In this section of the course,
we are going to discuss cloud security.
The cloud security section
of the course focuses on Domain 2: Security Architecture,
specifically objective 2.5, which states
that given a scenario, you must be able
to securely implement cloud capabilities
in an enterprise environment.
Securing cloud environments requires a comprehensive
approach that addresses the challenges of implementation,
ongoing management, and seamless integration
between various cloud services
to protect sensitive data and maintain system integrity.
Additionally, security must be prioritized throughout
the development and deployment process
with careful attention to emerging technologies
and best practices.
By embedding strong security measures at every stage,
organizations can build a resilient cloud infrastructure
that effectively supports their needs.
As we go through this section,
we will cover many topics related to cloud security,
including cloud implementation, cloud management,
connectivity and integration, cloud security considerations,
application programming interface security,
Cloud Access Security Broker,
development and deployment, continuous integration,
continuous deployment pipeline, container management,
and serverless computing.
First, we will look at cloud implementation.
Cloud implementation is the process of deploying
and configuring cloud services
with security measures in place to protect data
and ensure compliance.
Cloud implementation concepts include cloud service adoption
and the use of preventive, detective,
and proactive cloud control strategies.
Cloud service adoption involves integrating cloud platforms
and services into an organization's existing infrastructure.
Next cloud control strategies include preventative controls,
which are designed to stop security incidents
before they occur.
Detective controls, which monitor systems
to detect security breaches
and proactive controls,
which anticipate potential security threats and address them
before they appear.
For example, an organization adopting a new cloud service
might implement encryption as a preventative control.
Use real-time monitoring tools to detect unauthorized access
as a detective control
and conduct regular security assessments to identify
and mitigate emerging threats as a proactive control.
Next, we will explore cloud management.
Cloud management is overseeing and securing cloud resources
and services while ensuring that cloud provider
and customer responsibilities are clearly defined
and properly executed.
Cloud management concepts include the shared responsibility
model as well as the management of encryption keys
and licenses, both in cloud
and customer managed environments.
The shared responsibility model outlines the division
of security responsibilities
between the cloud service provider and the customer.
The cloud service provider typically handles
the infrastructure and physical security of the cloud,
and the customer handles the responsibility in the cloud.
This means the customer takes actions
to secure data applications and access controls.
This distinction of responsibilities extends
to cloud managed and customer managed actions,
such as securing encryption keys and monitoring licenses.
In some cases, the cloud provider manages these elements;
while in others the customer does.
Negotiating clear lines of responsibility is critical.
For example, while a cloud provider may secure
the underlying infrastructure, the customer may manage
and safeguard their own encryption keys
and licenses, ensuring that sensitive data remains protected
in the shared cloud environment.
After that, we will look at connectivity and integration.
Connectivity and integration ensures secure
and seamless connections between customer systems
and cloud services.
Connectivity and integration concepts include customer
to cloud connectivity, cloud service integration,
and shadow IT detection.
Customer-to-cloud connectivity refers
to the secure connection established
between a customer's network and the cloud provider.
This connection is crucial for protecting data in transit
and maintaining a trusted communication channel.
Next, cloud service integration involves securely linking
different cloud services and platforms to work together.
This integration ensures that data flows securely
and efficiently across environments without
introducing vulnerabilities.
Finally, shadow IT detection is the process of identifying
and managing unauthorized cloud services
or applications that employees may install
and use without the IT team's knowledge.
Shadow IT can pose significant security risks,
if not properly identified and controlled.
Bringing all of these concepts together,
a company might establish a secure Virtual Private Network
for customer-to-cloud connectivity,
integrate multiple cloud services
through secure Application Programming Interfaces,
and use monitoring tools to detect
and manage any unauthorized cloud services
to identify shadow IT.
Next, we will explore cloud security considerations.
Cloud security considerations involve addressing potential
risks and vulnerabilities to protect data
and resources within cloud environments.
Cloud security considerations include unsecured storage
resources, data exposure, data leakage, and data remnants.
Unsecured storage resources refer to cloud storage
that lacks proper security configurations,
such as encryption or access controls.
Data exposure occurs when sensitive information is
unintentionally made accessible to unauthorized users.
It is often due to misconfigurations
or inadequate security measures.
Data leakage refers to the unauthorized transmission
of data from within the cloud environment
to external parties, which can happen
through insecure channels or compromised accounts.
Data remnants is the residual data
that remains on storage devices after deletion,
which can be maliciously recovered
if not properly sanitized.
Following that, we will look at Application Programming
Interface or API security.
Application Programming Interface Security
protects Application Programming Interfaces
from unauthorized access, misuse, and attacks
to ensure secure interactions
between applications and cloud services.
Application Programming Interface Security concepts
include authorization, rate limiting, and logging.
