1
00:00:06,820 --> 00:00:07,653
- [Announcer] So as you know,

2
00:00:07,653 --> 00:00:09,830
many organizations are
either moving to the cloud

3
00:00:09,830 --> 00:00:11,610
or they already have moved.

4
00:00:11,610 --> 00:00:13,780
Most of the applications to the cloud

5
00:00:13,780 --> 00:00:17,290
or they may be deploying
a hybrid solution, right.

6
00:00:17,290 --> 00:00:19,250
To host their applications.

7
00:00:19,250 --> 00:00:21,060
Now, organizations moving to the cloud

8
00:00:21,060 --> 00:00:25,050
are almost always looking
into transition from CapEx

9
00:00:25,050 --> 00:00:29,520
or capital expenditure to
operational expenditure.

10
00:00:29,520 --> 00:00:31,070
What we actually call OpEx.

11
00:00:31,070 --> 00:00:35,290
So most Fortune 500 nowadays are operating

12
00:00:35,290 --> 00:00:37,520
in a multi-cloud environment.

13
00:00:37,520 --> 00:00:40,440
So it is obvious that
cloud computing security

14
00:00:40,440 --> 00:00:41,960
is more important than ever

15
00:00:41,960 --> 00:00:45,800
and is top of mind for
many individuals, right.

16
00:00:45,800 --> 00:00:47,410
This dilemma includes

17
00:00:47,410 --> 00:00:51,120
not only protecting critical
infrastructure from data theft

18
00:00:51,120 --> 00:00:54,380
and exfiltration, but also privacy,

19
00:00:54,380 --> 00:00:58,150
which is another dilemma
that we have nowadays.

20
00:00:58,150 --> 00:01:01,800
Now, the National Institute
of Standards and Technology,

21
00:01:01,800 --> 00:01:03,360
so otherwise known as NIST,

22
00:01:03,360 --> 00:01:07,960
they authored a special
publication 800-145,

23
00:01:07,960 --> 00:01:10,690
which is the NIST definition
of cloud computing.

24
00:01:10,690 --> 00:01:13,330
I strongly suggest for you
to become familiar with,

25
00:01:13,330 --> 00:01:15,900
but I'm actually gonna highlight a few

26
00:01:15,900 --> 00:01:19,250
of these definitions here for you, right.

27
00:01:19,250 --> 00:01:20,350
Now, first things first,

28
00:01:20,350 --> 00:01:23,260
let's actually look at the
cloud deployment models.

29
00:01:23,260 --> 00:01:26,260
You have public cloud, private
clouds, community cloud

30
00:01:26,260 --> 00:01:27,240
and hybrid cloud.

31
00:01:27,240 --> 00:01:29,190
Public cloud is actually the ones

32
00:01:29,190 --> 00:01:32,400
that you are fairly familiar with such as,

33
00:01:32,400 --> 00:01:36,343
Amazon AWS, Google Cloud
Platform, Microsoft Azure,

34
00:01:37,200 --> 00:01:39,350
Digital Ocean, and many others.

35
00:01:39,350 --> 00:01:41,130
Then you also have private cloud,

36
00:01:41,130 --> 00:01:46,130
which is used by the organization
itself on an on-premise

37
00:01:46,200 --> 00:01:50,210
or at a dedicated area
in a cloud provider.

38
00:01:50,210 --> 00:01:51,830
Then you also have community cloud,

39
00:01:51,830 --> 00:01:56,370
and community cloud is shared
between several organizations.

40
00:01:56,370 --> 00:01:59,200
And then lastly, you have hybrid cloud,

41
00:01:59,200 --> 00:02:03,620
and that's actually composed
of two or more cloud services,

42
00:02:03,620 --> 00:02:07,163
including on-premise services
and public cloud providers.

43
00:02:08,050 --> 00:02:10,740
Now cloud computing can be broken down

44
00:02:10,740 --> 00:02:13,410
into three basic models.

45
00:02:13,410 --> 00:02:16,240
First, you have
infrastructure as a service,

46
00:02:16,240 --> 00:02:19,840
which is basically whenever
you rent the infrastructure

47
00:02:19,840 --> 00:02:23,780
of some provider, think
about model similar

48
00:02:23,780 --> 00:02:26,380
to a utility company
because you actually pay

49
00:02:26,380 --> 00:02:27,810
for what you actually use.

50
00:02:27,810 --> 00:02:32,810
And examples of these are
Amazon AWS, Microsoft Azure,

51
00:02:33,180 --> 00:02:36,350
Google Cloud Platform, and some others.

