CLOUD COMPUTING SECURITY
Comprehensive Study Notes – Security in Cloud Environments
Anna University | B.E / [Link] Computer Science Engineering
1. Introduction to Cloud Security
Cloud security refers to a broad set of policies, technologies, controls, and services
that protect cloud computing infrastructure, data, and applications. As businesses
increasingly move operations to the cloud, security becomes a top concern due to
the shared and distributed nature of cloud environments.
1.1 Shared Responsibility Model
Cloud security operates on a shared responsibility model — the provider secures the
underlying infrastructure, while the customer is responsible for securing what they
put in the cloud.
• IaaS: Provider secures hardware, networking, and hypervisor. Customer
secures OS, applications, and data.
• PaaS: Provider additionally secures runtime and middleware. Customer
secures application code and data.
• SaaS: Provider manages nearly everything. Customer is responsible for user
access management and data governance.
1.2 Security Threats in Cloud
• Data Breaches: Unauthorized access to sensitive or confidential data stored
in the cloud.
• Insider Threats: Malicious or negligent actions by employees or contractors
with access to cloud resources.
• Account Hijacking: Attackers steal credentials to gain unauthorized access to
cloud accounts.
• DDoS Attacks: Distributed Denial of Service attacks flood cloud resources to
make services unavailable.
• Misconfiguration: Improperly configured cloud services (e.g., publicly
accessible S3 buckets) are a leading cause of breaches.
• Insecure APIs: Vulnerable application programming interfaces can expose
cloud resources to attackers.
2. Data Security in the Cloud
Protecting data is the most critical aspect of cloud security. Data must be secured at
rest, in transit, and during processing.
2.1 Encryption
• Encryption at Rest: Data is encrypted when stored on disk. Common
algorithms include AES-256. Cloud providers offer native encryption features
(e.g., AWS KMS, Azure Key Vault).
• Encryption in Transit: Data is encrypted as it moves across networks using
protocols such as TLS (Transport Layer Security) and HTTPS.
• End-to-End Encryption: Data is encrypted from source to destination and
cannot be decrypted by intermediaries, including the cloud provider.
2.2 Data Classification
Data classification categorizes data based on its sensitivity so that appropriate
security controls can be applied.
• Public Data: No access restrictions required (e.g., marketing content).
• Internal Data: Restricted to employees (e.g., internal memos).
• Confidential Data: Sensitive business information (e.g., financial records, IP).
• Regulated Data: Data subject to legal compliance requirements (e.g., PII,
healthcare records under HIPAA, payment data under PCI DSS).
2.3 Data Loss Prevention (DLP)
DLP tools monitor and control data transfers to prevent sensitive data from leaving
the organization without authorization. They can scan files, emails, and cloud
storage for patterns such as credit card numbers or health record identifiers.
3. Identity and Access Management (IAM)
IAM is the framework of policies and technologies that ensures the right individuals
have access to the right resources at the right times for the right reasons.
3.1 Core IAM Concepts
• Authentication: Verifying the identity of a user or system (e.g., passwords,
multi-factor authentication).
• Authorization: Determining what resources an authenticated user is permitted
to access.
• Multi-Factor Authentication (MFA): Requires two or more verification factors
— something you know, something you have, and something you are.
• Single Sign-On (SSO): Allows users to authenticate once and gain access to
multiple services without re-entering credentials.
• Principle of Least Privilege: Users and systems are granted only the minimum
permissions needed to perform their tasks.
3.2 Access Control Models
• Role-Based Access Control (RBAC): Access rights are assigned based on the
user's role within the organization.
• Attribute-Based Access Control (ABAC): Access is granted based on a
combination of attributes such as user department, data classification, and
time of day.
• Discretionary Access Control (DAC): Resource owners decide who can
access their resources.
• Mandatory Access Control (MAC): Access is controlled by a central authority
based on classification labels.
4. Network Security in Cloud
Network security in cloud environments involves protecting cloud-based networks
from unauthorized access, attacks, and misuse using a combination of tools and
configurations.
4.1 Virtual Private Cloud (VPC)
A Virtual Private Cloud is an isolated section of a public cloud where customers can
launch resources in a logically separated network. VPCs allow organizations to
define their own IP address ranges, create subnets, and configure routing and
security settings.
4.2 Firewalls and Security Groups
• Network Firewalls: Filter incoming and outgoing traffic based on predefined
rules at the network boundary.
• Security Groups: Virtual firewalls applied at the instance level that control
inbound and outbound traffic for cloud virtual machines.
• Web Application Firewall (WAF): Protects web applications by filtering and
monitoring HTTP traffic between the application and the internet.
4.3 VPN and Zero Trust
• VPN (Virtual Private Network): Creates an encrypted tunnel between a user's
device and the cloud environment, ensuring secure remote access.
• Zero Trust Architecture: Operates on the principle of 'never trust, always
verify' — every user and device must be authenticated and authorized
regardless of their location, even inside the network perimeter.
5. Compliance and Governance
Cloud compliance involves ensuring that cloud services and data handling practices
conform to applicable laws, regulations, standards, and internal policies.
5.1 Key Compliance Standards
• ISO/IEC 27001: International standard for information security management
systems (ISMS).
• SOC 2: Auditing standard for cloud service providers covering security,
availability, processing integrity, confidentiality, and privacy.
• GDPR (General Data Protection Regulation): EU regulation governing the
collection, storage, and processing of personal data of EU citizens.
• HIPAA: U.S. regulation protecting the privacy and security of health
information.
• PCI DSS: Payment Card Industry Data Security Standard for organizations
that handle credit card transactions.
5.2 Cloud Governance
• Policy Management: Defining and enforcing security policies across all cloud
resources.
• Audit Logging: Maintaining detailed logs of all user and system activities for
accountability and forensic analysis.
• Risk Management: Continuously identifying, assessing, and mitigating
security risks.
Two Marks Questions and Answers
Q1. What is the Shared Responsibility Model in cloud security?
The Shared Responsibility Model defines the division of security responsibilities
between the cloud provider and the customer. The provider secures the underlying
infrastructure while the customer is responsible for securing their data, applications,
and access controls.
Q2. Define encryption at rest and encryption in transit.
Encryption at rest protects data stored on disks using algorithms such as AES-256.
Encryption in transit protects data as it travels across networks using protocols such
as TLS/HTTPS.
Q3. What is Multi-Factor Authentication (MFA)?
MFA is a security mechanism that requires users to verify their identity using two or
more independent factors: something they know (password), something they have
(OTP device), and something they are (biometric).
Q4. What is Zero Trust Security?
Zero Trust is a security model based on the principle of 'never trust, always verify.'
Every user, device, and service must be authenticated and authorized before being
granted access, regardless of their network location.
Q5. What is RBAC?
Role-Based Access Control (RBAC) is an access control model where permissions
are assigned to roles rather than individual users. Users are then assigned roles that
grant them the appropriate level of access.
Q6. What is a Virtual Private Cloud (VPC)?
A VPC is an isolated, logically separated network within a public cloud where an
organization can deploy resources with full control over IP addressing, subnets,
routing, and security configurations.
Cloud Computing Security | Study Notes | Anna University | Prepared for Academic Use