Presenter: Cloud models. 2 2
These days cloud computing is such a buzzword 3 3
and everybody wants to migrate into the cloud. 4 4
If you're working as a cybersecurity analyst though, 5 5
you have to understand the vulnerabilities associated 6 6
with moving into the cloud 7 7
and that's what we're going to be focused on here. 8 8
Now, while there is great savings to be had 9 9
by moving to the cloud, 10 10
we have to make sure we understand those security risks. 11 11
But before we can dive into all those security risks, 12 12
we really have to talk 13 13
about the various cloud computing models that are used 14 14
within the organizations these days. 15 15
And as we do that, I will talk 16 16
about the different risks associated with each one. 17 17
These different models include things 18 18
like public clouds, private clouds, community clouds, 19 19
hybrid clouds, and multi-cloud setups. 20 20
Now, when I talk about a cloud deployment model 21 21
what do I really mean? 22 22
Well, when we talk about a cloud deployment model 23 23
we're talking about classifying the ownership 24 24
and the management of the cloud as one of these categories. 25 25
It's either public, private, community, or hybrid. 26 26
Now, when I talk about the ownership and management 27 27
it's who's responsible for what? 28 28
Because there is a trade off here. 29 29
When you move to the cloud, you don't own everything. 30 30
There's certain things you're going to be responsible for 31 31
as the consumer and certain things your cloud provider 32 32
is going to be responsible for. 33 33
Now these cloud deployment models 34 34
have various vulnerabilities 35 35
and threats associated with them 36 36
depending on which one you choose, as I mentioned before. 37 37
So let's go ahead and look at each of these. 38 38
First we have the public cloud. 39 39
Now, when we deal with the public cloud, we're dealing 40 40
with a service provider making resources available 41 41
to the end users over the internet. 42 42
Now, really, when we talk about a public cloud 43 43
we are talking about things that are being deployed 44 44
for shared use by multiple independent tenants. 45 45
And we talk about a tenant. 46 46
Just think about that as a customer. 47 47
It's somebody who is going to have access to those resources. 48 48
Now, let me give you a great example of this. 49 49
AWS. 50 50
AWS is a great example of a public cloud. 51 51
Anybody can go and buy services from AWS. 52 52
Now, when I buy services and I put up a virtual site on a VM, 53 53
inside one of these cloud centers, 54 54
I'm sitting on AWS's hardware. 55 55
And that hardware may not just have my servers 56 56
it may have your servers 57 57
and your company servers and your college's servers 58 58
and we're all sitting on one server. 59 59
Now, there are logical separations there 60 60
but we're all still sitting on the same server. 61 61
That's the idea when we start talking about public cloud 62 62
because we don't own the resources, they are public. 63 63
Anybody who pays for it can have access to it. 64 64
Now, AWS does a really good job with their public cloud 65 65
by making it available in lots of places. 66 66
Everywhere you see a blue dot, that's one 67 67
of the AWS regions. 68 68
Everywhere you see an orange dot, that's a future region 69 69
that's coming soon. 70 70
Now, these data servers are all in these different regions 71 71
so that way they can have higher redundancy 72 72
and availability. 73 73
So if I have my servers in the east coast 74 74
of the United States over in Virginia, that's one 75 75
of those blue dots. 76 76
But I might have the same set of servers over 77 77
in the west coast, over in Washington state 78 78
and I might have another one over in England. 79 79
And by having it in those three regions, 80 80
I can have them all talk to each other. 81 81
I can have them have data transfer back and forth 82 82
and being replicated between 'em. 83 83
That way if one of those three sites goes down, 84 84
the other two can carry the load from my customers. 85 85
This is one of the great things 86 86
about public clouds because you can have yourself 87 87
in lots of different places really, really quickly 88 88
and that gives you great redundancy and great availability. 89 89
Now, when we talk about these clouds though 90 90
we have to think about who owns what. 91 91
When we talk about this, think about public clouds this way, 92 92
you're going to have the infrastructure, 93 93
the application code, and the data that's being hosted 94 94
within these private instances. 95 95
