MD1 The emergence of cloud security

Question 1

Cloud computing

Answer 1

United Kingdom’s National Cyber Security Centre defines cloud computing as, “An on-demand, massively scalable service, hosted on shared infrastructure, accessible via the internet.”

Question 2

Cloud-based services

Answer 2

The term cloud-based services refers to a variety of on demand or web-based business solutions. Depending on a company’s needs and budget, services can range from website hosting, to application development environments, to entire back-end infrastructure.

There are three main categories of cloud-based services:

• Software as a service (SaaS)
• Platform as a service (PaaS)
• Infrastructure as a service (IaaS)

Question 3

Cloud-based services

1.Software as a service (SaaS)

Answer 3

SaaS refers to front-end applications that users access via a web browser. The service providers host, manage, and maintain all of the back-end systems for those applications. Common examples of SaaS services include applications like Gmail™ email service, Slack, and Zoom software.

Question 4

Cloud-based services

2. Platform as a service (PaaS)

Answer 4

PaaS refers to back-end application development tools that clients can access online. Developers use these resources to write code and build, manage, and deploy their own apps. Meanwhile, the cloud service providers host and maintain the back-end hardware and software that the apps use to operate. Some examples of PaaS services include Google App Engine™ platform, Heroku®, and VMware Cloud Foundry.

Question 5

Cloud-based services

3. Infrastructure as a service (IaaS)

Answer 5

IaaS customers are given remote access to a range of back-end systems that are hosted by the cloud service provider. This includes data processing servers, storage, networking resources, and more. Resources are commonly licensed as needed, making it a cost-effective alternative to buying and maintaining on premises.

Cloud-based services allow companies to connect with their customers, employees, and business partners over the internet. Some of the largest organizations in the world offer cloud-based services:

Google Cloud Platform

Microsoft Azure

Question 6

Cloud security

Answer 6

A PaaS client pays to access the resources they need to build their applications. So, it is reasonable to expect them to be responsible for securing the apps they build. On the other hand, the responsibility for maintaining the security of the servers they are accessing should belong to the cloud service provider because there are other clients using the same systems.

In cloud security, this concept is known as the c. Clients are commonly responsible for securing anything that is directly within their control:

Identity and access management

Resource configuration

Data handling

Question 7

Shared responsibility model

Answer 7

Clients are commonly responsible for securing anything that is directly within their control:

Identity and access management

Resource configuration

Data handling

Note: The amount of responsibility that is delegated to a service provider varies depending on the service being used: SaaS, PaaS, and IaaS.

Question 8

Cloud security challenges

Answer 8

Misconfiguration: is one of the biggest concerns. Customers of cloud-based services are responsible for configuring their own security environment. Oftentimes, they use out-of-the-box configurations that fail to address their specific security objectives.

Cloud-native breaches: are more likely to occur due to misconfigured services.

Monitoring access might be difficult: depending on the client and level of service.

Meeting regulatory standards: is also a concern, particularly in industries that are required by law to follow specific requirements such as HIPAA, PCI DSS, and GDPR.