- So as you know, many organizations are either
moving to the cloud or they already have moved
most of their applications to the cloud.
Or they may be deploying a hybrid solution right,
to host their applications.
Now, organizations moving to the cloud are almost
always looking into transition from CapEx
or capital expenditure to operational expenditure,
what we actually call OpEx.
So most Fortune 500's nowadays are operating
in a multi-cloud environment.
So it is obvious that cloud computing security
is more important than ever,
and is top of mind for many individuals, right.
This dilemma includes not only protecting
critical infrastructure from data theft and exfiltration,
but also privacy,
which is another dilemma that we have nowadays.
Now, the National Institute of Standards and Technology,
so otherwise known as NIST.
They authored a special publication "800-145",
which is the NIST definition of cloud computing.
I strongly suggest for you to become familiar with,
but I'm actually gonna highlight a few of these definitions
here for you, right.
Now, first things first,
let's actually look at the cloud deployment models.
You have public cloud, private clouds, community cloud
and hybrid cloud.
Public cloud is actually the ones
that you are fairly familiar with.
Such as, you know Amazon AWS,
Google Cloud Platform,
Microsoft Azure,
Digital Ocean, and many others.
Then you also have private cloud,
which is used by the organization itself
at an on-premise or at a dedicated area in a cloud provider.
Then you also have community cloud,
and community cloud is shared between several organizations.
And then lastly, you have hybrid cloud
and that's actually composed of two or more cloud services,
including on-premise services and public cloud providers.
Now cloud computing can be broken down
into three basic models.
First, you have infrastructure as a service,
which is basically whenever you rent the infrastructure
of some provider.
Think about model similar to a utility company,
because you actually pay for what you actually use.
And examples of these are Amazon AWS, Microsoft Azure,
Google Cloud Platform, and some others.
Then you also have platform as a service or pass,
and basically pass provides everything
except the applications.
The services provided by this model
include all phases of the system development life cycle,
and can use application programming interfaces or APIs
and web portals and gateway software to be able to,
you know, of course bring or provide you
the services necessary for you
to create your own application.
And then you have software as a service,
and basically software as a service or SaaS is designed
to provide a complete package solution.
So the software itself and the whole solution
is rented out to the user.
So for example, a very popular software as a service,
you know, service is WebEx, right.
So a collaboration service
and not only you can actually communicate
via conference call,
but also you have WebEx teams.
And you can actually communicate and keep in touch
with your coworkers,
and you know, increase productivity.
Another one is of course, email in many different forms
like Microsoft Office 365 and Google G Suite
and many others.
So another NIST special publication that is called
the "Cloud Computing Reference Architecture"
is available for you or another resource
for you to learn more about cloud architectures.
And that is special publication "500-292".
Now, there are many potential threats
when organizations actually move to a cloud model,
regardless of the model.
For example, even though your data is in the cloud,
it must reside on a physical location somewhere.
Your cloud providers should agree in writing
to provide the level of security required
for your customers right,
and for your organization.
Now, the following are a few questions
to ask a cloud provider
before even thinking about using their services.
Like for example, who has access to your data,
access to key critical data
and not only your organization's data
but the data of your customers, perhaps?
Now, what are your regulatory requirements
depending on where you reside,
whether it's in the United States, Canada, Europe
and some other locations,
you may have regulatory requirements
that they must abide by.
And an examples of these are, you know,
like the EU or US Privacy Shield Framework, ITIL, COBIT,
you know, ISO standards like the 27002 standard
and many others.
Now, another question that you must ask is,
do you have the right to audit?
In other words, can you even do an assessment,
a security posture assessment of the underlying
infrastructure or the applications and so on, right?
So, can you do pen testing for example?
Now, what other type of training does this provider
offer to its employee, right?
What are the types of data classifications
that this provider use, you know?
How your data is separated from one user to another one?
Is encryption being used,
not only in transit but also at rest, right?
So, all these are questions that you must ask
when you take in consideration,
between your cloud provider and you, the consumer.
Now, because cloud-based services are accessible
via the internet,
they're open to a number of attacks, right.
Some of the potential attack vectors that criminals
and threat actors may attempt include session hijacking,
which is whenever the attacker can actually sniff
or intercept traffic to take over a legitimate connection
to a cloud service,
or a DNS based attack,
or cross-site scripting,
SQL injection,
session riding,
and many other application based vulnerabilities.
You also have the dilemma of
distributed denial-of-service attacks,
or man-in-the-middle cryptographic attacks.
Also site-channel attacks on where the attacker
could attempt to compromise the cloud service
by placing malicious virtual machines in close proximity
to a target application or to a target cloud server
and so on, and then launching a site channel attack.
Another one is actually authentication attacks
and authorization bypass attacks
and often APIs are configured insecurely.
So an attacker can take advantage
of API misconfigurations to modify, delete,
or append data in applications
or systems in cloud environments.
Now, regardless of the model used,
cloud security is the responsibility
of both the client and the cloud providers.
So, these details will need to be worked out
before the cloud computing contract or whatever, you know
agreement that you have is actually signed
and agree upon, you know, those entities.