Domain 1: Cloud Concepts, Architecture and Design Flashcards
What are the cloud computing roles?
Cloud Service Customer: Company or person the consumes a cloud service
Cloud Service Provier (CSP): Company offering cloud services, e.g AWS, Azure, or GCP
Cloud Service Partner: Third party offering a variety of cloud based services (infrastructure, storage, application services, and platform services) using the assoicated CSP. Some partners provide their own or most of their own infrastructure and extend the service areas they can reach through the use of partnerships. e.g Dropbox can be deployed within AWS
Cloud service Broker: Find solutions to their cloud computing needs. Adds value through aggregation of services from multiple parties, integration of services with a company’s existing infrastructure, and customisations of services that a CSP cannot or will not make.
What are the Key Cloud Computing Characteristics?
- On Demand Self-Service: Rapidly provisioned and released with minimal management effort or service provider interaction. Requires vendor management.
- Broad Network Access: For public and community clouds. the internet provides the network access. For private cloud, this could include corporate network.
-
Multitenancy: Server may have more than one company purchase access, like an apartment building. Each tenant’s data remains private and secure in the same belongings (data) in an apartment isloated from neighbour (data). However, if the hypervisor is comprimised, this could lead to loss of data.
- Resource pooling: Multiple customers share a set of resources including servers, storage, application services. Inability to ensure data erasure can mean that remants of sensitive files could exist on storage allocated to another user.
- Rapid Elasticity and Scalability:
- Measured service: In private cloud, allow an organisation to charge each department based on their usage. For public cloud, each customer to pay for the resources consumed - and pay for metered service for peak peroids e.g Black Friday sales, and etc.
What are the building block technologies for Cloud Computing?
- Virtualisation: Allows the sharing of servers, by leveraging existing hardware and running multiple different isolated servers. CSPs leverage this idea, by creating tenants - independant and seperate environments. This allows CSPs spread over many locations to spin up /down services easily. However, this has securitty implications over data residency requirements. In addition, the Hypervisor is critical to keeping the data segmented, and if comprimised comprimises all VMs - its security is the responsibility of the CSP.
- Storage: Two types Storage area Networks (SAN) or Network attached storage (NAS). SAN provides secure storage acoss the domain, and appears like a single disk, which the storage is spread across multiple locations. NAS uses TCP/IP and allows file level access, and appears as single file system. Security of the storage is the responsibility of the CSP. Major security issues, if file fragments exist on a disk after it has been deallocated from one customer to another.
- Networking:
- Databases: Adminstration of the underlying database is the CSP’s responsibilty. A number of different database options, and types including data warehouse, data lakes, etc.
- Orchestration: the glue that ties all the other pieces together through programming and automation. It is able to manage many CSPs, in various deployment models. e.g. IBM Cloud Orchestration, AWS Cloud formation, and etc.
What is the NIST 500-292 cloud reference architecture?
A role based architecture, is a reference architecture centred around the 5 core roles that creates a framework or mapping of cloud computing activities and cloud capabilites.
Cloud Consumer: Procuremurement and use of cloud services.
Cloud Provider: Entity that makes services available, including service deployment, orchestration, management, security and privacy.
Cloud Auditor: Independant examination and evaluation of cloud service controls - focused compliance, security or privacy.
Cloud Broker: Entity involved in 3 primary activities: aggregation of services from several CSPs, integration with existing infrastructure, and customisation of services.
Cloud carrier: entity provides the network or telecommunication connectivity.
What are the cloud service capabilities?
Application capabilities: access an application over the network from multiple devices & locations. Users do not have the abilitiy to control or modify underlying cloud infrastructure. Supporting all of the different types of devices is the responsibility of the CSP.
Platform capabilities: allows for the development and deployment of solutions. Users can modfy the solutions they deploy (ones they develop & customise). No capabilities to modify the underlying infrastructure.
Infrastructure capabilities: users can control over the OS, installed tools, solutions installed, provisioning of infrastructure compute, storage, and network other computing resources - with the only exception of hardware.
What is set of transformative technolgies that has led to increased capabilities of cloud computing?
- Machine Learning: component of AI to create solutions that learn and improve without programming. As a result of large inexpensive data storage and technologies (data warehouse, data lake), and computing power inceases the effectiveness of ML. Risks include data storage with all data stored in single location, privacy concerns include what can be learnt from the data, and how that knowledge will be learnt.
- Artifical Intelligence: goal of AI to create a machine that cannot be distinguished from humans - and impact lower skill workforces. This greater ability to aggregate and manipulate data through tools created through AI research impacts security and privacy.
- Block Chain: open distributed ledger of transactions, often financial, between two parties. Transaction is recorded in a permanent and verifiable manner. Blocks are linked cryptographically distributed across a set of computers.
- Internet of things: great deal of data is being generated and stored from IOT devices, which is mined from the cloud. Not always the data that are targeted, device can be part of DDoS, or the technology itself can be used as part of the attack e.g cameras.
- Containers: In traditional virtualisation - the hypervisor sits atop the host OS, VM sits atop of the hypervisor, with VM contains the guest OS. However, containerisation no hypervisor, and no guest OS with. A container runtime sits above the host OS, and uses it to access needed system resources and with the virtualisation occuring higher in the stack requiring fewer resources and no additional OS. Containers are like priviledged users.
