Unit 6: Cloud Security

I. Orientation — Security as a Shared, Risk-Based Discipline

Cloud security is the protection of cloud-hosted identities, networks, computing resources, applications, and data. It combines provider safeguards with customer controls and applies confidentiality, integrity, and availability—the CIA triad—throughout the service lifecycle.

• Confidentiality: Prevent unauthorized disclosure through encryption, access control, and data classification.
• Integrity: Prevent or detect unauthorized modification using hashes, digital signatures, versioning, and audit logs.
• Availability: Maintain reliable access through redundancy, backups, autoscaling, and denial-of-service protection.
• Zero-trust assumption: Trust is never implicit; every request is authenticated, authorized, and continuously evaluated.
• Defense in depth: Multiple controls protect identity, network, host, application, and data layers so that one failure is not decisive.
• Risk-based governance: Controls are selected according to asset value, threat likelihood, business impact, and regulatory obligations.
• Cloud-native emphasis: Automation, immutable infrastructure, centralized telemetry, and policy as code replace inconsistent manual administration.

II. Cloud Risk and Responsibility — Establishing the Security Boundary

A. Security Issues in Cloud Computing

Cloud computing introduces risks arising from remote access, multi-tenancy, rapid provisioning, abstraction, and dependence on third-party infrastructure.

• Misconfiguration: Public object storage, unrestricted security groups such as 0.0.0.0/0, and excessive IAM permissions frequently expose resources.
• Data breaches: Stolen credentials, vulnerable APIs, or accidental publication can disclose customer records, credentials, and intellectual property.
• Insecure interfaces: Weak authentication, missing rate limits, or improper input validation can expose REST APIs and management consoles.
• Account hijacking: Phishing, leaked access keys, session-token theft, and credential stuffing let attackers impersonate legitimate users.
• Multi-tenancy: Customers share physical infrastructure; providers must enforce strong isolation through hypervisors, containers, and virtual networks.
• Availability threats: Distributed denial-of-service attacks, regional outages, ransomware, and dependency failures can interrupt services.
• Insider threats: Privileged employees or compromised administrator accounts may bypass ordinary application controls.
• Visibility and shadow IT: Unapproved SaaS accounts and short-lived workloads can escape inventory, logging, and governance.
• Vendor dependence: Provider outages, service withdrawal, proprietary APIs, and difficult data migration create concentration and lock-in risks.

B. Shared Responsibility Architecture

Shared responsibility divides security duties between the cloud service provider and the customer, with the boundary changing by service model.

1. Provider—security of the cloud:
   • Infrastructure: Protects data centers, physical servers, storage hardware, networking, and the virtualization layer.
   • Managed-service foundation: Patches and operates components controlled by the provider.
2. Customer—security in the cloud:
   • Configuration: Controls identities, data classification, encryption choices, network rules, and application security.
   • Workloads: Patches customer-managed operating systems and software.

• IaaS: In an AWS EC2, Azure VM, or Google Compute Engine deployment, the customer secures the guest OS, applications, and firewall rules.
• PaaS: For Azure App Service or Google App Engine, the provider also manages the OS and runtime; the customer secures code, identities, and data.
• SaaS: For Microsoft 365, the provider runs most of the stack, while the customer manages users, sharing settings, and information governance.
• Accountability principle: Outsourcing operation does not remove the customer’s legal responsibility for its data.

C. Security by Design Principles

Security by design integrates controls into architecture and delivery pipelines rather than adding them after deployment.

• Least privilege: Grant only required actions, resources, and duration; replace permanent administrator access with temporary privileged sessions.
• Secure defaults: New databases, buckets, and APIs should be private unless explicitly approved for public access.
• Separation of duties: Different identities should develop code, approve deployments, and manage production secrets.
• Fail securely: An authorization service failure should deny access rather than permit requests.
• Minimize attack surface: Remove unused ports, packages, accounts, APIs, and public endpoints.
• Automate verification: CI/CD pipelines can scan dependencies, container images, infrastructure-as-code templates, and secrets before release.
• Assume breach: Segment systems, rotate credentials, preserve logs, and prepare recovery procedures even when preventive controls exist.

III. Identity and Layered Protection — Controlling Who Can Do What

A. Identity and Access Management

Identity and Access Management (IAM) authenticates principals and authorizes their actions on cloud resources.

• Principals: Human users, groups, service accounts, applications, devices, and federated identities receive distinct identities.
• Authentication: Passwords should be strengthened with multi-factor authentication using FIDO2 keys, authenticator applications, or biometrics.
• Authorization models:
  • RBAC: Role-based access control assigns permissions through roles such as DatabaseReader.
  • ABAC: Attribute-based access control evaluates tags, department, device state, location, or time.
• Federation: SAML 2.0 and OpenID Connect support single sign-on from an enterprise identity provider; OAuth 2.0 delegates API access.
• Temporary credentials: Short-lived tokens reduce the exposure created by permanent API keys.
• Privileged access: Just-in-time elevation, approval workflows, session recording, and break-glass accounts protect administrative operations.
• Lifecycle control: Joiner, mover, and leaver processes create, modify, and promptly disable access as employment status changes.

