Chapter 10 Cloud and Virtualization Security

Cloud Scalability and Elasticity

• Scalability allows cloud providers to adjust resources transparently, enhancing performance based on demand.
• Vertical scaling increases server capacity by adding CPU cores or memory, enabling quick resource upgrades.
• Horizontal scaling involves adding more servers to a cluster to manage increased user load, enhancing system capacity gradually.

Elasticity vs. Scalability

• Elasticity enables automatic adjustment of resources, allowing expansion during high demand and contraction when the demand reduces.
• Scalability focuses on increasing capacity quickly, while elasticity optimizes costs associated with resource usage.

Measured Service

• Cloud providers track user resource consumption (e.g., processing time, storage use, log entries).
• Charges are based on actual usage, ensuring customers only pay for what they use.

Agility and Flexibility

• Rapid provisioning of cloud resources grants organizations flexibility to meet short-term demands.
• Customers retain some control over data and access configurations, while providers manage operational and cybersecurity tasks.

Cybersecurity Responsibilities

• Clear documentation of cybersecurity responsibilities is crucial for compliance with regulations like PCI DSS.
• Cloud providers often have resources detailing controls for compliance with various standards.

Cloud Standards and Guidelines

• NIST’s Cloud Reference Architecture offers a comprehensive taxonomy for understanding cloud services and their roles.
• The Cloud Security Alliance (CSA) promotes best practices in cloud security and has developed the Cloud Controls Matrix to assist organizations.

Storage Types

• Block Storage: Allocates large volumes for virtual servers, functioning like physical drives. Example: AWS Elastic Block Storage (EBS). Customers pay for allocated capacity.
• Object Storage: Allows file storage in buckets, treating files as independent entities. Example: AWS Simple Storage Service (S3). Customers pay for actual storage used.

Cost Comparison

• Block storage costs are typically 3 to 10 times higher than object storage as block storage is preallocated.

Security Considerations for Cloud Storage

• Properly set permissions to prevent unauthorized access, especially in object storage where misconfigurations can lead to data exposure.
• API-based Cloud Access Security Brokers (CASBs) monitor but may have limitations in blocking policy violations upfront.

Resource Policies

• Cloud providers offer resource policies to limit user actions, enhancing security. For example, a JSON policy can restrict access to specific regions and instance types.
• Appropriate security controls should be maintained, considering permissions, encryption, and availability of cloud resources.

High Availability and Network Design

• Resilient cloud implementations should achieve high availability through design across multiple zones.
• Network segmentation is vital, using public and private subnets to enhance security.

Review Questions Context

• Example of vertical scaling: Adding a CPU in response to high traffic demands.
• Importance of maintaining security patches in environments utilizing a Type I hypervisor for IaaS.

Public Cloud

• Utilizes a multitenant model, meaning infrastructure is shared among multiple customers.
• Offers IaaS, PaaS, SaaS, and FaaS services.
• Resources are not dedicated to a single customer; they are generally available.
• Major providers include AWS, Microsoft Azure, and Google Cloud Platform (GCP).

Private Cloud

• Infrastructure is provisioned exclusively for a single customer.
• Can be built and managed internally or by a third-party provider.
• Often has unused capacity to handle peak demand, resulting in higher costs compared to public cloud.

Community Cloud

• Combines aspects of both public and private clouds.
• Shared infrastructure among a specific group with common interests (e.g., similar security needs, shared mission).
• Example: HathiTrust digital library, a consortium of academic research libraries.

Hybrid Cloud

• Integrates public, private, and/or community cloud services into a unified platform.
• Requires technology to seamlessly combine different cloud offerings.
• Enables capabilities like public cloud bursting (leveraging public cloud during peak demand).
• Offers a decentralized approach, reducing reliance on a single environment and minimizing single points of failure.

Edge Computing & IoT

• The Internet of Things (IoT) significantly alters computing provisioning and usage.
• IoT applications are prevalent in daily life (smart homes, vehicles) and industrial settings (manufacturing, agriculture, space).
• Remote sensors in areas with poor network connectivity pose challenges for traditional cloud computing.
• Transferring all sensor data to the cloud for processing is inefficient in these scenarios.
• Edge computing processes data closer to the sensor, reducing data transmission to the cloud.
• Edge computing involves placing processing power on sensors for data preprocessing.
• The term "edge" refers to the network's periphery where sensors are located.

Fog Computing

• Fog computing is similar to edge computing, but uses IoT gateway devices near the sensors.
• Sensors in fog computing might lack processing power; gateways handle preprocessing before cloud transmission.

