Week 11: Security Criteria - Building an Internal Cloud

Question 1

Why would an enterprise invest in a private cloud

Answer 1

Increased flexibility and increased security

Question 2

In general, nothing prevents public cloud providers from offering customers exclusive and separate sections “carved out” of overall infrastructure to implement a remotely hosted private cloud

However, doing so might undermine their ___

Answer 2

economic model

such exclusive sections of a public cloud infrastructure can be systematically and securely carved out of the combined hardware, storage, and network fabric

these exclusive sections can be forced to fall on sufficiently safe boundaries

Question 3

An organization can implement an ___as a proof of concept or to develop skills and experience

Answer 3

exploratory cloud

Question 4

exploratory cloud can be useful for

Answer 4

develop a hands-on understanding of the technical issues and possible complications that might be faced before making a larger commitment to an operational cloud

Question 5

The potential for better security with a ___ is ___at a ___overall cost than with traditional private IT

Answer 5

private cloud
greater
lower

Question 6

Before the recent rise of virtualization and more powerful servers, individual business applications resided on individual servers

This resulted in a chaotic and undisciplined landscape: ___

Answer 6

server sprawl

Question 7

With the rise of virtualization, this situation has evolved into one where the number of physical servers can be reduced

Without enforced discipline, server sprawl has become___

Answer 7

VM sprawl

Question 8

At the department level, the move to server virtualization seems to be a return to the ___mix of pooled and centrally managed resources

Answer 8

mainframe

Question 9

Cloud computing brings back the ___, and ___ model that marked the mainframe era

Answer 9

pooled

centrally managed

Question 10

While there is a good deal of overlap between mainframe and cloud computing, cloud is still unique in several ways

Answer 10

Cloud computing is far more services oriented than the mainframe model

The cloud model is more server failure tolerant than mainframes and more readily resource augmented as well

Question 11

If the private cloud is sized to both minimize excess capacity and to allow for peak demands, then ongoing cost reductions will include

Answer 11

Lower equipment cost

Lower than typical data center-related costs
- Lower power consumption (equipment and cooling)

Question 12

Infrastructure deviations to support the specific needs of internal customers (private cloud) fall into four main categories

Answer 12

Hardware Platform Variation
- Where users require different hardware for computing or storage, this cannot be economically supported unless these needs are sufficiently common to warrant dedicating a pool of identical resources

Network Variation
- Where network patterns are customized for small sets of servers, the cloud will give up some of its cost savings, unless there is a large enough need to deviate from the norm

Software Platform Variation
- It is significantly less difficult to support users who need a specialized operating system or software stack than it is to add additional hardware

Allocation Boundaries
- Allocation and provisioning of user and department usage should provide for segregation where confidentiality is a major concern

Question 13

To begin with, it is useful to analyze the use of ___in an internal data center and discern the level of usage at various times of the day, week, or month

Answer 13

existing servers

Question 14

Because of the ___population of cloud consuming users and applications in a private enterprise, a private cloud may not meet the advantages that a public cloud may

Answer 14

smaller

Unless there is off-peak load to consume otherwise idle cloud resources, a private cloud may lie largely idle for the remaining hours

Question 15

When individual servers are pooled together into a centrally managed private cloud, there are going to be opportunities to improve security in terms of

Answer 15

operational security

implementing future security capabilities

Question 16

When ___ is implemented at an enterprise level, more robust and capable solutions can be used in a cost-effective manner

Answer 16

identity

Question 17

An enterprise might use a public cloud for the bulk of its computing needs but still run a small in-house private cloud for ___

Answer 17

secure applications

Question 18

Reason for using private cloud

Answer 18

run a small in-house private cloud for secure applications

they may need to run a few older applications
- Another approach would be the use of virtualization or emulators to virtualize the nonstandard hardware platform that the application requires

Question 19

When there is no business need for making data from one group accessible to another group, the private cloud must enforce ___

Answer 19

separation

Question 20

A private cloud may also express some services to ___

Answer 20

external users

 - for instance, customers of the enterprise
 - Connectivity for customers must be secured and separated

Question 21

In summary, a private cloud must enforce various kinds of separation between sets of ___ and between ___and ___users

Answer 21

internal users
internal
external

Question 22

Exposing the cloud to either internal or external users must be done in response to a clear ___and a solid understanding of the ___

Answer 22

business need

risk factors

Question 23

To begin with, the ___to the cloud is the best place to filter out unwanted inbound traffic - for example

Answer 23

ingress
Blacklisted IP addresses
Whitelisted IP addresses

Question 24

Limiting Access to the Edge - two ways

Answer 24

To begin with, the ingress to the cloud is the best place to filter out unwanted inbound traffic

Secondly, we may authenticate inbound traffic by use of various means, including IPSec tunnels or VPN solutions

Question 25

When offering services to both internal and external users it is critical to avoid opportunities for non-enterprise users to gain access to enterprise data - methods of separation

Answer 25

Mixing enterprise and external user traffic must be avoided

Generally, SaaS traffic is terminated at a proxy or web service with data being passed to other services not directly reachable by users

Storage of enterprise and Internet users must be segregated

All user data should be encrypted

Sensitive enterprise data should not be processed by the same app instances that are processing public users’ data

Question 26

Isolation between realms can be effected through various means, including

Answer 26

physically separated networks

virtual local area networks (VLANs)

Such isolation should be reinforced via other mechanisms such as a firewall

Network isolation can also be achieved by using encryption

Question 27

A best practice in physical isolation is to contain separate categories of use (internal users, public Internet users, and so on) within groups of ___ (sometimes referred to as pods or compartments)

Answer 27

separate racks

Question 28

For higher assurance, it is a best practice to isolate these physical zones by physically surrounding them with ___

Answer 28

cages

Question 29

An overall production cloud infrastructure will most likely be logically divided for a number of distinct uses:

Answer 29

Development
Testing and Staging
Production

Question 30

Degree of assurance in isolation techniques (lowest to highest)

Answer 30

Software –> Cryptography –> Virtualization –> Physical Separation

Question 31

It is a best practice to maintain a separate network for ___

Answer 31

management traffic

Question 32

Among many important initial steps in setting up a private cloud is effectively addressing the need for ___ that will bridge your physical and virtual infrastructure

Answer 32

management tools

Question 33

It may be more cost effective to locate a private cloud in a professionally staffed and certified ___

Answer 33

hosting center

Only your organization would have physical access to your cages

Question 34

Data Center Sensors

Answer 34

Smoke, Motion, Power, Water, Door, Temperature, Humidity

Question 35

Operational Security Considerations (Private Cloud)

Answer 35

Antimalware
Device Configuration
Intrusion and Anomaly Detection
Data Backup and Storage

Question 36

Private Cloud Regulations

Answer 36

Location of Data

Data Retention