- [Presenter] The National Institute of Standards
and Technology, or NIST created
a special publication 800-145,
which is called the NIST Definition of Cloud Computing,
and it provides a standard set of definitions
for the different aspects of cloud computing.
The first thing that I want to actually go over is
the different cloud deployment models,
and that includes public cloud for, open for public use,
things like Google Cloud, Azure from Microsoft,
DigitalOcean the Google Cloud platform, and many others.
You also have private cloud, which is actually used
just by the client organization, either on premise
or on-prem, or at a dedicated area in a cloud provider.
You also have community cloud that is actually
an environment that is shared
between several organizations, and thus the word community.
Then you also have the hybrid cloud,
which is composed of two or more cloud services
including on-prem services as well.
Now, cloud computing can be broken down
into three basic models, infrastructure as a service,
and that's basically a solution
where you're renting the infrastructure.
You purchase the virtual power to actually execute
your software as needed, and you can put your VMs,
or containers in an environment,
and this model is actually similar to a utility company,
because basically, you pay for what you actually use.
Examples of those are again, Amazon AWS,
and also Azure, and Google Lab platform, and many others.
Now, platform as a service basically provides
everything except application.
So the services provided by this model includes all phases
of the system development life cycle,
and can use application programmable interfaces, or APIs.
You also have the ability to use web portals
or gateway software, and then basically,
you just dedicate yourself on creating your application
on top of this system platform,
those that name platform as a service.
Now, these solutions tend to be preparatory,
which can actually cause problems if the customer moves away
from the provider's platform.
So in many cases, actually,
several customers would like to have just their containers
or their VMs actually instantiated
in an infrastructure as a service.
But one of the main benefits of platform as a service is
that you don't have to worry about all that overhead,
and dedicate even people to take care of the infrastructure.
You just dedicate it in there to develop your application.
And the other one is the software as a service or SaaS,
and SaaS is designed to provide a complete package solution.
Take a look, for example, Cisco Webex
on where you actually pay for a service,
where you can actually host your conference calls,
and medical collaboration features that it has,
but you don't have to take care
of the underlying infrastructure or the application.
You know, basically you're using the application directly
from the provider, in this case, Cisco.
Another example is the Office 365 from Microsoft,
or Google Drive, and Google Docs is another example
of a software as a service.
Now NIST also has another special publication
which is the 500-292,
and is the NIST Cloud Computing Reference Architecture,
and is another great resource to learn more
about the cloud architecture as well.
Cloud service providers like Azure, and AWS,
and Google Lab platform have no choice
but take their security
and compliant responsibilities very seriously.
For example, Amazon created a share responsibility model
that is actually used to describe
what are the responsibilities of the AWS customers
and Amazon responsibilities in detail,
and you can access the Amazon share responsibility model
from the link that I'm highlighting in the screen.
Now, the shared responsibility depends on the type
of cloud model whether you actually have software
as a service, platform as a service,
or infrastructure as a service.
So starting with software as a service,
the customer responsibility is basically people and data,
and then the cloud service provider responsibility includes
from the physical network all the way to the application.
Now here, I'm showing the responsibility
of a platform as a service environment
on where the customer responsibility
or the consumer responsibility is people, data,
and applications is basically you're developing applications
on top of their infrastructure and their platform.
And then the cloud provider responsibility includes
from the physical network all the way
to the actual run time, including things like middleware,
the operating system, virtual network, hypervisor,
the actual servers, and the overall infrastructure.
And then finally, I'm showing the infrastructure
as a service responsibility model
on where now you are running virtual networks,
and VMs, and containers, and basically,
the cloud service provider responsibility is the hypervisor,
the servers, the storage,
the physical and underlying network.
And then the customer responsibility includes
from people, data, applications, the run time,
the middleware, operating systems, the virtual networks,
and the virtual appliances that are running
in those environments.
Patch management in the cloud is also
a shared responsibility in infrastructure as a service
and platform as a service environment.
In SaaS environments,
or the software as a service environments,
basically, the cloud service provider is the one responsible
for patching all software and all hardware vulnerabilities.
However, in infrastructure as a service environment,
the cloud service provider is responsible
for only patching the hypervisors
and also the physical compute and storage servers,
including physical network, and so on.
You are the one responsible for patching the applications,
the VMs, and the operating systems running on top
of those VMs, and of course, your containers as well.
And if you deployed any virtual networks,
you also are liable for patching and making sure
that those virtual networks are deployed in a secure manner.
Whenever you perform penetration testing in the cloud,
you must understand what you can
and you cannot do in that cloud environment.
Most of the cloud service providers that are mature,
the biggest one out there have detailed guidelines
on how to perform security assessments
and penetration testing in the cloud.
Now, regardless, there are many potential threats
when organizations move to a cloud model.
For instance, although your data is actually in the cloud,
it actually has to reside somewhere
in a physical location somewhere.
So your cloud provider should agree
in writing to provide the level
of security required for your customers,
and for your organization.
Now, these are a few questions that most people
in the industry ask cloud providers
before they actually sign their contract
and they contract them for their services.
First one is actually, who has access to the data?
Access control is a key concern,
because even insider attacks are actually a huge risk
nowadays, even in the cloud environment.
The other thing is that what are
the provider's regulatory requirement?
And especially organizations operating
in different geographical locations
like the US, Canada, European Union, and Asia must abide
by different regulatory requirements
that may be specific for those areas.
The other question is, do you have the right to audit?
What type of training does the provider offer
to the employee?
What type of data classification system does
the provider use?
You know, how's your data separated from other users' data?
And is the data on a shared server or a dedicated server
that they actually may have?
And of course, if there's a dedicated server,
or a dedicated system, they may actually charge extra,
but those are actually some requirements
that you must explore before you actually sign a contract.
Now, is encryption being used?
Not only encryption during transit,
but also is data encrypted at rest in the cloud?
And also what are the crypto algorithms and implementations
that the cloud provider uses?
Who maintains control of the encryption key?
Is it gonna be your company,
or is it gonna be the cloud provider?
Also, what are the service level agreements or SLA,
different terms that you must abide,
and the cloud provider also should agree and guarantee
the service between them and you as a consumer?
Also, will they assume liability in the case of a breach?
What is the disaster recovery
and business continuity plan
that the cloud provider actually has?
So all those are different questions that you must ask
whenever, not only for performing security assessment,
but overall, how they actually perform
a security assessment in their infrastructure as well.