But you have no ability to control the physical server. 96 96
I can't go to Amazon and say, Hey 97 97
I want to walk in and touch my server. 98 98
They're not going to let me do that. 99 99
I don't have physical access, but I do have logical access. 100 100
And so I might have this private instance 101 101
of my server inside this virtual thing sitting 102 102
on their bigger servers, their physical servers. 103 103
Now this brings up the question on who's responsible 104 104
for the security of a public cloud? 105 105
Well, this is kind of a hard question to answer, right? 106 106
Because we each have our own responsibilities. 107 107
If I'm the cloud service provider like Amazon, 108 108
I have the responsibility 109 109
for integrity and availability of the platform. 110 110
Now, what do I mean 111 111
by this integrity and availability of the platform? 112 112
Well, Amazon is responsible 113 113
for making sure the physical server stays up. 114 114
It has the right power, it has the right cooling, 115 115
it has the right bandwidth 116 116
and it has the right redundancy from a physical component. 117 117
So if they're going to store something there, 118 118
they should have it on a rate array, for instance. 119 119
So if one of the drives fails, the other one picks up 120 120
or if we put it on their storage area network, 121 121
they have it mirrored and backed up to make sure 122 122
that it's always up and ready to go. 123 123
That's the availability piece. 124 124
Now, the integrity piece is to make sure nobody messes 125 125
with my data, nobody changes it, modifies it. 126 126
When I write it there, it should stay there 127 127
and it shouldn't be modified by their underlying server. 128 128
Now, as the consumer though, 129 129
I have the responsibility to manage the confidentiality 130 130
of my systems as well 131 131
as the authorization and the authentication. 132 132
So if I'm using their service, 133 133
I'm going to be able to have access to the data 134 134
but I'm responsible to make sure 135 135
that data is properly stored 136 136
and the right people have access 137 137
to it by doing authorization authentication. 138 138
Now, the next area we want to talk about is private clouds. 139 139
Now, private clouds is where a company creates 140 140
its own cloud environment that only it can utilize 141 141
as an internal enterprise resource. 142 142
So what might this look like? 143 143
Well, let's say that I decide to go and buy my own servers. 144 144
I put them in three different locations around the world. 145 145
I now have multiple servers sitting in different locations 146 146
around the world, and I tie them all together. 147 147
That would be a private cloud. 148 148
Now, what's great about doing that? 149 149
Well, I have full control. 150 150
I control the hardware, I control the software. 151 151
I control the entire stack. 152 152
It's mine because it's private. 153 153
Now, a private cloud can be hosted both internally 154 154
or externally. 155 155
This is really up to you. 156 156
So I might take my physical server and put it 157 157
in somebody else's data farm, but again, I own it 158 158
and I have access to walk in and touch it anytime I want. 159 159
That's part of that agreement. 160 160
Or I can do it internally. 161 161
Maybe I have three corporate offices around the world 162 162
and I can put these servers in those three offices 163 163
and that way it would be hosted internally. 164 164
Either way is acceptable. 165 165
Let me give you a great example 166 166
of an externally hosted private cloud. 167 167
There is something in the United States 168 168
known as the AWS GovCloud. 169 169
And as you can guess, AWS means Amazon Web Services. 170 170
So what this is is the US government has given a contract 171 171
to Amazon to stand up their cloud for the government. 172 172
So these are servers that were bought 173 173
and paid for under contract for the US government. 174 174
Nobody else can use it, but the US government. 175 175
So if you work 176 176
for the Bureau of Indian Affairs, which is one 177 177
of our departments underneath the US government, 178 178
they can have access to the GovCloud. 179 179
If you work for the Department of Defense, 180 180
you work for the US government, 181 181
you can have access to the GovCloud. 182 182
If you work for Social Security Administration, 183 183
you can have access to the GovCloud. 184 184
But Dion Training, we don't work for the government. 185 185
We cannot have access to the GovCloud. 186 186
