Many types of businesses are now using cloud service providers as their standard model for cloud computing.
Cloud-based software models have many advantages, mainly because they delegate maintenance responsibility to service providers. Pricing models can often be built using a pay-per-use model, which allows small businesses to start small.
Shared responsibility model
Data security is a key aspect of software-related services. A two-fold approach is needed when discussing cloud security. This should distinguish between the security in the cloud and the security.
This is because cloud services are shared responsibility. The security aspect of cloud services is not the responsibility of the cloud provider, but it does depend on the service model.
The simplest model, Infrastructure as a Service, (IaaS), is that the cloud provider is only responsible for the physical security and operation of the host operating system with virtualization, power supply, and hardware. The Platform as a Service solution (PaaS), the cloud service provider is responsible for all software required to run customers’ applications.
Clients who subscribe to Software as a Service (SaaS), save the most effort in security. This approach leaves the service provider responsible for all security except access management for the end users.
Cloud Security
Cloud security refers to all organizational and technical measures taken by cloud service providers in order to protect clients’ data. These controls include:
- Uninterruptible power supply and environmental control
- Access control is a key component in ensuring physical security for hardware and network devices.
- Network connectivity and high availability
- Storage with high availability
- Securely managing and ensuring the availability of system components
- Data backup, retention, and recovery procedures
- Software development lifecycle and change management
- Use of encryption key management and cryptography
- Security auditing, testing, and measuring.
Also read: CIEM: The Cornerstone of Sustainable Cloud Security
How can you check the security of a Cloud?
Al Service providers will claim that their environments and services are safe and best for your company. It is your job is to perform fact-checking.
Both the cloud provider as well as an independent third party must audit the security of the cloud. Check with your provider to verify the most recent certification results. The most well-known security certificates include:
- SOC 2 Type II – This confirms compliance with the US AICPA SOC 2 requirements in these areas: network and physical, data availability, confidentiality, privacy, data processing integrity, security management, and data confidentiality
- CSA STAR Level 2 — confirms compliance with Cloud Security Alliance STAR requirements regarding high-risk data processing
- ISO/IEC 27001 is accompanied by the declaration of compliance with ISO/IEC 27017 & ISO/IEC 27018. This confirms that a standard Information Security Management System has been implemented, along with privacy and security controls for public cloud providers.
- PCI-DSS – confirms that all services comply with the Payment Card Industry Data Security Standard
Security in the cloud
Security in the cloud, It is the client that takes responsibility for any data stored in the cloud. Security controls that may be used to achieve this goal depend on the cloud computing model.
Identity and Access Management
Every cloud computing model requires Identity and Access Managemen. Clients can decide what accounts they want, what access level is granted, how secure they are, and, most importantly, if accesses can be revoked if they are no longer required for business purposes.
Access policies must be set up and maintained in accordance with the principle that the least privilege is applied. Permissions should only be granted when necessary to complete a task, and for the time it takes to do so.
Cloud IAM must provide strong authentication mechanisms that do not rely on passwords but also on other factors such as U2F keys, one-time code-based codes, push notifications, and so on.
It is also crucial to teach cloud users how to spot phishing. Along with leaked passwords and weak passwords, account takeovers by Phishing are two of the most common issues. Phishing can be prevented by multifactor authentication, except for U2F keys.
Cloud Identity and Access Management services can also be connected to additional security tools that can help increase account security. These tools are examples of such tools:
- Reporting on the effectiveness of permissions for a group of users and services
- Reporting on the use and age of credentials (passwords or API keys)
- Machine learning-supported reports about sensitive data storage
- Application access is granted conditionally based on the user’s behavior and detected environment
Logging and monitoring
An additional security control that cannot be overlooked is the visibility of security-related events within applications and cloud-based platforms. Audit trails can help you achieve this. The audit trail entry must be triggered by at least one of the following events:
- Success in signing-in
- Sign-in failed
- Create an account, group, or role
- Modifying an account, group or role
- Delete an account, group or role
- Pairing accounts with devices, changing passwords and one-time password application
- Permissions granted and revoked
- Change configuration, including enabling or disabling security control controls
- Any confidential data can be operated: creation, modification, or deletion
Log entries must contain the following data:
- Who was the one who created the event?
- When the event occurred (exact date, synchronized to the reliable time source).
- What was the subject of the event (which data were accessed or modified)
Also read: Top 10 Cloud Computing Tools
PaaS security services
Clients are responsible for the security and maintenance of PaaS cloud applications. This includes:
- Security of the code used in applications
- Vulnerabilities in used libraries and other components
- Securing high-level network connections
- Data encryption in transit, and in storage
- Multi-sensor threat detection was made possible by machine learning
- Management of cryptographic keys
- Data backup and restore
Nearly all cloud service providers provide tools that can solve the problems mentioned above. Clients may also choose to use third-party solutions available in the cloud application store if the functionality provided is inadequate. Cloud providers should be reviewed by clients.
IaaS security tools and processes
The Infrastructure as a Service cloud model presents the highest number of security-related issues that the client must address. The client must also apply and maintain the following security controls in addition to the above-mentioned concerns:
- Patch management and vulnerabilities in the operating system
- Network security
- High availability
- Backups of the operating system and configuration, as well as restore procedures
- Data storage scalability
Additional security tools and services are required to ensure security in all the areas mentioned. Cloud providers may offer some of these services, particularly if they are standard. These services include:
- Additionally distributed denial of service network protection
- Monitors vulnerability in agent-based operating systems
- Load balancers at the network and application levels
- Backup and recovery wizards
- Cloud lift-and-shift from on-site
- Intrusion Prevention Systems
- System-scaling calculators and wizards
These tools need to be managed by cloud operations-skilled staff. To ensure that they can perform their tasks securely, it is important to have a set of security policies and organizational procedures in place. It might be worth making additional investments to review security procedures and training.
Choose the right cloud computing model
Cloud security is a broad discipline that has been built with the “shared responsibility” idea in mind. Cloud security is only possible if you choose the right cloud cooperation model. Software as a Security cloud computing is more agile, but the client is responsible for security and maintenance.
The Infrastructure as a Service model is the opposite. This requires that the client assumes all responsibility except hardware. This requires the use of not only good tools but also skilled staff, and regular testing.
Leave a comment