- Quantum Computing: uses quantum physics to build powerful computers - and when combined with cloud make AI & ML more powerful. Has the ability to transform modeical research, AI, and computing technologies. Security concern includes breaking encryption/decryption as computing increases.
What are the security concepts relevant to cloud computing relevant to encryption and access control?
Cryptography and Key management: In multi-tenancy there is an ability to securely wipe the physical drive. Also, it will required to deteremine if a VM or container has been unaltered after deployment. Another issue is key management, and ensure keys stored seperately from data.
Access Control: Can be physical, technical or administrative. Phyiscal is the responsibility of the CSP. Administrative controls are policies, procedures, including access control, logging & monitoring. Customers, are responsible for determining the right administrative controls. Technical controls are a shared responsibility. e.g CSP will federate a customers IAM with the responsibility of the integration whilst the customer is responsible for the maintance of the IAM system.
Data Media santisation: Overwriting, is the idea that data marked for deletion will eventually be cleared once that sector is written over. Encrypting all the data would ensure that data even if marked for deletion is secure. Cryptographic erase, is taking the encryption keys and zeroising them, ensuring data is not retrievable.
What are the network security considerations for cloud security?
- Network Security Groups: provides a set of security rules or virtual firewall for a group of cloud resources. It is applied as a layer around the VM, subnet, or other cloud resource.
- Cloud gateways: keeps communication between the customer and the CSP off the internet.
- Contextual based security: Context includes things such as identity, determined through IAM system, location, time of days, or endpoint type. e.g. connecting from the corporate network though a VPN or from public or user connects from an endpoint not registered.
- Ingress and Egress montioring: ingress controls can block all or some external access. Inbound connections can be limited to those that are in response to a request. Egress controls prevent internal resources from connecting to malicious locations, e.g. command & control.
What are the virtual security considerations for cloud security?
- Hypervisor security: Type 1 hypervisor is faster and more secure, but difficult to set up more than type 11 such as VMware or VirtualBox. Hypervisor is a natural target of malicious users as they control all the resources to the VM. For the customer, security is controlled by limiting admin access. All access to the hypervisor should be logged and audited. Hyervisor must remain current.
- Container securirty: containers provide efficiency, portability, easier scaling. Improves security by islating cloud solution, and host sytem. Security risks occur through inadequate IAM, and through misconfigured containers. Traditional DevOps practices requires education and training. Specialised container OS is benefical as limits capabilities of the underlying OS to those required, e.g similar to disabling ports, and OS functionality.
What are the design principles of secure cloud computing?
-
Cloud Secure Data Lifecycle: broken down into 6 steps:
- Create - creation of new content
- Store - storing new content
- Use - data activities such as viewing, processing & changing
- Share - exchange of data between two entities
- Archive - data is no longer used but is stored
- Destroy - data has reached end of its life defined in a data retention policy. Deleted.
- At each step in the lifecycle, there is a possibility of breach or leakage. General tools for preventing these are encryption and use of DLP
- DR & Business Continuity: BCP may focus on critical business process neccessary to keep the business going while DR takes place. Availability zones in a region protect from DC failures. Multiregion availability zones, provide enhanced coverage. DRPs rely heavilty on data backups. DRP is about returning to normal operations. Cloud backups works only if you have network access and sufficient bandwidth.
- Cost -benefit analysis: Cloud computing benefits reduce capital costs, but have higher operational costs. The tax benefits for capex vs opex may also need to be considered.
What are some functional security requirements for moving to cloud safer for customers information and/or processes?
- Portability: Frequent moves between CSPs, and CSP to on-prem can result in data loss or modification impacting availability and integrity. Portability refers to data and services moving seamlessly and can be automated.
- Interopability: refers to the ability to share data between tools and cloud environments, and between cloud and on-prem soltions. A way to bridge the gaps is via APIs.
- Vendor Lock-in: Solving portability and interoprability will go a long way to solving vendor lock in. Another issue is if one CSP provides functionality that others do not, e.g AWS cloudtrail which supports auditing of your AWS account supporing governance and risk managment, and if the organisation was to move away from AWS, the GRC functionality has to be built into the new solution.
What is Cloud Computing?
- Ubiquitous
- Convenient
- Self Service model
- that allows for on Demand network access to shared pool of computing resources
What are the four cloud deployment models?
- Public
- Private
- Community
- Hybrid
What are the key Characteristics of Public Cloud?
- Available to anyone who purchases the services
- Multi-tenant
Concern:
- Privacy, security, & Vendor lock in
What are the key Characteristics of Private Cloud?
- Single-Tenant: Available only to a single organisation
- Maybe located on-prem or hosted by a CSP
- Ideal for files and data that are too senstive to put on a public cloud (percieved to be more secure).
- Secure wipe of data is possible
Concern:
- More expensive
What are the key Characteristics of Community Cloud?
- Multi-tenat but limited to a group of comapnies or individuals (e.g. Universityes of Governments)
- Maybe hosted by one organisation with access provided to others.
What are the key Characteristics of Hybrid Cloud?
- Normally a combination of private and public clouds in whatever way makes sense to the business.
- Example, primary system is in a private cloud with backups stored in a public cloud (OR) sensitive data in a private cloud, with less sensitive data (email) in public cloud.
- Orchestration becomes important to keep it manageable.
What are the various cloud computing roles?
- Cloud Service Customer
- Cloud Service Provider
- Cloud Service Partner
- Cloud service broker
