Cloud Security

Cloud Security

1. IDENTITY AND ACCESS MANAGEMENT

   • Also known and access control works as the first line of defense * Authenticate and authorize users * Provide user-specific access 
   • Theres 3 types of users shown above.
   • Users
     • Administrative users
       • Include administrators, operators and managers : roles that create, update or delete application and instances and also need insight into their team members.
       • An attacker with this type of access could: * Steal data from databases * Deploy malicious applications * Destroy or deface existing apps
     • Developer Users
       • This type includes app devs, platform devs and app publishers: Roles that can read sensitive data, create apps, update apps and delete apps.
     • App Users
   • Authentication and User Identity
     • Enables apps in the cloud to authenticate the user on an app level through a cloud directory, social login, enterprise id provider or cloud id provider. You could also use an API key for the app that is making the request or for the user.
     • Multifactor Authentication
       • Used to combat identity theft by adding an additional level of authentication for application users.
       • Could be: * Single use pwd * Pins * Certificates * Tokens * RIsk based authentication based on the changes in the users location, past activity or preferences.
     • Cloud directory Services
       • Are used to securely manage user profiles and their associated credentials and pwd policy inside a cloud enviroment.
       • This means that apps in the cloud do not need to user their own user repository.
   • Reporting
     • Helps provide a user centric view of access to resources or a resource-centric view of access by users.
     • This shows us which users can acces which resources, changes in user access rights, access methods used by each user.
   • Audit and Compliance
   • Mitigating Risks
     • Provisioning users by specifying roles on resources for each user
     • Password policies that control the usage of special characters, minimum pwd lengths and other similar settings.
     • Multifactor authentication like time-based one-time pwd.
     • Inmediate de-provisioning of access when users leave or change roles.
   • Access Groups
     • A group of users and services IDs created so that the same acces can be assigned to all entities within the group with one or more access policies
     • Offered my most cloud provides to create, add users and manage access groups.
     • Access Policies
       • Define how users, service IDS and access groups in the account are given permission to access account resources.
     • Benefits
       • Streamline access assignment process vs assigning individual user access. Reduce the number of polices in an account.

2. CLOUD ENCRYPTION

   • Plays a keyrole on cloud, and is often referrred as the last line of defense in layered security model. This ensures that only authorized users will have access to sensitive data and without authorization, data is unreadable and meaningless.
   • This layer of protection not only encrypts data but includes: data access control, key management and certificate management.
   • Encryption can be only on sensitive data or end-to-end. The encryption process creates a key. Users must be careful with their key to the data because if they lose it they wont be able to read their data
   • Encryption
     • Scrambling data in a way that makes it illegible  Theres two components: the encryption algorithm, namely, the rules by which the data will be transformed and The Decryption key that defines how encrypted data will be transformed back to legible data.
   • Data Protection States
     • Encryption at rest: Protects stored data
     • Encryption at transit: Protect data while transmiting, includes encryting before transmission, authenticate endpoints, decrypts on arrival.
     • Encryption in Use: Protects data in use in memory, allows computations to be performed on encrypted text without decryption.
   • Types
     • Server-Side
       • This type of encryption includes: * Create and manage your own encryption keys or * Generate and manage keys on Cloud key management services.
     • Client
       • Occurs before data is sent to the cloud. Cloud providers cannot decrypt hosted data.
   • Key Management
     • Encryption does not eliminate security risk, it separates de security risk from the data itself, keys need to be managed and protected against threats
     • Key management cloud services enable customers to encrypt sensitive data at rest, easily create and manage the entire lifecycle of cryptographic keys, protect the data from cloud service providers.
     • Best Practices
       • Storing keys and encrypted data separately. Taking keys backups offsite and auditing them regularly Refreshing the keys periodically Implementing multifactor authentication for both the master and recovery keys.