Domain 3 - Cloud Platform and Information Security Flashcards
What are key components of the cloud infrastructure?
a) Physical Infrastructure (physical components of the cloud - e.g. data centers, servers, routers etc.)
b) Services (Virtualization, Compute, Storage, DBs)
c) Network and Communications (allows customer to reach cloud)
What are risks and mitigations associated with physical security?
CSPs responsible for physical security. Risks and Mitigations include:
- Physical Security (security guards, locks, fences, lights)
- Identity and Access Management (SSO, SAML/OAuth2/MFA)
- Data confidentiality and integrity (encryption, message digest, digital certs, PKI, TLS, VPN).
Who has security responsibilities for network and communications?
- CSP - responsible for network devices on its side
- Customer - responsible for network devices on their side
- Both must use secure protocols like HTTPS and/or VPN
- In IaaS - CSP provides technology, but customer is responsible for configuring the environment and enforcing company policy
- In PaaS - CSP provides physical components, internal network and tools; customer responsible for proper use and connection to the CSP
- In SaaS - customer responsible for securely accessing service (e.g. secure data transfer).
Who has security responsibilities for compute?
- CSPs responsible for physical security, virtualization/hypervisor (patching and keeping up to date).
- Customers responsible for data and users
- In between the two ends, responsibility varies by IaaS, PaaS, SaaS
What kinds of controls do CSPs have for hypervisor security?
- Controlling physical access to servers
- Ensuring only authN and authZ individuals have access
- Logging and Monitoring
- Patching and vulnerability management
- Network isolation - e.g. keeping virtual networks separate to prevent lateral movement (e.g. VLAN hopping); by using SDNs to create VPCs, subnets, routes.
- Using encryption
Who has security responsibilities for storage?
- CSPs responsible for physical security and patching, maintaining data storage technology (e.g. upkeep S3).
- Customers responsible for security of data they put in it.
- CSPs provide tools (e.g. IAM, encryption), customers responsible for properly using them
- Customers also responsible for mitigating risks due to not having physical access to storage medium (e.g. crypto shredding).
What is the management plane?
The Web interface and API used to configure, monitor and control the cloud environment.
Separate from the control plane and data plane.
What are controls to secure the management plane?
- Strong password
- MFA (HW better than SW or SMS based)
- Not using a root account
- Role-based access controls (e.g. groups and policies)
- Limit access to management planes (SCPs)
- Separate dev, test and prod environments
What is ABAC?
Attribute based access control -e.g. using attributes such as user name, device type, point of connection (e.g. internet vs corp network) to provide access.
What is IDaaS?
- IDentity as a Service.
- Identity management system is provided by a 3rd party as a SaaS Service.
- SSO, MFA
- Integration with existing on-prem Active Directory systems
What are access control methods in the cloud?
- Use of Federation (single entry point enhances security)
- Use of IDaaS - to keep cloud separate depending on business needs.
What are the considerations in designing a secure data center?
- Logical Design (involves tenant partition and access controls)
- Physical Design (involves location/siting and buy-and-hold)
- Environmental Design (HVAC, Multivendor Pathway Connectivity).
Most of this is the domain of the CSP. However, customers still have an obligation to properly use the logical separation controls to ensure that their data is secure).
Also to verify that the CSPs have done this properly -e.g. via SOC2 reports.
When moving to the cloud, what areas must the risk assessment and analysis of the CSP focus on?
- Privacy and Information Security.
- Authentication is a key question - a breach of the CSP’s IAM service could mean a breach of on-prem since users reuse passwords.
- Use of IDaaS vs. Federation with on-prem (each with their own pros and cons)
- Data Security is another concern
- Incident response (does CSP have proper tools - e.g. logging/monitoring, vulnerability scans, pen test etc.)
- Compliance (e.g. handling of PII, PHI data)
- Downtime due to loss of connectivity
Customer can assess this via SOC2 Type 2 reports.
What are cloud vulnerabilities, threats and attacks?
- Primary cloud vulnerability : access via Internet.
Risks: loss of availability due to DoS attacks - Multitenancy - breakdown in tenant separation may cause data exposure (control: encryption)
- Insider threat: unlawful access by CSP employees (encryption, with keys managed by customers)
What are virtualization risks?
- Breakdown of tenant isolation due to hypervisor issues (CSPs responsible for this)
- VM sprawl - users creating VMs and forgetting to shut them down (security and cost issue). Sensitive data may be stored on these VMs.