Hypervisor Responsibility

• The primary function of a hypervisor is to ensure the isolation of virtual machines.
• This isolation provides each virtual machine with the impression of its own dedicated physical environment.
• Isolation prevents interference between virtual machines, ensuring operational independence.
• From a security perspective, isolation safeguards virtual machines from accessing or modifying resources allocated to other virtual machines.

Hypervisor Types

• There are two main categories of hypervisors: Type I and Type II.
• Type I hypervisors, also called bare-metal hypervisors, operate directly on the hardware.
• Type I hypervisors are highly efficient and widely used in data centers.
• Type II hypervisors run as applications on top of an existing operating system.
• Type II hypervisors are less efficient than Type I because the host operating system increases resource consumption.
• Type II hypervisors are commonly used for personal computer virtualization.

Cloud Storage Resources

• Infrastructure providers offer both storage coupled with their computing offerings and independent storage offerings.
• There are two main categories of cloud storage offerings: block storage and object storage.
• Block storage allocates large volumes of storage for use by virtual server instances.
• Block storage volumes are formatted as virtual disks by the operating system on server instances.
• Block storage is offered by AWS through their Elastic Block Storage (EBS) service.
• Object storage allows customers to store files in buckets, treating each file as an independent entity.
• Object storage files can be accessed over the web or through the provider's API.
• Object storage hides storage details from the end user.
• AWS Simple Storage Service (S3) is an example of object storage.
• Block storage is preallocated and you pay for the allocated capacity, regardless of data usage.
• Object storage is not preallocated and you pay for the storage you actually use.
• Block storage is more expensive than object storage.

Traditional Approach to Technology Teams

• Technology teams were organized into silos of expertise based on roles, isolating development and operations.
• Developers were responsible for creating software applications, while operations managed servers and infrastructure.
• This separation created a comfortable working environment but also led to disadvantages like reduced agility and increased overhead.

Disadvantages of Separated Development and Operations

• Isolating operations teams from development inhibited their understanding of business requirements.
• Isolating developers from operational considerations resulted in wasteful designs in terms of resource consumption.
• Hand-offs between development and operations slowed down agility and required lengthy transitions.
• Overhead associated with transitions encouraged infrequent releases, delaying requirement satisfaction.

DevOps Approach

• DevOps brings together development and operations teams in a unified, agile approach.
• It automates the testing and release process, allowing for frequent updates.
• The DevOps approach emphasizes collaboration and speed, leading to a faster pace of development and deployment.

Infrastructure as Code (IaC)

• IaC enables automating infrastructure provisioning, management, and deprovisioning using scripts instead of manual intervention.
• IaC is a key enabler of DevOps and a crucial advantage of cloud computing services integration.
• It is a feature of major IaaS environments like AWS, Azure, and GCP.
• IaC can be implemented through cloud service provider features or third-party cloud management platforms.

Cloud Provider APIs in DevOps

• Cloud providers offer APIs that allow developers to programmatically manage cloud resources.
• APIs are crucial for DevOps, particularly in environments embracing microservices.
• Microservices are designed to communicate with each other based on environmental events, facilitating automated interactions.

VM Escape Vulnerabilities

• A serious security risk in virtualized environments, especially when hosting systems with varying security levels.
• Attackers gain access to a virtual host and leverage it to compromise resources allocated to other virtual machines.
• The hypervisor is designed to restrict a VM's access to its assigned resources, but escape attacks allow processes to bypass these restrictions.

VM Sprawl

• Occurs when IaaS users create virtual service instances and then disregard or abandon them, leading to unnecessary costs and accumulating security risks.
• Organizations should monitor instance activity to prevent VM sprawl.

Resource Reuse

• Cloud providers may reassign hardware resources previously used by one customer to another.
• If data isn't adequately removed from the hardware before reassignment, new customers could unintentionally access data belonging to previous users.

Cloud Access Security Brokers (CASBs)

• Organizations commonly use multiple cloud service providers.
• Managing security across multiple service providers is challenging.
• CASBs act as intermediaries between users and cloud service providers.
• CASBs enforce security policies by monitoring user activity.

CASB Deployment Models

• Inline CASB:
  • Physically or logically reside in the network path between users and services.
  • Can monitor and block requests before they reach the cloud service.
  • Requires network or endpoint device configuration.
• API-based CASB:
  • Interact with cloud service providers through APIs.
  • Do not require user device configuration.
  • Monitor user activity and report on policy violations after they occur.
  • Cannot block request in real-time.