When we take a look at security of course,
that's general for most things, but when we take
specifically a look at cloud security,
we have a few other concerns, certainly, we have to pay
attention to. The cloud is a multi‑tenant model.
We have all sorts of different customers that could
be in there, both corporations,
but also just people, and many of them can have different
security even requirements or security practices.
Could I be attacked from one of them?
Could a competitor see my data? So there are things
we do have to consider in this.
In most cases,
cloud service providers do a good job of isolation, but that
probably depends a little bit on the quality of the cloud
service provider we choose as well.
We of course have concerns with jurisdiction.
There can be laws regarding privacy that require data to be kept
within our country or region. There can be problems to deal with
legal issues, if there's a problem,
where will any dispute be heard in the courts of our country or of
another, and those are things we have to consider.
We also have to consider, where are my backups. For example,
maybe my data is being stored in my own country,
but does the cloud service provider back it up to another part
of the world, and is it therefore secure?
We also have to worry about end of life, data destruction,
especially when we look at memory, for example,
that has stored very sensitive data.
We want to make sure that that hardware is properly then cleared so there's
no chance of recovery of my data at the end, as well.
We also have to worry about secure development.
That means that we build security in as part of the actual plan,
the design, but we all know that things can be designed, but
that's not how they're actually built.
There's often a large difference between as‑designed and as‑built.
So are the things that are important for us actually being
implemented and are the security controls, for example,
being operated correctly as well.
We want to ensure that we have security all the way through things
like systems development and software development,
the SDLC. We want to make sure that when different projects are done,
say, for example,
we could use a methodology like DevOps, was security considered in
that? Is it truly DevSecOps, as we sometimes hear? We want to be
sure we're secure at the network level.
We can see that the cloud has many different attack vectors,
more than a traditional type of operation.
We rely on the networks, and to ensure availability of those networks through
things like redundancy. We want to ensure that our data is protected while it's
in transit so that we have encryption, for example,
but also protection against errors or lost data.
Part of this will ensure protection of data from
re‑transmission or maybe some other type of unauthorized
alteration. When we look at network security,
it's important that we review what traffic we have on our
networks to make sure that all of that traffic is, for example,
properly protected and that we're not exceeding the actual
bandwidth limitations that we have.
We very often today hear the term zero‑trust network, and this is
used, of course, in many cases where we talk about zero‑trust that
everything must be protected. And we know the network can be two
things, it can be the target of an attack,
but also it can be the conduit used in an attack.
So, therefore, we have to make sure that not only
is the network secure in itself,
but also we have protection in there to ensure the network is
not a channel that can be used to attack endpoints and our
systems or our customer systems.
Everything must be protected.
In other words, nothing is trusted, truly a zero‑trust network.
The other thing is that we quite often will try to limit
things according to geographic areas.
Maybe we only allow access to our networks or systems from certain
registered or common places, and the idea of course behind that, also,
is where we get into the challenge today of using marketing tools to try
and target our advertising and our outreach to certain areas and people
in their current location.
The virtual level is, of course, another area of an attack,
and virtualization security, whether or not we're talking
about security of containers,
security of the data that we store, even temporarily, and serverless
technology, are areas that are used a lot in the cloud. We have a
lot, for example, of containers that are self‑contained units, but
must be configured to be secure.
We want to make sure that any data we store, even temporarily, was protected.
And of course it's kind of funny to use a term like serverless
technology, because it's not truly serverless, it's just not a
dedicated server for our use.
And the idea, of course, behind this is that we want to have that level of
abstraction that we're not worried about the servers underneath. We're quite
simply just trusting that the cloud service provider is properly storing and
processing our data on the servers they have.
So the question for us is, are these attack points? Are there ways
that a person could get in and disclose our data,
corrupt our data or make systems unavailable as well? Linked into, of
course, virtualization security is the hypervisor itself.
We know that a key component of the cloud is the use of hypervisors.
It is that layer of abstraction between hardware and
our presentation and applications, but it also can be an attack surface.
The hypervisor itself must be secured through things like keeping the
patches up to date and making sure it's correctly configured as well. In
conjunction with all of this are the virtual machines.
These, of course, are the configurations of the systems that we will
then power up and run on the platforms we have, and we've often said
that a virtual machine should be something that is considered an
asset of the organization.
Any time somebody needs to spin up a virtual machine,
they should use a trusted and approved configuration, so therefore, that should
also be included in the configuration management database.
This will ensure that all VMs follow that correct standard configuration.
As we mentioned earlier,
one of the problems with this is the fact that we could have VM
sprawl. Virtual machine sprawl, where we are paying for all kinds of
resources that we're not even using, so this is why we need careful
management of these as well.
This leads to, of course, not only wasted resources, but excessive billing.
The Key Points Review.
Obviously, security is security,
but cloud‑based systems have not only the same security
challenges as a traditional system, but they also bring in some new challenges,
especially since we're dealing with coordination between
different entities that have to work together.