Cloud security, identity and compliance notes — Unit 4

Security in the cloud is a partnership. The fundamental paradigm shift from on-premises security is the Shared Responsibility Model, which dictates who is responsible for what.

⇒1.1 Security OF the Cloud (Provider)

The cloud provider (AWS, Azure, GCP) is responsible for protecting the infrastructure that runs all the services offered. This includes the physical security of data centers, the hardware, the hypervisors, and the foundational networking.

The customer's responsibility depends on the service model selected.

• IaaS: The customer is responsible for almost everything on top of the hypervisor: OS patching, firewall configuration, data encryption, and application code.
• PaaS: The provider handles OS patching. The customer is responsible for application code security and data access controls.
• SaaS: The provider handles everything. The customer is only responsible for managing user accounts and access rights.

If a customer leaves an AWS S3 bucket open to the public and data is stolen, that is entirely the customer's fault for misconfiguring Security IN the cloud.

In the cloud, the traditional network perimeter (firewalls) is dead. If everything is accessible via public APIs, identity becomes the new perimeter. IAM is how you control who can do what in your cloud environment.

⇒3.1 Core Components

• Users: Represents a physical person interacting with the cloud console.
• Groups: A collection of users. Policies are attached to groups to manage permissions easily.
• Roles: Identifies a set of permissions, but is not tied to a specific person. Roles are temporarily assumed by humans or cloud services.
• Policies: JSON documents that explicitly list what actions are allowed or denied.

The foundational rule of cloud security: An entity (user, app, or service) should be granted only the minimum permissions necessary to perform its specific task, and absolutely nothing more.

⇒4.1 Implementation

If a developer needs to upload logs to an S3 bucket, they should not be given 'Full S3 Access'. They should be given a policy that only allows `s3:PutObject` on that one specific bucket. If their credentials are compromised, the blast radius of the attack is severely limited.

In legacy systems, if a web server needed to access a database, the database password was hardcoded into a configuration file. If a hacker read the file, they got the password.

⇒5.1 IAM Roles for Services

In the cloud, you do not use hardcoded credentials. You attach an IAM Role to the Virtual Machine itself. The cloud infrastructure automatically securely injects temporary, auto-rotating credentials into the VM. The application code uses these temporary credentials to access the database. There is no password to steal.

Data must be protected in two states: at rest (stored on disks) and in transit (moving across networks).

⇒6.1 Encryption in Transit

Ensures data cannot be intercepted via Man-in-the-Middle attacks. All API calls to the cloud provider are secured via HTTPS/TLS. Internal traffic between load balancers and VMs should also be encrypted.

⇒6.2 Encryption at Rest

Ensures that if someone breaks into the data center and steals the physical hard drive, the data is unreadable. Cloud providers offer seamless Server-Side Encryption (SSE) where they encrypt data before writing it to disk and decrypt it when you read it.

Encryption is useless if the encryption keys are poorly managed. A KMS is a centralized, highly secure cloud service used to create and manage cryptographic keys.

⇒7.1 Hardware Security Modules (HSM)

Cloud KMS is usually backed by physical HSMs—tamper-proof hardware appliances. The master keys never leave the HSM. If an application needs to decrypt data, it sends the ciphertext to the KMS, the KMS decrypts it inside the secure hardware, and returns the plaintext.

A VPC allows you to carve out an isolated, private section of the public cloud. It is a virtual data center where you control the entire networking environment.

⇒8.1 Subnets

• Public Subnets: Resources (like Web Servers or Load Balancers) that have a route to the Internet. They have public IP addresses.
• Private Subnets: Resources (like Databases or internal microservices) that have NO direct route to the Internet. They are fundamentally unreachable from the outside world, dramatically increasing security.

VPCs use software-defined firewalls to control traffic.

⇒9.1 Security Groups

Act as a virtual firewall for individual Virtual Machines. They are 'Stateful' (if an inbound request is allowed, the outbound response is automatically allowed). You can configure a Database Security Group to ONLY accept incoming traffic on port 3306 from the Web Server Security Group.

⇒9.2 Network ACLs

Act as a firewall at the Subnet level. They are 'Stateless' (you must explicitly write rules for both inbound and outbound traffic). Used as a secondary layer of defense.

Distributed Denial of Service (DDoS) attacks attempt to exhaust a server's resources by flooding it with millions of fake requests.

⇒10.1 Cloud Defenses

One of the massive benefits of the cloud is its inherent DDoS protection. Cloud providers have colossal bandwidth and specialized edge services (like AWS Shield or Cloudflare). They inspect incoming packets at the edge locations and automatically drop malicious traffic before it ever reaches your VPC or your servers.

Businesses must adhere to strict legal and regulatory standards regarding data protection.

• GDPR: European data privacy law.
• HIPAA: US healthcare data protection.
• PCI DSS: Credit card processing standards.
• SOC 2: General enterprise security auditing.

Under the Shared Responsibility Model, the cloud provider audits and certifies their physical infrastructure. The customer inherits those certifications, but the customer must still configure their software securely to achieve full compliance.

To maintain security and compliance, you must know exactly what is happening in your environment. 'Visibility' is paramount.

⇒12.1 API Activity Logging

Because the cloud is API-driven, providers offer services (like AWS CloudTrail) that log every single API call made in the account. You can see exactly who deleted a server, from what IP address, at what exact millisecond.

These logs are crucial for forensic investigations after a security breach.

⇒13.1 Automated Security Audits

In traditional IT, security audits happen once a year. In the cloud, the infrastructure is defined by software, so it can be audited continuously by code.

Cloud security posture management (CSPM) tools constantly scan the environment. If a developer accidentally makes an S3 bucket public, the system detects it within seconds, triggers an alert, and can automatically execute a Lambda function to instantly change the permissions back to private.

⇒14.1 Automated Incident Response

In the cloud, if an intrusion detection system flags a VM as compromised, the cloud can automatically isolate the VM, take a forensic snapshot, and spin up a healthy replacement—all within seconds and without human intervention.

⇒14.2 The Zero Trust Model

The cloud accelerates Zero Trust. No entity is trusted by default, even inside the corporate network. Every request between microservices requires explicit mutual TLS authentication and authorization validation via IAM.