Cloud Infrastructures - CompTIA Security+ SY0-701 - 3.1

Understanding Cloud Security Responsibilities

Overview of Cloud Applications

• At this stage in cloud technology evolution, organizations likely have applications running in various cloud service models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).

Responsibility for Security

• The key question remains: who is responsible for security across different cloud systems? Public cloud providers typically offer a responsibility matrix to clarify these roles.

• Not all providers present the same matrix; variations may exist based on provider contracts that adjust default responsibilities.

Responsibility Matrix Breakdown

• The responsibility matrix categorizes responsibilities by service type: SaaS, PaaS, IaaS, and on-premises.

• Blue indicates customer-managed aspects.

• Yellow indicates provider-managed aspects.

• Overlaps indicate shared responsibilities.

Specific Responsibilities

• For operating systems:

• SaaS and PaaS are managed by the provider.

• IaaS and on-premises are customer responsibilities.

• Customers are always accountable for their account-related security measures.

Managing Hybrid Clouds

Complexity of Hybrid Cloud Environments

• Organizations often utilize multiple clouds from different providers, known as hybrid clouds. This setup offers flexibility but increases management complexity due to lack of direct communication between providers.

Configuration Challenges

• Manual configuration is often necessary across different providers, leading to potential mismatches in settings such as authentication or firewall configurations.

Log Management Difficulties

• Managing security logs can be challenging since each provider generates logs with unique formats and terminologies, complicating comprehensive monitoring.

Data Transfer Security

Protecting Data in Transit

• Data frequently transfers between cloud providers over the public internet; thus, ensuring robust security settings during transit is crucial.

Third-party Application Management

Vendor Risk Management Policies

• When using third-party applications or devices alongside your own cloud-hosted applications, implementing vendor risk management policies is essential for maintaining security.

Incident Response Coordination

• Incident response must include processes from both internal teams and third-party vendors to ensure comprehensive coverage during incidents.

Infrastructure as Code

Definition and Benefits

• Cloud infrastructures typically require infrastructure as code (IaC), which allows defining application instances or infrastructure components through code rather than hardware specifications.

Flexibility in Infrastructure Management

Understanding Serverless Architecture

Definition and Concept of Serverless Architecture

• Infrastructure as code allows for building application instances without traditional servers, leading to the concept of serverless architecture.

• In this model, applications are accessed through individual functions rather than a single application instance, with each function handling a specific task.

Functionality and Efficiency

• Each function can operate on any suitable operating system, focusing solely on information exchange for that function without concern for underlying systems.

• Developers break applications into smaller functions deployed in the cloud, running only when needed. This approach saves time and costs associated with public cloud infrastructure.

Real-Time Function Deployment

• Functions can be built in real-time within the cloud environment; unnecessary compute containers can be removed until required again.

• The majority of security measures related to serverless architecture are managed within the cloud itself.

Transition from Monolithic to Microservice Architectures

Limitations of Monolithic Applications

• Traditional monolithic applications require installation on local machines, where all functionalities run as a single executable file.

• Updating these large applications necessitates complex change control processes to install new versions on each device.

Advantages of Microservices and APIs

• Cloud environments enable microservice architectures using APIs (Application Programming Interfaces), allowing individual services to operate separately rather than as one large application.

• Clients interact with an API gateway that directs requests to appropriate microservices, enhancing scalability by deploying additional services based on demand.

Resilience and Security in Microservices

• The loss of one microservice does not affect the overall functionality of the application, promoting resilience.