- [Announcer] So as you know,
many organizations are either moving to the cloud
or they already have moved.
Most of the applications to the cloud
or they may be deploying a hybrid solution, right.
To host their applications.
Now, organizations moving to the cloud
are almost always looking into transition from CapEx
or capital expenditure to operational expenditure.
What we actually call OpEx.
So most Fortune 500 nowadays are operating
in a multi-cloud environment.
So it is obvious that cloud computing security
is more important than ever
and is top of mind for many individuals, right.
This dilemma includes
not only protecting critical infrastructure from data theft
and exfiltration, but also privacy,
which is another dilemma that we have nowadays.
Now, the National Institute of Standards and Technology,
so otherwise known as NIST,
they authored a special publication 800-145,
which is the NIST definition of cloud computing.
I strongly suggest for you to become familiar with,
but I'm actually gonna highlight a few
of these definitions here for you, right.
Now, first things first,
let's actually look at the cloud deployment models.
You have public cloud, private clouds, community cloud
and hybrid cloud.
Public cloud is actually the ones
that you are fairly familiar with such as,
Amazon AWS, Google Cloud Platform, Microsoft Azure,
Digital Ocean, and many others.
Then you also have private cloud,
which is used by the organization itself on an on-premise
or at a dedicated area in a cloud provider.
Then you also have community cloud,
and community cloud is shared between several organizations.
And then lastly, you have hybrid cloud,
and that's actually composed of two or more cloud services,
including on-premise services and public cloud providers.
Now cloud computing can be broken down
into three basic models.
First, you have infrastructure as a service,
which is basically whenever you rent the infrastructure
of some provider, think about model similar
to a utility company because you actually pay
for what you actually use.
And examples of these are Amazon AWS, Microsoft Azure,
Google Cloud Platform, and some others.
Then you also have platform as a service or PaaS,
and basically PaaS provides everything
except the applications.
The services provided by this model include all phases
of the system development life cycle,
and can use application program interfaces or APIs
and web portals and gateway software to be able to,
of course bring or provide you the services necessary
for you to create your own application.
And then you have software as a service,
and basically software as a service or SaaS
is designed to provide a complete package solution,
so the software itself and the whole solution
is rented out to the user.
So for example, a very popular software as a service
is Webex, right.
So a collaboration service
and not only you can actually communicate
via conference call,
but also you have Webex Teams,
so you can actually communicate and keep in touch
with your coworkers and increased productivity.
Another one is of course, email
in many different forms like, Microsoft Office 365,
and a Google G Suite, and many others.
So another NIST special publication
that is called the cloud computing reference architecture
is available for you or another resource
for you to learn more about cloud architectures.
And that is special publication, 500-292.
Now there are many potential threats
when organizations actually move to a cloud model,
regardless of the model.
For example, even though your data is in the cloud.
It must recite on a physical location somewhere.
Your cloud providers should agree in writing
to provide the level of security require
for your customers, right.
And for your organization.
Now, the following a few questions to ask a cloud provider
before even thinking about using their services.
Like for example, who has access to your data,
access to key critical data
and not only your organization's data,
but the data of your customers perhaps.
Now, what are your regulatory requirements?
Depending on where you reside,
whether it's in the United States, Canada, Europe,
and some other locations,
you may have regulatory requirements
that they must abide by.
And an examples of these
are the EU or U.S. Privacy Shield Framework, ITIL, COBIT,
ISO standards like, the 27002 standard and many others.
Now, another question that you must ask
is do you have the right to audit?
In other words, can you even do an assessment,
a security posture assessment
of the underlying infrastructure or the applications
and so on, right.
So can you do pen testing for example?
Now, what other type of training does this provider offer
to its employee, right.
What are the type of direct classifications
that this provider use?
How your data is separated from one user to another one
is encryption being used not only in transit,
but also addressed, right.
So all these are questions that you must ask
and you take in consideration between your cloud provider
and new the consumer.
Now because cloud-based services
are accessible via the internet.
They're open to a number of attacks, right.
Some of the potential attack vectors that criminals
and threat actors may attempt include session hijacking,
which is whenever the attacker can actually sniff
or intercept traffic to take over a legitimate connection
to a cloud service or a DNS based attack
or cross-site scripting, SQL injection, session riding,
and many other application-based vulnerabilities.
You also have the dilemma
of distributed announced service attacks
or man-in-the-middle cryptographic attacks.
Also side-channel attacks
on where the attacker could attempt
to compromise the cloud service
by placing malicious virtual machines in close proximity
to a target application
or to a target cloud server and so on.
And then launching a side-channel attack.
Another one is actually authentication attacks
and authorization bypass attacks.
And often APIs are configured insecurely,
so an attacker can take advantage of API misconfigurations.
To modify, delete, or append data
in applications or systems in cloud environments.
Now, regardless of the model use cloud security
is the responsibility of both the client
and the cloud providers.
So these details will need to be worked out
before the cloud computing contract
or whatever agreement that you have
is actually signed and agree upon those entities.