, only falling back to unencrypted when they don’t succeed.
This often means wrapping communications using TLS.
What are the high level differences between each type of virtualization?
Image
