SE4455 Final (Unit 5-8) Flashcards
Name 4 cloud management mechanisms
remote admin system
resource management system
SLA management system
Billing management system
How does the remote admin system interface with underlying management systems?
Via APIs
What are the two types of remote admin system portals?
usage & administration
self-service
What does the usage & administration portal do?
centralized management controls of different cloud resources
Which remote admin portal provides IT resource usage reports?
Usage and admin portal
What does the self-service portal do?
shopping portal: allows consumers to search list of cloud services & resources
Why do remote admin systems use standard APIs?
- consumer can create own administration console and reuse it with multiple cloud providers
What does VIM stand for
Virtual Infrastructure manager
What does the VIM do?
manages multiple virtual resources and hypervisors across multiple physical servers
What is the name of the repository in a resource management system?
VM image repository
What does the VM image repository store?
Virtual resource templates to create pre-built instances (virtual server images)
Replication, load balancing, and failover systems are tasks performed by which cloud management system?
resource management system
What are the 2 forms of access for resource management system
- externally through a usage and administration portal
2. internally through the native user interface provided by VIM
What are the 2 components of the SLA management system?
SLA manager
quality-of-service measurements repository
What mechanisms are used to collect SLA data?
SLA monitors
SLA monitor agents intercept messages between who?
cloud consumer
cloud service
What are the 2 components of a billing management system?
pricing & contract manager
pay-per-use measurement repository
What does encryption help counter?
eavesdropping
malicious intermediary
insufficient authorization
overlapping trust boundaries
Symmetric key encryption is also known as ___
private/secret key encryption
Asymmetric key encryption is also known as ___
public key encryption
Which method of encryption is faster?
symmetric
What security does private key encryption offer?
integrity and non-repudiation (not confidentiality)
What security does public key encryption offer?
confidentiality only
What is the underlying encryption protocol for HTTP?
SSL and TLS
Does TLS use asymmetric or symmetric encryption?
Both
asymmetric for key exchange, then symmetric
T/F: RSA is a symmetric encyption cipher
False: asymmetric
T/F: AES is a symmetric encryption cipher?
True
T/F: hashing is non-reversible
True
What threats does hashing mitigate?
malicious intermediary
insufficient authorization
What security does digital signature provide?
authentication
integrity
non-repudiation
Digital signatures require ___ and ___ to be created
hashing
asymmetrical encryption
What does PKI stand for?
Public key infrastructure
What does PKI associate?
public keys with corresponding key owners
PKI relies on the use of ____
digital certificates
Who usually signs a digital certificate?
3rd party certificate authority
What does IAM stand for?
Identity and access management
What does IAM counter?
insufficient auth
DoS
overlapping trust boundaries
What are the four components of IAM?
authentication
authorization
user management
credential management
What does the authentication component of IAM include?
username + passwords digital signatures and certificates biometrics voice/face recognition IP addresses
What does the authorization component of IAM include?
defines granularity for access controls
What does the user management component of IAM include?
admin capabilities (create access groups, reset passwords, manage privileges)
What does the credential management component of IAM include?
establishes identities and access control rules for user accounts
What does SSO stand for?
Single sign-on
In SSO, who authenticates the consumer?
security broker
What security threat does SSO directly counter?
none!
What is the purpose of SSO?
enhance usability of distributed resources
When a security broker authenticates a consumer, what is established?
A security context (authentication token), which is persistent while the consumer accesses other cloud services
How are cloud-based security groups segmented?
According to security policies
T/F: cloud-based resources can be assigned to more than one logical cloud-based security group
true (assigned to at least one)
What does cloud-based security groups help counter?
DoS
insufficient auth
overlapping trust boundaries
What is hardening?
process of stripping unneccessary software to limit vulnerabilities
What are some examples of hardening?
remove redundant programs
close server ports
disable services
internal root account, guest access