And so these are servers that were stood up 187 187
specifically for the use by the government. 188 188
So it is a private cloud in this case 189 189
it's a contracted private cloud and it's hosted externally. 190 190
Now, a private cloud should be chosen when you have security 191 191
as your main concern. 192 192
If you want more security and you're not worried about cost, 193 193
you can move to a private cloud. 194 194
That's what the GovCloud is. 195 195
They wanted to have more security 196 196
than just having regular old AWS. 197 197
So they have their own servers that are hosted 198 198
by AWS and only used by the government. 199 199
That way there can't be co-mingling of data. 200 200
This is what we consider a single tenant model. 201 201
When you're talking about private clouds, think about this. 202 202
It is a single tenant model, 203 203
one company or one organization being able to use it. 204 204
In the case of GovCloud, 205 205
it is multiple smaller organizations, 206 206
but all of those organizations 207 207
are owned by the US government. 208 208
So it is still one organization, the US government. 209 209
Now, as I said, 210 210
one of the drawbacks to using a private cloud 211 211
is private clouds are much more expensive. 212 212
Why? 213 213
Because you have to pay for all the hardware 214 214
and you're paying for the entire use of the server 215 215
whether or not you're using the entire use of the server. 216 216
Now, what do I mean by that? 217 217
Well, let's say I bought a bunch of servers 218 218
for this GovCloud, and I'm only using 50% of the capacity. 219 219
Well, guess what? 220 220
I paid for 100% capacity. 221 221
'Cause I bought the hardware, 222 222
I bought the software, I bought the licenses. 223 223
And whether I'm using it or not, 224 224
I'm paying for the whole thing. 225 225
So it's more expensive. 226 226
Now, if I was using a public cloud, I'd only pay 227 227
for what I'm using because Amazon bought all the servers, 228 228
they bought all the hardware, they bought all the software 229 229
and they pay for all the infrastructure. 230 230
And so I'm only paying on a per usage basis 231 231
under a public cloud model. 232 232
And so when you use a private cloud, 233 233
think it's going to cost more. 234 234
Again, security is more important than money here. 235 235
That's when we go to a private cloud. 236 236
So as a private cloud administrator, 237 237
what is your responsibility? 238 238
Well, if you're a private cloud administrator 239 239
you have to consider the data protection, the compliance 240 240
and the patch management. 241 241
Why? 242 242
Because you own the servers, you own the infrastructure. 243 243
All you get is bare metal here, 244 244
and you have to do everything yourself 245 245
because you're running your own cloud. 246 246
And so this is one of the reasons that it costs more 247 247
as well, because you have to pay people to do all 248 248
of this work, and it's going to have a lot more oversight 249 249
in terms of the things you have to do 250 250
from a security standpoint. 251 251
Now, another type of cloud we have is what's known 252 252
as the community cloud. 253 253
Now, a community cloud uses resources 254 254
and costs that are shared among 255 255
several different organizations who have 256 256
a common service need. 257 257
Let's say that I ran a credit union or a bank 258 258
and you ran a credit union or a bank. 259 259
We both want to set up some kind of a cloud service 260 260
to store our records to make sure they're secure 261 261
and we can have them for all of our regulatory requirements 262 262
say four or five or 10 years. 263 263
Well, we need a cloud to do that. 264 264
Do we want to put on AWS 265 265
or Azure and put on the public cloud? 266 266
Probably not. 267 267
Do we want to set our own private cloud each 268 268
because it'd be really expensive, probably not. 269 269
So we might get other banks to work with us and we get four 270 270
or five or six or 10 banks, and we all form a community. 271 271
We can share the cost of setting this thing up. 272 272
Now, a community cloud is deployed using what 273 273
we call a shared use by cooperating tenants. 274 274
What this means is there's five 275 275
or 10 different organizations and we all come together. 276 276
We share the cost, we share the responsibility, 277 277
we share the security. 278 278
So we're a community. We all work together. 279 279
Now, there's some good things 280 280
about this and bad things about it. 281 281
When everybody in the community helps 282 282
