cloud responsibility matrix - ANSWER Documentation listing which security and
management tasks are the responsibility of the cloud provider and which are the
responsibility of the cloud consumer.
IaaS, PaaS, SaaS, etc.
-Who is responsible for security?
Security should be well-documented
-Most cloud providers provide a matrix of responsibilities
-Everyone knows up front
These responsibilities can vary
-Different cloud providers
-Contractual agreements
Hybrid considerations - ANSWER Hybrid cloud
-More than one public or private cloud
-This adds additional complexity
Network protection mismatches
-Authentication across platforms
-Firewall configurations
-Server settings
1
,Different security monitoring
-Logs are diverse and cloud-specific
Data leakage
-Data is shared across the public Internet
Third-party vendors in the cloud - ANSWER You, the cloud provider, and third parties
-Infrastructure technologies
-Cloud-based appliances
Ongoing vendor risk assessments
-Part of an overall vendor risk management policy
Include third-party impact for incident response
-Everyone is part of the process
Constant monitoring
-Watch for changes in unusual activity
Infrastructure as code (IaC) - ANSWER Describe an infrastructure
-Define servers, networks, and applications as code
Modify the infrastructure and create versions
-The same way you version the application code
Use the description (code) to build other application instances
-Build it the same way every time based on the code
2
,An important concept for cloud computing
-Build a perfect version every time
Serverless Architecture (FaaS) - ANSWER Function as a Service (FaaS)
-Applications are separated into individual, autonomous functions
-Remove the operating system from the equation
Developer still crates the server-side logic
-Runs in a stateless compute container
It may be event-triggered and ephemeral
-May only run for one event
Managed by a third-party
-All OS security concerns are at the third-party
Microservices and APIs - ANSWER Monolithic applications
-One big application that does everything
The application contains all decision-making processes
-User interface
-Business logic
-Data input and output
Code challenges
-Large codebase
-Change control challenges
3
, Application Programming Interfaces (API) - ANSWER API is the "glue" for the
microservices
-Work together to act as the application
Scalable
-Scale just the microservices you need
Resilient
-Outages are contained
Security and Compliance
-Containment is built-in
Network infrastructure - ANSWER Physical isolation
-Air-gapped
Logical segmentation
Software-defined networking (SDN)
Physical isolation - ANSWER Devices are physically separate
-The air gap between Switch A and Switch B
Must be connected to provide communication
-Direct connect, or another switch or router
Web servers in one rack
4
management tasks are the responsibility of the cloud provider and which are the
responsibility of the cloud consumer.
IaaS, PaaS, SaaS, etc.
-Who is responsible for security?
Security should be well-documented
-Most cloud providers provide a matrix of responsibilities
-Everyone knows up front
These responsibilities can vary
-Different cloud providers
-Contractual agreements
Hybrid considerations - ANSWER Hybrid cloud
-More than one public or private cloud
-This adds additional complexity
Network protection mismatches
-Authentication across platforms
-Firewall configurations
-Server settings
1
,Different security monitoring
-Logs are diverse and cloud-specific
Data leakage
-Data is shared across the public Internet
Third-party vendors in the cloud - ANSWER You, the cloud provider, and third parties
-Infrastructure technologies
-Cloud-based appliances
Ongoing vendor risk assessments
-Part of an overall vendor risk management policy
Include third-party impact for incident response
-Everyone is part of the process
Constant monitoring
-Watch for changes in unusual activity
Infrastructure as code (IaC) - ANSWER Describe an infrastructure
-Define servers, networks, and applications as code
Modify the infrastructure and create versions
-The same way you version the application code
Use the description (code) to build other application instances
-Build it the same way every time based on the code
2
,An important concept for cloud computing
-Build a perfect version every time
Serverless Architecture (FaaS) - ANSWER Function as a Service (FaaS)
-Applications are separated into individual, autonomous functions
-Remove the operating system from the equation
Developer still crates the server-side logic
-Runs in a stateless compute container
It may be event-triggered and ephemeral
-May only run for one event
Managed by a third-party
-All OS security concerns are at the third-party
Microservices and APIs - ANSWER Monolithic applications
-One big application that does everything
The application contains all decision-making processes
-User interface
-Business logic
-Data input and output
Code challenges
-Large codebase
-Change control challenges
3
, Application Programming Interfaces (API) - ANSWER API is the "glue" for the
microservices
-Work together to act as the application
Scalable
-Scale just the microservices you need
Resilient
-Outages are contained
Security and Compliance
-Containment is built-in
Network infrastructure - ANSWER Physical isolation
-Air-gapped
Logical segmentation
Software-defined networking (SDN)
Physical isolation - ANSWER Devices are physically separate
-The air gap between Switch A and Switch B
Must be connected to provide communication
-Direct connect, or another switch or router
Web servers in one rack
4