52
00:02:36,350 --> 00:02:40,370
Then you also have platform
as a service or PaaS,

53
00:02:40,370 --> 00:02:43,020
and basically PaaS provides everything

54
00:02:43,020 --> 00:02:44,780
except the applications.

55
00:02:44,780 --> 00:02:48,330
The services provided by
this model include all phases

56
00:02:48,330 --> 00:02:50,910
of the system development life cycle,

57
00:02:50,910 --> 00:02:54,850
and can use application
program interfaces or APIs

58
00:02:54,850 --> 00:02:59,610
and web portals and gateway
software to be able to,

59
00:02:59,610 --> 00:03:02,580
of course bring or provide
you the services necessary

60
00:03:02,580 --> 00:03:05,190
for you to create your own application.

61
00:03:05,190 --> 00:03:08,030
And then you have software as a service,

62
00:03:08,030 --> 00:03:11,200
and basically software
as a service or SaaS

63
00:03:11,200 --> 00:03:15,390
is designed to provide a
complete package solution,

64
00:03:15,390 --> 00:03:17,690
so the software itself
and the whole solution

65
00:03:17,690 --> 00:03:19,430
is rented out to the user.

66
00:03:19,430 --> 00:03:24,150
So for example, a very
popular software as a service

67
00:03:25,190 --> 00:03:26,310
is Webex, right.

68
00:03:26,310 --> 00:03:28,920
So a collaboration service

69
00:03:28,920 --> 00:03:31,090
and not only you can actually communicate

70
00:03:31,090 --> 00:03:32,330
via conference call,

71
00:03:32,330 --> 00:03:33,710
but also you have Webex Teams,

72
00:03:33,710 --> 00:03:36,270
so you can actually
communicate and keep in touch

73
00:03:36,270 --> 00:03:40,520
with your coworkers and
increased productivity.

74
00:03:40,520 --> 00:03:42,220
Another one is of course, email

75
00:03:42,220 --> 00:03:46,830
in many different forms
like, Microsoft Office 365,

76
00:03:46,830 --> 00:03:50,690
and a Google G Suite, and many others.

77
00:03:50,690 --> 00:03:53,930
So another NIST special publication

78
00:03:53,930 --> 00:03:57,320
that is called the cloud
computing reference architecture

79
00:03:57,320 --> 00:03:59,840
is available for you or another resource

80
00:03:59,840 --> 00:04:02,880
for you to learn more
about cloud architectures.

81
00:04:02,880 --> 00:04:07,880
And that is special publication, 500-292.

82
00:04:08,240 --> 00:04:11,150
Now there are many potential threats

83
00:04:11,150 --> 00:04:13,780
when organizations actually
move to a cloud model,

84
00:04:13,780 --> 00:04:15,340
regardless of the model.

85
00:04:15,340 --> 00:04:18,420
For example, even though
your data is in the cloud.

86
00:04:18,420 --> 00:04:22,090
It must recite on a
physical location somewhere.

87
00:04:22,090 --> 00:04:25,710
Your cloud providers
should agree in writing

88
00:04:25,710 --> 00:04:28,520
to provide the level of security require

89
00:04:28,520 --> 00:04:30,390
for your customers, right.

90
00:04:30,390 --> 00:04:32,630
And for your organization.

91
00:04:32,630 --> 00:04:36,570
Now, the following a few
questions to ask a cloud provider

92
00:04:36,570 --> 00:04:39,910
before even thinking about
using their services.

93
00:04:39,910 --> 00:04:43,020
Like for example, who
has access to your data,

94
00:04:43,020 --> 00:04:45,490
access to key critical data

95
00:04:45,490 --> 00:04:48,560
and not only your organization's data,

96
00:04:48,560 --> 00:04:51,630
but the data of your customers perhaps.

97
00:04:51,630 --> 00:04:54,200
Now, what are your
regulatory requirements?

98
00:04:54,200 --> 00:04:55,520
Depending on where you reside,

99
00:04:55,520 --> 00:04:58,450
whether it's in the United
States, Canada, Europe,

100
00:04:58,450 --> 00:04:59,470
and some other locations,

101
00:04:59,470 --> 00:05:02,590
you may have regulatory requirements

102
00:05:02,590 --> 00:05:05,080
that they must abide by.