with designing the cloud, 283 283
we can have really good security or really bad security. 284 284
It depends on who's in it. 285 285
Now, when we take the security together and we all work 286 286
as a community, say that I had really high security needs 287 287
and you had low security needs, 288 288
do you want to pay for my high security needs? 289 289
Probably not. 290 290
And so we're going to have to have a discussion 291 291
and we're going to have to negotiate what those 292 292
security needs are going to be. 293 293
And maybe I had a security need of 10, 294 294
you had a security need of two 295 295
and we meet in the middle at say six. 296 296
Well, if we do that, we have now met the common denominator 297 297
which means I brought my level of security down 298 298
which is bad for me, and you brought yours up 299 299
and now paid more for security you really didn't care about. 300 300
And so these are some of the things 301 301
in the design considerations that you have to think 302 302
about when you're working 303 303
with the community cloud deployment. 304 304
Now, community clouds are secure when the organizations 305 305
involved have strong, interoperability agreements. 306 306
Remember, we're all connecting to the same cloud 307 307
because it's a community. 308 308
And so again, going back to my bank example. 309 309
If my bank is known as being the most secure out there 310 310
and we're a level 10 311 311
and you're a level two and you connect your network 312 312
to our new community cloud with your level two security 313 313
and I connect my level 10 to this cloud 314 314
and now I'm connected, what to you through that cloud? 315 315
And so your level two people can break in 316 316
through your network and get into our cloud that way 317 317
and then go from that cloud into my network. 318 318
And so these IOP operations are important to think about. 319 319
And when you have interoperability agreements 320 320
you need to make sure you have the right security 321 321
in place so everybody's meeting a baseline level 322 322
of security that you all can live with. 323 323
Now, the next thing we're going to talk about is what's known 324 324
as a hybrid cloud. 325 325
Now, a hybrid cloud is going to combine different types 326 326
of clouds like public, private and community clouds, 327 327
as well as on-premise infrastructure 328 328
to meet an organization's needs. 329 329
Sometimes just one of these clouds isn't enough. 330 330
I might not want to use all of my systems as a public cloud 331 331
because I'm worried about security of certain systems. 332 332
I might not want to use a private cloud for everything 333 333
because it costs too much. 334 334
So I can combine those two together. 335 335
I can say maybe that all my credit card and financial data 336 336
will be kept in a private cloud, but all of my customer 337 337
facing stuff that is supposed to be open to the public, 338 338
will be on the public cloud. 339 339
And so I can mitigate my risk 340 340
and mitigate my cost by doing this hybrid approach. 341 341
Now, what are some of the things you have to consider 342 342
when dealing with a hybrid cloud? 343 343
Well, they have greater complexity. 344 344
Hybrid clouds have to deal with the scripted infrastructure 345 345
and orchestration tools to be able to spin the instances 346 346
up and tear instances down and make sure 347 347
that all the connection between them are working. 348 348
So if I'm going to have to operate both a private 349 349
and a public cloud and I have to connect them together, 350 350
that's more complex than just doing one or the other. 351 351
Another thing you need to think 352 352
about when you're dealing with public 353 353
and private clouds is do you have the right data redundancy? 354 354
You want to make sure you don't have an absence 355 355
of data redundancy. 356 356
Now, what I mean 357 357
by this is sometimes people will have a hybrid environment 358 358
and they'll go, well, I'm already paying 359 359
for public and I'm already paying for private 360 360
so I must have redundancy. 361 361
But the public 362 362
and private are doing two different functions, 363 363
so there really is no redundancy there. 364 364
So you might have to have a private cloud 365 365
with full redundancy and a public cloud with full redundancy 366 366
in addition to the connection between the two. 367 367
So keep that in mind as well. 368 368
Another thing that makes it a little bit more 369 369
difficult when you're dealing with hybrids 370 370
