In this lesson,
we will learn about Cloud Management.
Cloud management involves overseeing
and securing cloud resources
and services while ensuring that cloud provider
and customer responsibilities are clearly defined
and properly executed.
Cloud management concepts include
the shared responsibility model
as well as the management of encryption keys
and licenses in both cloud
and customer managed environments.
The shared responsibility model outlines the division
of security responsibilities
between the cloud service provider and the customer.
Let's learn more about the shared responsibility model
as well as cloud versus customer managed resources.
First, we have the shared responsibility model.
A shared responsibility model defines which security tasks
are handled by the cloud provider
and which are handled by the client.
If you are using services like Amazon Web Services
or AWS, Microsoft Azure,
or Google Cloud,
certain roles like maintaining the physical infrastructure,
security of the hardware,
and environmental controls will be handled
by the cloud service provider.
On the other hand,
tasks such as configuring data encryption, managing access,
and setting up security permissions fall on the client.
There are three types of controls
under this shared responsibility modeled,
inherited, shared, and customer specific.
Inherited controls are fully managed by the cloud provider,
such as ensuring data centers have the right
environmental conditions.
Shared controls are responsibility shared
between the cloud provider and the client,
like patch management,
where the provider patches the infrastructure
and the client patches the operating systems they manage
and are using.
Last customer specific controls are solely
the responsibility of the customer or client,
and include configuring security zones
or setting up proper communication protocols
for their applications.
So to sum it up,
the more you move up the technology stack
from infrastructure to user-facing applications,
the more responsibilities typically fall on the client.
The cloud service provider handles the physical hardware,
regions, availability zones, and core services like compute
and storage,
while the client is responsible to protect their own data,
install, patch, and configure their systems,
as well as manage identity
and access permissions in the cloud.
In this way, both the cloud provider
and the client work together to ensure
a secure and reliable cloud environment.
Second, we have cloud versus customer managed resources
In the cloud environment,
as we just discussed,
many of the core infrastructure responsibilities fall
to the cloud service provider.
This includes the physical hardware, networking,
and general maintenance of the underlying systems
and infrastructure.
However, when it comes
to critical resources like encryption keys
and software licenses,
the responsibility often shifts to the customer.
In a cloud environment, the provider is responsible
for maintaining the infrastructure that stores
and protects encryption keys,
ensuring the underlying platform is secure and reliable.
Services like AWS Key Management Service or KMS
or Azure Key Vault even help manage
and store keys securely.
However, it is still the customer's responsibility
to generate, manage, and rotate the keys properly.
So if a customer mismanages their encryption keys
by failing to rotate them regularly
or improperly configuring access
sensitive data could be exposed
despite the cloud service provider's secure infrastructure.
Licensing is another area
where the difference between cloud
and customer managed environments becomes clear.
In cloud environments, licenses for software
or services are often bundled with the platform
as part of a subscription.
For instance, if you are using a service
like Microsoft Azure or AWS,
certain licenses for tools like Microsoft Office
or database solutions might be included automatically,
reducing the administrative overhead for customers.
In this case, the cloud provider takes care
of licensing renewals
and ensures that the licenses stay compliant
with the provider's terms.
In contrast, in customer managed environments,
the organization is solely responsible for tracking,
renewing, and maintaining compliance licensing agreements.
This can involve managing multiple software licenses
for various products and services,
often requiring dedicated staff
to ensure that no licenses expire
and that the organization remains within legal compliance.
So when using cloud-based services,
understanding the balance of cloud
and client responsibility is a must.
In a cloud environment, many aspects like key storage
and licensing may be managed by the provider,
but the customer must still ensure proper usage
and security of those resources.
In a customer managed environment
in the cloud, the organization has greater control,
but this also means taking on the full responsibility
for managing security, licensing and compliance.
The distinction between cloud
and customer managed resources highlights
the importance of carefully managing encryption keys
and licenses regardless of who is responsible
for the underlying infrastructure.
So remember, cloud management involves overseeing
and securing cloud resources while clearly defining
responsibilities between the cloud provider
and the customer.
The shared responsibility model outlines
which security tasks are handled
by the cloud service provider,
like maintaining the physical infrastructure,
and which are managed by the customer,
such as configuring data encryption and access.
In cloud environments,
services like AWS Key Management Service
or Azure Key Vault help manage encryption keys,
but customers are still responsible for properly handling
and rotating those keys.
Furthermore, licensing in the cloud is often bundled
into platform subscriptions,
reducing the customer's workloads,
but organizations must still track, renew,
and maintain compliance themselves.
Understanding the division of responsibilities
for encryption keys
and licenses is crucial to maintaining security
and compliance in any cloud environment.