B. Cloud Security Layers Illustration

Layered security applies independent but coordinated controls from physical facilities to business data.

Users and devices     → MFA, device posture, conditional access
Applications and APIs → Secure coding, WAF, API gateway, secrets management
Data                   → Classification, encryption, DLP, backups
Hosts and workloads    → Hardening, patching, EDR, image scanning
Virtual networks       → Segmentation, firewalls, private endpoints
Cloud control plane    → IAM, policy, audit logs, configuration monitoring
Physical infrastructure → Guards, access cards, cameras, redundant facilities

• Control-plane importance: A compromised management account can create resources, alter policies, or disable logging across many workloads.
• Cross-layer correlation: An unfamiliar login, firewall change, and large data download together indicate greater risk than any event alone.
• Resilience benefit: If phishing defeats a password, MFA, least privilege, network segmentation, and data encryption still restrict impact.

IV. Technical Protection Layers — Network, Host, and Data Controls

A. Cloud Network Security Concepts

Cloud network security controls traffic paths between users, services, workloads, and external networks.

• Segmentation: Virtual private clouds, subnets, route tables, and security groups separate public, application, and database tiers.
• Traffic filtering: Stateful firewalls track connections, while network ACLs commonly provide subnet-level filtering.
• Private connectivity: VPNs, dedicated circuits such as AWS Direct Connect, and private service endpoints reduce Internet exposure.
• Application protection: Web application firewalls block patterns associated with SQL injection and cross-site scripting; API gateways enforce authentication and quotas.
• DDoS mitigation: Anycast distribution, traffic scrubbing, rate limiting, CDNs, and autoscaling absorb or reject malicious volume.
• Zero-trust networking: Access is based on verified identity and context rather than merely belonging to an internal subnet.
• Detection: Flow logs, DNS logs, and intrusion-detection sensors reveal scanning, command-and-control traffic, and unusual data transfers.

B. Host Security Concepts

Host security protects virtual machines, containers, serverless runtimes, and their operating environments.

• Hardening: Disable unnecessary services, restrict administrative access, and apply benchmarks such as the CIS Benchmarks.
• Patch management: Inventory versions, prioritize exploitable vulnerabilities, test updates, and enforce remediation deadlines.
• Workload isolation: Hypervisors separate VMs; namespaces, cgroups, seccomp profiles, and non-root execution constrain containers.
• Image security: Use minimal trusted base images, scan them for known CVEs, sign artifacts, and reject unsigned deployments.
• Endpoint detection and response: EDR agents monitor processes, files, network connections, and persistence mechanisms.
• Immutable infrastructure: Replace compromised or outdated instances from a verified image instead of manually repairing them.
• Serverless responsibility: Providers patch the runtime infrastructure, but customers still secure functions, dependencies, permissions, and event inputs.

C. Data Security Concepts

Data security protects information throughout creation, processing, storage, transmission, archival, and deletion.

• Classification: Labels such as public, internal, confidential, and restricted determine handling and retention controls.
• Encryption in transit: TLS protects browser, API, and service-to-service communication.
• Encryption at rest: Storage encryption protects disks, databases, snapshots, and object stores using provider-managed or customer-managed keys.
• Key management: KMS and hardware security modules generate, protect, rotate, and audit cryptographic keys; keys should be separated from encrypted data.
• Data loss prevention: DLP identifies patterns such as payment-card or national-identity numbers and blocks unauthorized sharing.
• Tokenization and masking: Sensitive values are replaced or obscured in analytics and non-production environments.
• Recovery: Versioned, immutable, geographically separated backups reduce ransomware impact; restoration testing verifies usability.
• Deletion: Retention schedules, cryptographic erasure, and provider deletion procedures support secure end-of-life disposal.

V. Operations, Governance, and Service Quality

A. Security Operations and Major Cloud Service Provider Tools

Security operations continuously detect, investigate, contain, and recover from cloud threats.

• Operational cycle: Asset discovery and prevention precede detection, triage, containment, eradication, recovery, and post-incident improvement.
• AWS tools: CloudTrail records API activity; GuardDuty detects threats; Security Hub aggregates findings; Inspector assesses workloads; Macie discovers sensitive S3 data.
• Microsoft Azure tools: Azure Monitor collects telemetry; Microsoft Defender for Cloud provides posture and workload protection; Microsoft Sentinel supplies SIEM and automation.
• Google Cloud tools: Cloud Audit Logs record activity; Security Command Center centralizes posture and findings; Cloud Armor protects applications.
• Automation: Event-driven playbooks can quarantine an instance, revoke a token, preserve evidence, and notify responders.
• Evidence integrity: Logs should be centralized, time-synchronized, access-controlled, retained, and protected against alteration.