is to demonstrate your compliance. 371 371
If you're at a highly litigious area 372 372
and you have regulations and compliance requirements, 373 373
moving to a hybrid model can make it harder 374 374
for you to meet those 375 375
because now you're not just dealing with the public cloud, 376 376
you're not just dealing with the private cloud, 377 377
but you're dealing with both 378 378
and the interconnection between the two. 379 379
So again, having that greater complexity makes it harder 380 380
for you to demonstrate compliance. 381 381
And finally, security management. 382 382
Now again, you're not just doing private, 383 383
you're not just doing public, you're doing both. 384 384
And so you have security management concerns. 385 385
You need to make sure you have the right authentication 386 386
and authorization and identity management to work 387 387
in both the private and the public cloud. 388 388
You also need to make sure there's replication 389 389
between the two of your security infrastructure. 390 390
You need to make sure you have communications 391 391
between the two 392 392
and those are secure and properly channeled. 393 393
All of these are things you have to think 394 394
about when you're dealing with a hybrid model. 395 395
The last thing we want to talk 396 396
about here is what's known as multi-cloud. 397 397
Now, multi-cloud is just like a sounds. 398 398
It's a cloud deployment where the cloud consumer 399 399
is going to use multiple public cloud services. 400 400
So if I have an organization 401 401
and I'm using lots of different things, for instance 402 402
I might be using Amazon Web Services to host my website. 403 403
I'm using Slack for communication. 404 404
I'm using Zoom for live meetings. 405 405
I'm using Google's G-suite for me to able to do my docs 406 406
and my sheets and my Google Drive, 407 407
and maybe some of my employees 408 408
are also using Microsoft 365 or Word and Excel 409 409
and PowerPoint. 410 410
All of these are cloud tools. 411 411
They're all public cloud tools. 412 412
Now, if I'm using all of these, 413 413
this puts me into what's known as a multi-cloud environment 414 414
because we're using lots of different tools 415 415
in lots of different ways. 416 416
Anytime you start adding more tools 417 417
and you start adding more clouds, 418 418
you are dealing with more complexity. 419 419
And so using multiple cloud service providers 420 420
does require additional due diligence 421 421
and risk assessment effort 422 422
because you have to think what is the risk involved. 423 423
For instance, when the global pandemic with COVID happened, 424 424
lots of people moved on to using Zoom. 425 425
They didn't think about the fact that Zoom 426 426
at the time did not have end-to-end encryption. 427 427
So you could be having a conference and somebody 428 428
could actually be listening to what you're saying 429 429
or they could actually jump into your Zoom call 430 430
because they weren't password protected. 431 431
These are all things you have to think about 432 432
from a risk assessment effort. 433 433
Now, as you're going through and doing this 434 434
because you have multiple tools, 435 435
this is going to become more complicated 436 436
and more time consuming. 437 437
Now, that was a ton of information. 438 438
So let me give you a quick exam tip. 439 439
For the exam, what do you need to know? 440 440
You need to know the five different types 441 441
of clouds that we talked about, 442 442
public, private, community, hybrid, and multi-cloud. 443 443
You need to know what the benefits and the drawbacks are 444 444
for each of them in terms of security and cost. 445 445
And you should understand when you should use each one. 446 446
Or if I give you an example of one, 447 447
you should be able to say based on that example 448 448
this sounds like a, blank, type of cloud. 449 449
For instance, if I say 450 450
that your company is using Amazon Web Services 451 451
to be able to host your infrastructure 452 452
is that public or private? 453 453
That would be public because anyone can sign up for AWS. 454 454
If you're using Microsoft Azure or Google Cloud 455 455
that again is public. 456 456
If you decide to set up your own cloud, 457 457
that would be private. 458 458
These are the kind of things you have to be able to answer 459 459
and also when each one would be appropriate, 460 460
more security lean towards private, 461 461
more openness and lower cost, more towards public. 462 462
These are the kind 463 463
of things you need to understand for the exam.