Authorization ensures that only authenticated users
and applications are granted access
to specific application programming interface endpoints.
Authorization prevents unauthorized actions or data access.
Rate limiting controls the number of application programming
interface requests a user or application
can make within a given time.
Rate Limiting helps denial of service attacks.
Logging involves recording application programming,
interface interactions to monitor usage, detect anomalies
and troubleshoot issues.
Logging provides a clear audit trail for security analysis.
Then, we will explore Cloud Access Security Brokers.
A Cloud Access Security Broker or CASB
is a security solution that acts as a control point
between cloud service users and cloud application.
Cloud Access Security Brokers enforce security policies
and protect data across cloud environments.
Cloud Access Security Broker implementation concepts include
Application Programming Interface based
and proxy-based Cloud Access Security Broker solutions
An Application Programming Interface based Cloud Access
Security Broker integrates directly with cloud services
and uses Application Programming Interfaces to monitor
and control data flow, enforce security policies,
and provide visibility into cloud usage
without affecting user experience.
Proxy-based Cloud Access Security Brokers,
on the other hand, route cloud traffic
through a proxy server, allowing real-time inspection,
threat prevention and enforcement of security policies
by sitting between the user and the cloud service.
In application, an organization might use
an Application Programming Interface based
Cloud Access Security Broker to monitor
and control data access within its cloud applications,
while employing a proxy-based Cloud Access Security Broker
to actively inspect and secure all data traffic
between its users and the cloud.
Next, we will explore cloud development and deployment.
Development and deployment involves creating, configuring,
and releasing cloud-based applications and infrastructure.
Development and deployment should ensure
that security best practices are integrated
throughout the entire process.
Development and deployment includes tools such as Terraform
and Ansible, as well as concepts such as package monitoring.
Terraform is an Infrastructure as Code or IaC tool.
Infrastructure as Code automates the provisioning
of cloud infrastructure.
Terraform enables consistent and repeatable
Infrastructure as Code deployments,
which help in maintaining security
configurations across environments.
Ansible is another automation tool
that focuses on configuration management,
application deployment, and task automation.
Ansible ensures secure
and consistent management of cloud environments.
Finally, package monitoring involves tracking
and analyzing the security
and integrity of software packages
and dependencies used in development
to prevent vulnerabilities from being
introduced during deployment.
For example, an organization may use Terraform
to provision a network infrastructure
with predefined security settings, followed by using Ansible
to configure applications securely,
and then implementing package monitoring
to ensure all deployed software is free
from known vulnerabilities.
Then we will look at the continuous integration,
continuous deployment pipeline.
The continuous integration,
continuous deployment pipeline is the automated process
of integrating, testing, and deploying
code changes in a secure and efficient manner to ensure
that security measures are consistently applied throughout
the software development lifecycle.
Continuous integration involves regularly merging code
changes into a shared repository where automated tests
and security scans are run to detect
and address vulnerabilities
early in the development process.
Continuous deployment automatically deploys tested code
to a production environment.
In practice, continuous integration
and continuous deployment pipelines might automatically scan
code for vulnerabilities
during the continuous integration phase
and then securely deploy the application to the cloud
with all necessary configurations in place
during the continuous deployment phase.
Following that, we will explore container management.
Container management oversees the deployment operation
and security of containers to ensure
that applications run securely
and efficiently across cloud environment.
Container management concepts include container security
and container orchestration.
Container security focuses on protecting the containerized
applications and their underlying infrastructure
from vulnerabilities.
Protecting containers involves securing container images,
managing access controls,
and monitoring containers for threats.
Container orchestration automates the deployment, scaling,
and management of containers across multiple hosts.
Container orchestration ensures
that security policies are consistently applied across
the entire containerized environment.
For example, an organization may use a container
orchestration tool like Kubernetes to manage the deployment
of containers with predefined security configurations,
while utilizing container security practices to ensure
that containers are protected from potential threats.
Finally, we will explore serverless computing.
Serverless computing is running application code without
managing the underlying infrastructure.
In serverless computing,
the cloud provider rather than the client,
handles the execution environment.
Serverless computing concepts include workloads,
functions, and resources.
Workloads in serverless computing
refer to the specific tasks
or operations that the serverless functions execute.
Functions are the individual units of work
in a serverless architecture,
where each function performs a specific task,
resources in serverless computing
include the underlying compute, storage,
and networking components that the cloud provider manages.
For example, when deploying a serverless function
to handle user authentication,
the function must be securely coded,
assigned minimum necessary permissions,
and run within a protected environment,
where the cloud provider securely manages the resources
ensuring end-to-end security.
To finish things off, we'll take a short quiz to see
what you learned during this section of the course,
and we will review each of those quiz questions
to fully ensure you can explain why the right answers were
right and the wrong answers were wrong.
So let's get ready
to dive into cloud security in this section of the course.