B. Security Compliance and Regulations

Compliance translates legal, contractual, and industry requirements into documented and testable cloud controls.

• GDPR: Governs processing of personal data involving people in the European Economic Area and emphasizes lawful processing, data-subject rights, and breach management.
• HIPAA: Protects specified health information in applicable US healthcare organizations and requires appropriate safeguards and agreements.
• PCI DSS: Establishes security requirements for environments that store, process, or transmit payment-card data.
• ISO/IEC 27001: Defines requirements for an information security management system based on managed risk.
• SOC reports: Independent assurance reports describe controls and testing relevant to service organizations.
• Data residency: Organizations may need to select regions and restrict replication to meet location or sovereignty obligations.
• Continuous compliance: Policy-as-code can flag unencrypted storage, missing tags, public endpoints, and prohibited regions.
• Scope warning: A provider’s certification does not automatically make every customer workload compliant; configuration and operating evidence remain essential.

C. Interoperability Challenges

Interoperability is the ability to move or integrate workloads, identities, data, and controls across providers without unacceptable redesign.

• Proprietary services: Provider-specific databases, event systems, IAM syntax, and monitoring formats make migration difficult.
• Identity differences: Roles, resource hierarchies, token claims, and policy evaluation vary across AWS, Azure, and Google Cloud.
• Data portability: Large datasets face incompatible schemas, egress fees, bandwidth limits, and lengthy transfer windows.
• Control inconsistency: Equivalent firewall or encryption features may expose different options and defaults.
• Mitigation: Containers, Kubernetes, OpenTelemetry, standard protocols, portable data formats, and Terraform-style infrastructure definitions reduce—but do not eliminate—lock-in.
• Trade-off: Maximum portability often sacrifices optimization available from a provider’s native managed services.

D. Monitoring and Performance Management

Monitoring and performance management maintain secure, reliable services by converting telemetry into operational decisions.

• Signals: Metrics measure values such as CPU percentage and request latency; logs record events; traces follow requests across microservices.
• Service indicators: Availability, error rate, throughput, and percentile latency such as p95 reveal user-visible behavior.
• Alert quality: Alerts should indicate actionable symptoms and use thresholds, anomaly detection, and deduplication to limit fatigue.
• Observability tools: Amazon CloudWatch, Azure Monitor, Google Cloud Operations, Prometheus, Grafana, and OpenTelemetry support collection and analysis.
• Performance actions: Autoscaling, caching, load balancing, database indexing, and capacity planning address detected bottlenecks.
• Security connection: Sudden outbound traffic, unusual API latency, or sharp error increases may indicate abuse or compromise.

VI. Emerging Cloud Security Directions

A. Future Trends and Innovations

Cloud security is moving toward automated, identity-centered, and cryptographically stronger protection.

• Confidential computing: Trusted execution environments protect data while it is being processed, complementing encryption at rest and in transit.
• Passwordless access: Passkeys and FIDO2 authenticators resist phishing better than reusable passwords.
• Policy as code: Version-controlled rules automatically evaluate infrastructure before deployment and during operation.
• Software supply-chain security: Signed artifacts, software bills of materials, provenance records, and admission policies verify what enters production.
• Post-quantum preparation: Cryptographic inventories and algorithm agility prepare systems to replace schemes threatened by quantum computing.
• Autonomous remediation: Cloud platforms increasingly correct drift, isolate suspicious workloads, and rotate exposed credentials automatically.

B. Edge computing and AI

Edge computing moves processing closer to devices, while AI improves detection and automation but introduces new assets and attack paths.

1. Edge computing:
   • Security challenge: Distributed gateways, sensors, and micro-data centers may operate in physically exposed or intermittently connected locations.
   • Controls: Secure boot, signed updates, hardware roots of trust, local encryption, remote attestation, and zero-trust access protect edge nodes.
   • Benefit: Local processing reduces latency and can limit transmission of raw sensitive data.
2. Artificial intelligence:
   • Defensive use: Models correlate large telemetry volumes, detect anomalous behavior, classify malware, and prioritize alerts.
   • AI-specific risks: Prompt injection, poisoned training data, model theft, adversarial inputs, and sensitive-data leakage require dedicated controls.
   • Governance: Model inventories, access restrictions, evaluation, human approval, and audit logs make AI-assisted security accountable.

• Combined direction: Edge AI enables rapid local decisions, but models and updates must be authenticated, monitored for drift, and centrally governed.