3.1 Cloud Infrastructure

Question 1

Cloud responsibility matrix

Answer 1

• IaaS, PaaS, SaaS, etc.– Who is responsible for security?
• Security should be well documented– Most cloud providers provide a matrix of responsibilities– Everyone knows up front.
• These responsibilities can vary– Different cloud providers– Contractual agreements– Responsibility matrix example

Question 2

Hybrid considerations

Answer 2

• Hybrid cloud– More than one public or private cloud– This adds additional complexity
• Network protection mismatches– Authentication across platforms– Firewall configurations– Server settings
• Different security monitoring– Logs are diverse and cloud-specific
• Data leakage– Data is shared across the public Internet

Question 3

Third-party vendors in the cloud

Answer 3

You, the cloud provider, and third parties
–Infrastructure technologies
–Cloud-based appliances
* Ongoing vendor risk assessments
–Part of an overall vendor risk management policy
* Include third-party impact for incident response
–Everyone is part of the process
* Constant monitoring
–Watch for changes and unusual activity

Question 4

Infrastructure as code

Answer 4

• Describe an infrastructure
  –Define servers, network, and applications as code
• Modify the infrastructure and create versions
  –The same way you version application code
• Use the description (code) to build other application
  instances
  –Build it the same way every time based on the code
• An important concept for cloud computing
  –Build a perfect version every time

Question 5

Serverless architecture

Answer 5

• Function as a Service (FaaS)
  –Apps are separated into individual, autonomous functions
  –Remove the operating system from the equation
• Developer still creates the server-side logic
  –Runs in a stateless compute container
• May be event triggered and ephemeral
  –May only run for one event
• Managed by a third-party
  –All OS security concerns are at the third-party

Question 6

Microservices and APIs

Answer 6

• Monolithic applications
  –One big application that does everything
• Application contains all decision making processes
  –User interface, business logic, data input and output
• Code challenges
  –Large codebase, change control challenges
• APIs - Application Programming Interfaces
• API is the “glue” for the microservices
  –Work together to act as the application
• Scalable - Scale just the microservices you need
• Resilient - Outages are contained
• Security and compliance - Containment is built-in