Q56.
Enlist the key mechanisms for securing data
Encryption: This is used to protect data both in transit and at rest. Advanced approaches use multiple
encryption keys and separate encryption zones (Trusted vs. Untrusted) to ensure that even if one key is
compromised, the data in cloud storage remains inaccessible.
Access Control: This mechanism controls who can access data and what operations they can perform.
Key strategies include:
o Role-Based Access Control (RBAC): Limiting access based on specific job roles.
o Least Privilege Access (LPA): Restricting permissions to only what is strictly necessary for a
task.
Authentication: This involves verifying user identity to ensure only legitimate users access resources.
Common methods include Multi-Factor Authentication (MFA), Single Sign-On (SSO), and biometric
authentication.
Authorization: Once identity is verified, authorization determines what an authenticated user is
permitted to do. It often employs Policy-Based Access Controls (PBAC) and Just-In-Time (JIT)
Access, which grants temporary rather than permanent permissions.
Auditing: This mechanism tracks who accessed data, when they accessed it, and what changes were
made. It utilizes audit logs and Security Information and Event Management (SIEM) systems to
detect suspicious activities and trigger automated alerts.
Brokered Access Model: This model enhances security by placing intermediaries (a proxy and a
broker) between the client and the cloud storage. This prevents clients from directly accessing the data
storage system, thereby reducing the risk of unauthorized actions and data exposure
Q58. Explain cloud security? How to secure the cloud? How to get Data secured?Cloud security involves a
set of strategies and technologies designed to protect data, applications, and infrastructure in cloud environments.
It is built upon a security boundary where responsibility is shared between the service provider and the customer,
depending on the chosen service model (IaaS, PaaS, or SaaS).
The Cloud Security Alliance (CSA) further defines cloud security through various operational domains,
including Governance, Risk Management, Compliance, and Information Lifecycle Management.
How to Secure the Cloud
Securing a cloud deployment requires a systematic evaluation of risks and a mapping of security needs to the
specific environment:
Risk Analysis:
Organisations must determine which resources are moving to the cloud, evaluate their sensitivity to risk (such as
loss of privacy or data), and assess the risks associated with different cloud types, such as public, private, or
hybrid.
Security Mapping:
It is essential to match security needs to the chosen cloud model. This involves identifying required security
features, comparing them with the provider’s offerings, and determining which security tasks the customer must
handle versus what the provider manages.
Infrastructure Management:
Security varies by infrastructure ownership and location.
In Public Clouds, the vendor manages the infrastructure, which is often considered "untrusted" because
customers have less control.
In contrast, Private Clouds may be fully "trusted" if the customer owns and secures the infrastructure.
Compliance and Accountability:
Organisations must ensure their cloud deployment meets regulatory and legal standards.
Even when tasks are outsourced, the organisation must ensure the provider remains responsible through clearly
defined Service Level Agreements (SLAs).
Addressing Multi-Tenancy:
In shared environments, providers must ensure isolation of customers and data segmentation so that one
customer's data does not leak into another's environment.