In this lesson, we will learn
about Cloud Security Considerations.
Cloud Security Considerations involve addressing risks
and vulnerabilities to protect data
and resources within cloud environments.
Cloud Security Considerations include
Insecure storage resources, data exposure, data leakage,
and data remanence.
Insecure storage resources refer to cloud storage
that lacks proper security configurations, such
as encryption or access controls.
Data Exposure occurs when sensitive information is
unintentionally made accessible to unauthorized users.
It is often due to misconfigurations
or inadequate security measures.
Next Data Leakage refers to the unauthorized transmission
of data from within the cloud environment
to external parties, which can happen
through insecure channels or compromised accounts.
Finally, data remanence is the residual data
that remains on storage devices
after deletion, which can be maliciously recovered,
if not properly sanitized.
Let's learn more about insecure storage resources
and Data Exposure, Data Leakage and data remanence.
First, we have Unsecured Storage Resources.
There are many ways to store data in the cloud,
but the most commonly misconfigured storage resources are
buckets and blobs.
Buckets and blobs essentially function the same way,
but the name that is used depends on the cloud provider.
For example, in Amazon Web Services
or AWS storage containers are called buckets.
While in Microsoft Azure, they're known as blobs.
Regardless of the name, both are used
to store files and data in the cloud.
When you store a file into the cloud, it goes into one
of these types of containers.
These containers can be located
in different geographic regions, such
as the East Coast, West Coast, Europe,
or Asia, depending upon your chosen data center
at the time of storage setup.
However, unlike your personal computer
where you can nest folders inside
of each other, you cannot nest containers in the cloud.
This means that each container hosts
its own data objects or files.
Once a container is created,
configuring access control is the next step,
and this is where can occur.
Access control for storage containers is managed
through three key components, the container's policies,
Identity and Access Management, or IAM authorizations
and object access control lists or ACLs.
When these elements are configured properly,
they provide strong security,
but misconfigurations can leave the data exposed.
For example, a common issue is
that newly created storage containers may come
with default read and write access,
which can leave them more open than intended.
So it's important to update these default settings to align
with your security needs.
Additionally, misconfigurations can occur
in origin settings, which determine the source location
from which the data is retrieved
and how that data is distributed
through a content delivery network
or CDN to end users.
If these origin settings are incorrect,
data could be unintentionally shared across the CDN
to unintended locations.
Moreover, when data is shared across different domains,
Cross-origin Resource Sharing or CORS policies
are used to control how resources are shared between
these domains.
Improper CORS configurations can expose
your storage resources to security risks, such
as cross site scripting attacks.
Therefore, always double check these settings
to ensure your data is securely stored and shared.
Second, we have Data Exposure.
Data Exposure occurs when sensitive information is
accidentally made accessible to unauthorized users.
Typically because of poor security practices
or misconfigurations.
This can happen when cloud storage resources
like buckets or blobs are set
with incorrect access permissions, allowing the public
or untrusted parties to access confidential data.
For example, if a company's customer database is stored
in a cloud container and is mistakenly set to public, anyone
with the URL could access the database exposing sensitive
personal information, such as names, addresses,
or financial details.
Data exposure can also occur through weak access controls.
If proper identity
and access management policies are not enforced,
unauthorized users may gain access to sensitive information.
For instance, if an employee has access
to highly confidential data,
but then leaves the organization without having their
permissions revoked, they could still access
that data remotely.
This is why we should regularly audit permissions
and ensure that only authorized users have the necessary
level of access to sensitive information.
One way to prevent data exposure is through encryption.
That way, even if the data is accidentally exposed,
encryption can prevent unauthorized users
from being able to read or use the data.
So ensuring that all sensitive data is encrypted both
at rest, when in storage, and in transit
between systems is an important security practice.
Tools like AWS Key Management Service,
Microsoft Azure Key Vault and encryption protocols, such
as transport layer security, are essential for managing
and automating this encryption process.
Additionally, regular security audits
and automated tools like AWS Config
or Azure Security Center can help detect misconfigurations
early before they lead to a major Data Exposure event.
Third, we have Data Leakage.
Data Leakage refers to the unauthorized transmission
or transfer of sensitive data from within an organization
to an external or untrusted party.
This can happen through a variety of channels such
as insecure email communications, cloud applications,
or USB drives.
For example, an employee may unknowingly send
sensitive files like financial reports
or customer information to an external email address
without encrypting the content resulting in data leakage.
In cloud environments using unauthorized applications
or storage services can also lead to leakage
if proper security controls are not in place.
Data Leakage is particularly concerning
because it often goes unnoticed.
For instance, if an employee syncs sensitive files
to an unapproved cloud storage service
like a personal Dropbox or Google Drive account,
the data could be exposed to risks including theft or loss.
IT departments may not even be aware
of this activity if they are not actively monitoring
employee behavior, making it difficult
to detect when sensitive data has left the
organization's control.
Preventing Data Leakage requires both technology
and policy.
Data Loss prevention tools can be implemented to monitor
and control the movement
of sensitive data within the organization,
ensuring it doesn't leave through insecure channels.
Additionally, clear policies
and training for employees regarding the use
of personal devices, cloud services,
and email communication can help reduce the risk
of data leakage.
Fourth and last, we have data remanence.
Data remanence refers to residual data
that remains on storage media even
after it has been deleted or erased.
This residual data can be recovered
if proper deletion techniques aren't used.
Presenting a significant security risk.
For instance, when a company retires a cloud storage
instance but fails to fully wipe the data stored
in the containers, fragments of sensitive information
might remain accessible and could be recovered by someone
with the right tools and expertise.
This could lead to unauthorized access
to confidential information even
after the data was thought to be erased.
In cloud environments,
data remanence becomes a concern when organizations move
or delete virtual machines, containers, or volumes.
If the storage devices are not properly sanitized
or if the cloud provider does not follow strict data
destruction protocols,
sensitive information could still exist in residual form.
This could happen, for example,
if a cloud provider reuses hardware
that hasn't been fully wiped
after one client stops using it, potentially exposing data
to a future client who uses the same hardware.
So to mitigate the risk of data remanence,
organizations should use secure deletion methods such
as cryptographic erasure or physical destruction
of storage devices to ensure that no residual data remains.
When using cloud services, it's essential to confirm
that the cloud provider follows industry standard data
destruction practices
by ensuring data is securely erased
from all storage, media organizations can prevent
unauthorized access to sensitive information even
after the data is no longer active use.
So remember, insecured storage resources,
data exposure, data leakage,
and data remanence are concerns
that organizations must address
to protect sensitive information.
Insecured storage resources occur when cloud storage
containers like buckets
or blobs are not properly configured
with the right access controls
or encryption, leading data vulnerable
to unauthorized access.
Next, data exposure occurs when sensitive data is
accidentally made accessible to unauthorized users due
to misconfigurations or inadequate security measures.
This can lead to unauthorized access
and compromised confidential data.
Next, Data Leakage refers
to the unauthorized transmission
of sensitive information from within the organization
to external parties.
Often through insecure channels
or unauthorized cloud services.
This can go unnoticed for long periods
of time, increasing the risk of data theft or loss.
Last, data remanence involves residual data
that remains on storage devices even
after deletion, posing a risk
if proper erasure techniques are not used.
So preventing data remanence
requires secure deletion practices to ensure
that no data fragments remain accessible
after storage resources are no longer in use.