Let's take a look at the principles of secure cloud computing.
In the first module, we took a look at some of the architecture, models,
service models, and so on, related to the cloud, but we want to
make sure that we use the cloud in a secure way.
In this course, we took a look at cloud concepts and architecture.
Now we're going to specifically look at the principles of
secure cloud computing, and finish this off with a look at
evaluating of cloud providers.
Information security has been defined for many decades already, as
confidentiality, integrity, and availability. In the old days
sometimes they called this destruction, modification, and disclosure.
These three concepts are important, whether or not we're
dealing with our own IT infrastructure or dealing with a
cloud‑based infrastructure.
The idea of confidentiality is the protection of
information from unauthorized disclosure.
This includes protection of intellectual property, maybe our research,
for example; personally identifiable information, PII, or just personal
information; and things like protected health information, PHI, and other
types of sensitive business data.
In a relationship with the cloud, this becomes more complex because we have a
dependency on the cloud service provider to ensure the confidentiality and
protection of our data. Integrity is known as the protection of information
from unauthorized modification, but also, and sometimes forgotten, integrity
is also integrity of process, assurance of correct processing, storage, and
use of information.
The cloud introduces more layers into the systems model.
That means we have more attack surfaces.
We now have the whole infrastructure,
the APIs, and of course, therefore, more potential points of compromise as well.
The idea of availability is to ensure that our systems and our data can be
accessed when necessary, they're accessible when required.
This is often known as criticality. Since we often look at
confidentiality and integrity using the term sensitivity,
we use criticality to reference this idea of availability.
Since the cloud represents a dependency for the consumer,
in order for their business to run,
they may really require these cloud services to be available, so
therefore this becomes a critical concern.
The Key Points Review. For many years,
we've used CIA as a way to define what information security is.
It describes information security in terms that everybody
can relate to, and these core concepts of CIA should be used
in relation to all information,
but also in relation to the information systems, such as the cloud.