103
00:05:05,080 --> 00:05:06,350
And an examples of these

104
00:05:06,350 --> 00:05:11,350
are the EU or U.S. Privacy
Shield Framework, ITIL, COBIT,

105
00:05:12,260 --> 00:05:17,260
ISO standards like, the 27002
standard and many others.

106
00:05:17,690 --> 00:05:20,100
Now, another question that you must ask

107
00:05:20,100 --> 00:05:23,260
is do you have the right to audit?

108
00:05:23,260 --> 00:05:25,710
In other words, can you
even do an assessment,

109
00:05:25,710 --> 00:05:27,680
a security posture assessment

110
00:05:27,680 --> 00:05:31,260
of the underlying infrastructure
or the applications

111
00:05:31,260 --> 00:05:32,100
and so on, right.

112
00:05:32,100 --> 00:05:34,840
So can you do pen testing for example?

113
00:05:34,840 --> 00:05:38,050
Now, what other type of training
does this provider offer

114
00:05:38,050 --> 00:05:39,150
to its employee, right.

115
00:05:39,150 --> 00:05:41,680
What are the type of
direct classifications

116
00:05:41,680 --> 00:05:43,070
that this provider use?

117
00:05:43,070 --> 00:05:47,220
How your data is separated
from one user to another one

118
00:05:47,220 --> 00:05:49,780
is encryption being used
not only in transit,

119
00:05:49,780 --> 00:05:51,610
but also addressed, right.

120
00:05:51,610 --> 00:05:54,920
So all these are questions
that you must ask

121
00:05:54,920 --> 00:05:58,570
and you take in consideration
between your cloud provider

122
00:05:58,570 --> 00:05:59,763
and new the consumer.

123
00:06:00,750 --> 00:06:02,520
Now because cloud-based services

124
00:06:02,520 --> 00:06:04,300
are accessible via the internet.

125
00:06:04,300 --> 00:06:07,580
They're open to a number
of attacks, right.

126
00:06:07,580 --> 00:06:11,000
Some of the potential attack
vectors that criminals

127
00:06:11,000 --> 00:06:15,400
and threat actors may attempt
include session hijacking,

128
00:06:15,400 --> 00:06:18,580
which is whenever the
attacker can actually sniff

129
00:06:18,580 --> 00:06:22,020
or intercept traffic to take
over a legitimate connection

130
00:06:22,020 --> 00:06:25,330
to a cloud service or a DNS based attack

131
00:06:25,330 --> 00:06:29,740
or cross-site scripting, SQL
injection, session riding,

132
00:06:29,740 --> 00:06:33,630
and many other application-based
vulnerabilities.

133
00:06:33,630 --> 00:06:35,380
You also have the dilemma

134
00:06:35,380 --> 00:06:37,280
of distributed announced service attacks

135
00:06:37,280 --> 00:06:39,700
or man-in-the-middle
cryptographic attacks.

136
00:06:39,700 --> 00:06:41,060
Also side-channel attacks

137
00:06:41,060 --> 00:06:42,440
on where the attacker could attempt

138
00:06:42,440 --> 00:06:45,550
to compromise the cloud service

139
00:06:45,550 --> 00:06:49,770
by placing malicious virtual
machines in close proximity

140
00:06:49,770 --> 00:06:50,770
to a target application

141
00:06:50,770 --> 00:06:53,500
or to a target cloud server and so on.

142
00:06:53,500 --> 00:06:56,260
And then launching a side-channel attack.

143
00:06:56,260 --> 00:06:58,170
Another one is actually
authentication attacks

144
00:06:58,170 --> 00:07:00,450
and authorization bypass attacks.

145
00:07:00,450 --> 00:07:04,160
And often APIs are configured insecurely,

146
00:07:04,160 --> 00:07:08,100
so an attacker can take advantage
of API misconfigurations.

147
00:07:08,100 --> 00:07:12,040
To modify, delete, or append data

148
00:07:12,040 --> 00:07:15,720
in applications or systems
in cloud environments.

149
00:07:15,720 --> 00:07:18,620
Now, regardless of the
model use cloud security

150
00:07:18,620 --> 00:07:21,760
is the responsibility of both the client

151
00:07:21,760 --> 00:07:23,430
and the cloud providers.

152
00:07:23,430 --> 00:07:26,460
So these details will
need to be worked out

153
00:07:26,460 --> 00:07:28,910
before the cloud computing contract

154
00:07:28,910 --> 00:07:31,540
or whatever agreement that you have

155
00:07:31,540 --> 00:07:35,683
is actually signed and
agree upon those entities.