>> Security implications of cloud technology adoption.
The learning objectives for this lesson are to
define business continuity and
disaster recovery with the cloud,
to explore cloud encryption and key management,
and to define cloud log collection and analysis.
Let's get started. One of
the biggest advantages that the cloud
can offer to an organization is
help with their business continuity
and disaster recovery.
However, before any cloud adoption
is considered for an organization,
they should conduct a business impact assessment.
This will allow them to find areas of
their company where maybe
the cloud won't work so well for them.
An example of this would be
legacy apps that might become too expensive to try to
shift them over to cloud or
even have that be a backup for them.
However, if you are able to define that
your particular organization or
your company is able to use cloud technology,
then this is one area where it can really
help and that's the business continuity
and disaster recovery.
When you choose to do this,
the company that you choose for
these services becomes your primary provider.
Now the cloud offers
significant advantages and stability,
scalability, and performance,
and this is especially true when we're
talking about the larger companies such as Amazon,
AWS, Microsoft Azure, and Google.
But one thing you want to keep in
mind when you're moving any resources to
a cloud provider is that you must do so within
the legal and regulatory restrictions
that your organization is under.
Shifting data to another provider away
from your direct control might invoke
additional restrictions and you
need to make sure that this
is handled properly when
you're choosing your primary provider.
In addition, since they are now
your primary provider for
your backup and disaster recovery,
what are their plans?
What do they have in place to ensure your availability?
Again, with your larger providers,
this is less of an issue,
but it's definitely something you want to address.
Are they keeping backups of your data
offsite and away from their data center?
Or if their data center would have come under attack,
or have a natural disaster,
or a fire,
what would be their ability to recover?
Because if you need them
and they're having their own issue,
then that becomes a problem.
When you do your business impact assessment
or your risk assessment,
you may end up finding that you
need an alternate provider.
This would be a backup to your backup.
Should your primary provider fail,
you would want to make sure that you add
a secondary for it.
Then shifting operations from
your primary provider can be
an automated or manual process.
Not all organizations are going to need this,
but those that really need the availability and
the ability to know that they are going
to be able to recover should something happen,
would have an alternate provider.
Encryption and key lifecycle.
Encryption is critical for
cloud data and this is because anything that's
sensitive that is no longer in your direct control
must be encrypted on the cloud service provider.
Not only must it be encrypted while it's stored there,
but it must be encrypted also
while it's in use and in motion.
Now, in the lessons on cryptography that are coming up,
we will go over in a little bit more
detail what that means.
But again, because of legal and compliance requirements,
you need to make sure that you are adhering to those
and most of those are going to
require that the data be encrypted.
In addition to that, you're going to
want to make sure you have policies and
procedures in place for the
following: you want to make sure that you are
managing the lifecycle of the keys that you're
using for your encryption and your key generation,
the replacement, and the revoking.
You also want to make sure that you have
guidance in place for which
cryptographic algorithms and protocols
are you going to allow to be used.
Some of these are no longer secure and shouldn't be
used and that needs to be defined in your policies.
How are you going to handle your key storage
and your key ownership?
You want to make sure that you're not
putting your keys anywhere
in the source code of your apps,
and also that your keys aren't
being stored in public repositories.
This has happened several times where people's keys
ended up in a GitHub repository to be downloaded
and then now that means that the data could be
decrypted by anyone that had access to that repository.
You also want to make sure that you're rotating
keys frequently and then
key management and the usage of the keys should
be separate duties and not performed by the same person.
Let's talk about key management system patterns.
First, we have cloud-native key management systems.
This is a KMS that is operated by
the same company that provides you the cloud services.
We also have external key origination.
This is when the KMS is
not the cloud provider being used.
It's a third party at that point.
We also have cloud service using external KMS.
It's similar to the external above
but this KMS has hardware that
may be used by the customer and it
is exclusively used by that customer.
Then finally, we have multi-cloud KMS.
This is where the KMS can be used by
multiple clouds and multiple clouds can use mini KMS's.
Data dispersion and bit splitting.
Data dispersion is intentionally spreading data across
multiple storage locations and/or
cloud providers to ensure that the data is safe.
This offers increased availability.
Bit splitting or cryptographic splitting is
the practice of splitting
encrypted data into multiple parts,
which are then stored in
different storage locations and then encrypted again.
This offers higher confidentiality.
Serverless computing.
All network architecture is hosted in the cloud.
We're not talking about
any form of physical server anymore.
This is designed to replace the local area network.
Applications are functions and microservices that
interact with each other for
handling different client requests.
The cloud will create a container,
and it will perform the processing
and then it will destroy the container.
Billing is handled by the execution of
time rather than hourly rates.
You're going to be billed on
how much time you're using instead of by the hour.
This is also known as function as a service.
Serverless computing removes the need
for anyone to have to manage VMs or physical servers.
The underlying architecture is managed
by the service provider rather than the organization.
