- [Instructor] Let's talk about cloud environment
and cloud security.
So our learning goal for this lesson will be
to define the basic models for cloud deployment.
We'll talk about the challenges of cloud security as well
as some of the strategies that we can deploy.
So let's first start with cloud deployment model.
There are three main types of cloud deployment.
You have public cloud deployment, private cloud,
as well as hybrid.
So the public cloud provides you access
to the cloud that is hosting
for several organization.
It can be hundreds of organization.
There's obviously segmented, so your organization's privacy
and access is protected.
But essentially, public cloud means
that, a shared cloud environment.
As opposed to public cloud,
you have the private cloud
that restricts the user's organizations
to a specific cloud segment or cloud name set.
So private cloud provides more isolation
compared to a public cloud.
A combination of this is hybrid cloud environment
that serves the need of a single organization
or its designated partners
and vendors in a public cloud environment.
However, hybrid environment, not necessarily hybrid cloud,
hybrid environment can also include a cloud environment
and a combination of on-premise environment.
So let's now look at cloud service models.
So cloud service models have infrastructure as service,
software as service, platform as service,
and identity as service.
So basically what that really means is
that infrastructure includes on-demand access
to cloud-based physical and virtual server.
And then you have platform as service that has access
to complete and ready to use cloud-hosted platform
for developing and running software.
And software as service basically has the software
that is on-demand
and ready to use in a cloud hosted environment.
So this particular cloud service model illustration
actually depicts the differences clearly.
So when you are talking about infrastructure as service,
if you subscribe to that, you'll have a infrastructure
or platform that lets you build your server storage.
It has the network security,
and you have your access to data center,
but you have to basically deploy your own operating system
and top of it, if you are developing application,
you're deploying your development tools,
and then obviously your application.
When you are doing platform as service,
you are getting a little bit more
where you are getting the operating system as well
as development tool.
So on top of it, you are going to install your application.
And in software as service,
you already have even the application installed.
Now you're going to configure the software
to meet your requirements.
We haven't talked much about identity as service.
It means that your identity
or your directory is completely residing in the cloud
and is integrated with any of the services so
that you can manage your identity from the cloud.
Let's now talk about cloud storage based on the type
of service you have chosen.
Now keep in mind that you don't have
to choose one specific service.
You can choose all of the service we talked about
or any combination of service based on your requirement.
So for infrastructure as service, the type of storage
that you are going to subscribe to will be a volume storage,
such as a virtual hard disk
or any object type of storage, such as a file share type
of storage that you are going to access using APIs
or web interface.
For platform as service,
there are storage that can be structured
or unstructured depending on what you choose.
But these are typically a database type of storage.
For software as service.
the storage is also database,
but it is basically more structured and the access,
and how you manage, is more well-defined
in software as service.
Let's now think about cloud management and cloud security.
Some of the challenges of cloud security,
first of all, is the lack of control.
So it is not like your on-premise environment
where you can just decide like, well, this application,
I'm going to simply secure it this way,
and the other application I'm going
to use a different strategy and whatnot.
So you kind of have to go with
what the cloud provider gives you the access of.
Then you have availability.
So what that really means is that if
for some reason your cloud basically goes down,
then you will have issues,
and you'll have to work with the provider
to basically get the services up and running.
So if you have a security software
that is completely in the cloud
and some of the service goes down, you have to make sure
that your software is still secure.
You can have data loss simply
because you have users who are not,
I mean the user accounts can be in the cloud,
but you have users who are using laptops
and other workstation,
it could be even other applications,
to access the cloud environment over the internet.
In other words, for on-premise environment,
you could have had database
or application that is completely internal
and you never expose that to the internet.
But with cloud environment, you don't have that choice,
and that opens up for data loss and data breach.
Last, but not the least, there are certain issues
with governance as well,
simply because you have to define
how are you going to make sure
that all your data is actually meeting all
the regulatory requirements
of your organization, since now you know the access as well
as the control is not completely within your control.
So let's now look at another aspect
of cloud environment,
which is the shared responsibility in terms of security
as well as management.
So if you look at this particular diagram,
you have different levels of security
such as physical security, infrastructure security,
platform security, application security, data security,
and then you have governance and compliance and risk.
So depending on the type of cloud service you have chosen,
it could be your responsibility
or it could be basically the cloud
provider's responsibility.
So for example, when you have
either infrastructure as service,
PaaS or SaaS, the physical security
is always the cloud provider's security.
But if you have private cloud, then it may be,
so the brown indicates
that maybe it's a combination of both.
Purple indicates that it
is the cloud provider's responsibility.
And then basically,
the blue indicates enterprise responsibility
or your organization's responsibility.
So simply by looking at that, you can get a pretty good idea
as to what you should be focusing on depending
on your responsibility.
So I mean, if you have any of the public cloud services such
as Pass or SaaS
or IaaS, you don't have to worry about physical security.
For PaaS and SaaS,
you don't even have to worry about infrastructure security.
You can just then focus on platform security as well
as your application level security.
Now, for all of these,
the data is always your responsibility.
In other words, there will be a lot of tools
and security features
that are configurable within the cloud platform,
but you need to configure it based on your requirements,
based on the application you're using.
And then you need to define the governance of this data,
meaning that you need to define like, okay,
for how long you're going to keep that data in the cloud?
Who has access to that data?
Do you have any backup?
All of these should be defined
within different configuration,
but you have to come up with a plan for that.
So speaking of governance,
one of the key features of governance
is data loss prevention.
So as we mentioned before,
that cloud storage,
since we are accessing it over the internet,
it is always subject to potential data loss.
So what you have to do is you have to make sure
that only the administrators who need access have access.
You also have to make sure that
whenever you are making configuration changes,
it does not give someone more access than needed,
and all these changes are recorded.
The other thing that you have with cloud storage is the lack
of control that we talked about.
So basically, you have to address that with different types
of data loss prevention policies.
So the way DLP works in the cloud is
through data discovery and classification.
And usually these features in all
the modern up-to-date cloud environment are automated,
but there's certain configuration you can still do.
So when we talk about data classification,
we are talking about what is your most critical data,
what is somewhat critical,
and then what is not necessarily absolutely critical, right?
And you can assign different priority,
and based on the priority,
you can have different security level.
Now, with all of that, you still need
to monitor your data access as well as DLP.
Doing the classification can also help you enforce
certain types of rules and regulatory requirements.
So speaking of rules
and regulatory requirements,
one of the regulatory requirements could be that you know,
for whatever business you are in,
maybe it's a healthcare industry, you have access to a lot
of healthcare data along with users'
really critical information
like social security information.
So what you can do to protect those data as well as
to protect the privacy, you can use data masking.
So data masking basically means,
let's just say your social security number,
with data masking, you're going
to mask the first six digits,
only the last four digits are visible.
That is the third option, which is just plain
and simple masking.
But you can also use other types of, you know,
data masking options such as shuffling the numbers,
random substitution of the numbers, or even deletion
or removing of data from certain files.
So maybe you just, you know, have some sort of code
or have some sort of key that actually points
to a different file where you keep this data.
So you move, let's just say social security,
if it's in multiple locations, you move it from everywhere.
Only have one particular database
where you have your client's social security information.
Then you have another technique called data anonymization.
So this is where basically personal information
is removed from the data.
And again, identifying this type of data is important.
Last but not the least, you have tokenization
where a sensitive data is substituted
for a non-sensitive data, assuming that substitution
is okay for that particular scenario.
So to summarize, in this video we discuss different types
of cloud environment.
We talked about cloud storage
and also different strategy for cloud security.