Chapter-5
Security in Cloud Computing
Faundamentals of Cloud Security.
• Control user access: a huge challenge for enterprises has been controlling
who has access to their cloud services. Too often, organizations accidently
publically expose their cloud storage service despite warnings from cloud
providers to avoid allowing storage drive contents to be accessible to anyone
with an internet connection. CSO advises that only load balancers and bastion
hosts should be exposed to the internet. Further, do not allow Secure Shell
(SSH) connections directly from the internet as this will allow anyone who
finds the server location to bypass the firewall and directly access the data.
• Data protection – data stored on cloud infrastructures should never be
unencrypted. Therefore, maintain control of encryption keys where possible.
Even though you can hand the keys over to cloud service providers, it is still
your responsibility to protect your data.
• Secure credentials – AWS access keys can be exposed on public
websites, source code repositories, unprotected Kubernetes
dashboards, and other such platforms. Therefore, you should create and
regularly rotate keys for each external service while also restricting
access on the basis of IAM roles. Never use root user accounts – these
accounts should only be used for specific account and service
management tasks. Further, disable any user accounts that aren’t being
used to further limit potential paths that hackers can compromise.
• Increase visibility – to see issues like unauthorized access attempts,
turn on security logging and monitoring once your cloud has been set
up. Major cloud providers supply some level of logging tools that can
be used for change tracking, resource management, security analysis,
and compliance audits.
What are the security risks of cloud computing?
• Malware
• Data Leakage
• Data breaches
• Poor application programming interface (API)
• Malware: By moving large amounts of sensitive data to an internet-
connected cloud environment, organizations are opening themselves up to
additional cyber threats. Malware attacks are a common threat to cloud
security, with studies showing that nearly 90% of organizations are more
likely to experience data breaches as cloud usage increases. As
cybercriminals continue to become increasingly savvy with their attack
delivery methods, organizations must be aware of the evolving threat
landscape.
• Data Leakage: Data leakage is a growing concern for organizations, with
over 60% citing it as their biggest cloud security concern. As previously
mentioned, cloud computing requires organizations to give up some of their
control. This can mean that the security of some of your organization’s critical
data may fall into the hands of someone outside of your IT department. If the
cloud service provider experiences a breach or attack, your organization will not
only lose its data and intellectual property but will also be held responsible for
any resulting damages.
• Data breaches: One of the most impactful security risks the cloud faces is
the potential for a data breach. These are a result of poor security measures
that allow malicious actors to gain access to sensitive data across cloud
servers. One breach could cost an organization millions of dollars,
alongside a blow to an organization’s reputation and the potential for legal
liability.
• Poor API: If the cloud has poor application program interfaces (API), then
servers run the risk of having data unwillingly exposed. When it comes to
API, malicious actors will employ several strategies such as brute force
attacks and denial-of-service attacks in order to weaken the integrity of the
system.
What is Security as a Service (SECaaS)?
• SECaaS offers consumers web security services that protect them against
internet threats and attacks like DDoS that are always seeking ways to breach
websites. Users are more vulnerable to attacks while connecting to the internet
• Working of SECaaS:
When the IT department installs virus protection software, spam filtering
software, and other security tools on every computer, on the network, or on the
server in your geographic location, keeping the package up to date or instructing
them to use it, security solutions are no longer delivered regionally with security
as a service
Security can be availed by the following alliances:
• Encryption: makes the data unreadable until it has been authentically
decoded, or encrypted.
• Network security: Network access management protocols are used to
secure and keep an eye on network services.
• Email security: Protects against email frauds, spam, phishing,
malware etc.
• Identification: Users can access with a valid log-in ID and legal
permission, else forbids if it is not authenticated.
• Data loss prevention: Tools are built to monitor and secure data to
protect from data loss.
Benefits of Security as a Service
• Cost Savings:
One of the biggest benefits of a Security as a Service model is that it
saves a business money.
• The Latest Security Tools and Updates:
When you implement SECaaS, you get to work with the latest security
tools and resources. For anti-virus and other security tools to be
effective, hey must be kept up to date with the latest patches and virus
definitions.
Digital identity and access management
- What is identity and access management (IAM)?
Identity and access management (IAM or IdAM for short) is a way to
tell who a user is and what they are allowed to do. IAM is like the
bouncer at the door of a nightclub with a list of who is allowed in, who
isn't allowed in, and who is able to access the VIP area. IAM is also
called identity management (IdM).
In more technical terms, IAM is a means of managing a given set of
users' digital identities, and the privileges associated with each identity.
It is an umbrella term that covers a number of different products that all
do this same basic function. Within an organization, IAM may be a
single product, or it may be a combination of processes, software
products, cloud services, and hardware that give administrators visibility
and control over the organizational data that individual users can access.
In cloud computing, data is stored remotely and accessed over the
Internet. Because users can connect to the Internet from almost any
location and any device, most cloud services are device- and location-
agnostic. Users no longer need to be in the office or on a company-
owned device to access the cloud. And in fact, remote workforces are
becoming more common.
As a result, identity becomes the most important point of controlling
access, not the network perimeter.* The user's identity, not their device
or location, determines what cloud data they can access and whether
they can have any access at all.
Content Level Security
Content Level Security (CLS) is a feature that controls who has access to
edit or read content.
The need for Content Level Security
-For certain businesses, there is information that should not be shared or
be editable between divisions. There are two key scenarios corresponding
to different levels of access:
-Completely confidential content: Content can be accessed only from
some business units. Other units are not aware that the content exists.
-Safety Reuse: A business unit can share content to other business
units but only in read-only mode.
Understanding security levels
-CLS uses a hierarchy of security levels, ranging from the most-
permissive/open to the most-restrictive/closed. These security levels
determine what users can see.
-The content security levels are (from most-permissive to most-
restrictive):
-Read-write: Content is viewable and editable
-Read-only: Content is viewable, but cannot be edited
-Invisible: Content is not visible
For example, if you have read-only access to a topic, you can view it.
But you cannot edit it. An invisible topic does not appear anywhere for
you.