They do have their own security risks.
One of these is because
the best practices and use cases are not very mature yet,
as this is new technology,
we don't really have a lot in the way of best practices.
It's very dependent on
the service provider that you've chosen.
It's event-driven.
When a client connects,
multiple services are called for authentication,
session creation, load allocations, and database access.
Software-defined networking.
This is known as infrastructure as a code.
It's partially facilitated by
both physical and virtual appliances
that can be configured using scripts and APIs.
As network complexity increases with
more and more virtual resources and physical devices,
it becomes difficult to manage
networks and security policies.
Software-defined networking
allows for fully automated deployment
or provisioning of network links,
appliances, and servers.
Collecting and managing cloud logs.
Logging must be enabled and set up
properly so that logs can be received.
Logs must be directed to a log management system that
will collect all the logs being
generated across your cloud network.
We're back to those legal and regulatory frameworks.
Those requirements may also state that
the use of log collection and alerting is required.
This is often the case.
I use HIPAA from time to time as an example,
but HIPAA also wants to
see that you're collecting the logs,
but also someone is reviewing those logs.
It's a lot easier on a local network because
it's easy to extract that data on your local network.
But you need to make sure that
you're doing the same thing in the cloud,
all of those log files are going to
a central point where they can be reviewed.
Let's talk about some cloud log monitoring services.
AWS CloudTrail is
an audit logging service for AWS applications.
AWS CloudWatch provides a graphical reporting and
analytics dashboard for monitoring and alerting.
Microsoft also has the Microsoft Monitor Logs.
This is collected and organized in
Azure and it can be visualized in Azure portal.
Cloud misconfigurations.
Cloud misconfigurations can cause
any number of security problems for an organization.
For example, when services are improperly provisioned on
the cloud platform or
maybe they have improper permissions,
unsecured data storage locations
where maybe your data is not encrypted,
or permissions aren't set properly on them,
and leaving default settings unchanged,
or even worse, disabling security controls.
These are all common things
that happen and you're going to want to make sure
that you take notice of if you were to use
Cloud technology for your organization.
I'm sure you've seen in the news there were
several times where data was found on
an open AWS bucket and
the people had put all information
there where they collected
information on millions of
individuals and they were maybe
going to use it for marketing purposes,
that type of thing, and they just left
it there with the default configurations,
no access control on them whatsoever.
Because of it, all that information
for all those millions of people was then exposed.
This usually happens because of the lack of
skills and lack of change controls
that we would normally have in place
to track these changes or these settings.
Not having those is a huge problem and we need to
make sure that all of
these things are checked off properly.
The cloud is great but
just like any other form of technology,
we have to make sure that
we're implementing them correctly.
Cloud access security broker or CASB.
This is an enterprise management tool
that will help mediate access to
cloud services by users of all types of devices.
Examples include Blue Coat,
SkyHigh Networks, Microsoft Cloud App Security.
A cloud access security broker will provide
visibility into how clients and
nodes are using cloud resources.
For example, single sign-on
authentication from network to cloud provider.
They also scan for malware or non-compliant devices,
and they can monitor and audit user activities.
This can help limit data exfiltration by
preventing access to unauthorized cloud resources.
Now, we can implement a cloud
access security broker in one of three ways.
We can use it forward proxy,
which is an appliance that would be at
the network edge of the customer,
and then traffic will be directed to
the cloud network if policies allow.
Now what this means is we would set up
specific policies for access to the cloud and
then whatever data match
those policies would be allowed to be
sent through the proxy to the cloud provider.
We can also use a reverse proxy,
and this is positioned at the cloud
network edge and it will direct
traffic to the cloud services
again if that traffic matches the policies.
Finally, we can use an API which brokers
connections between a cloud provider and
a customer. Let's summarize.
In this lesson, we went over
cloud and business continuity.
We went over primary and alternate providers for BCDR,
we also discuss cloud log management,
encryption and the key life cycle,
and we went over serverless computing,
software-defined networks,
and cloud access security broker.
Let's do some sample questions.
Question 1; this type of KMS pattern is where
keys are not managed
by the cloud provider where the keys are used.
External key origination. Question 2;
this allows for the fully automated deployment
or provisioning of network links,
appliances, and servers.
Software-defined networking. Question 3;
if a BIA finds that
a contingent cloud platform is needed, this is called?
Alternate provider. Keep in mind
sometimes questions on the test
will be exactly like this.
You would be expected to know what a BIA
means and that's why it will be written this way.
A lot of times it will not be spelled out and by knowing
the term automatically you should have
a good idea of what the answer is looking for.
Finally, Question 4. True or false.
Cloud services can be utilized
by any organization to save costs,
increase scalability, and security.
This is false. Because of legacy applications
some organizations with finite too
costly to use cloud services.
Well, that sums up this lesson.
I hope it was helpful for you
and I'll see you in the next one.