Cloud Computing - Cloud Security

Cybersecurity

The practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage.

Confidentiality, Integrity, and Availability

The three core principles of cybersecurity; CIA Triad.

Confidentiality

Ensuring information is only accessible to authorized individuals.

Integrity

Guaranteeing that data cannot be modified or deleted without proper authorization.

Availability

Ensuring that systems and data are accessible and usable when needed, even after disruptions.

Principle of Least Privilege

Users and systems should only have the minimum access rights necessary to perform their tasks.

Default Deny Principle

Anything not explicitly allowed is automatically prohibited.

IP Address

A unique identifier for a machine or instance on a network, typically written in dotted quad notation (e.g., 192.168.1.1).

Private IP Ranges

Non-routable IP ranges used within private networks — 10.0.0.0/8 (large), 172.16.0.0/12 (medium), 192.168.0.0/16 (small).

TCP/IP

Transmission Control Protocol/Internet Protocol; the foundational communication protocol for the internet.

Port Number

A numerical identifier that directs traffic to the correct service or application on a device.

Well-Known Ports

Ports 0–1,023 reserved for core services (e.g., HTTP, FTP, SSH).

Registered Ports

Ports 1,024–49,151 assigned to user or application processes.

Dynamic Ports

Ports 49,152–65,535 used for private or temporary connections.

Risk

The combination of a vulnerability and a corresponding threat.

Risk Assessment

The process of identifying and prioritizing risks based on likelihood and impact.

Likelihood

The probability that a risk will materialize.

Impact

The potential effect if a risk materializes.

Risk Avoidance

Eliminating risk by changing practices (e.g., relocating a data center away from a flood zone).

Risk Transference

Shifting risk to another party (e.g., buying insurance).

Risk Mitigation

Reducing the likelihood or impact of a risk (e.g., flood barriers).

Risk Acceptance

Acknowledging and accepting the risk without further action.

Firewall

A security system that monitors and controls incoming/outgoing network traffic based on rules.

Firewall Rule

Defines action (allow/deny), source, destination, port, and protocol for network traffic.

Implicit Deny Principle

Any traffic not explicitly permitted by firewall rules is blocked.

Security Groups

Virtual firewalls in cloud environments (e.g., AWS EC2) used to control traffic.

DMZ (Demilitarized Zone)

A subnetwork that exposes external-facing services (e.g., web servers) to untrusted networks like the internet.

Port Scanning

Technique used to discover open ports and services on a system.

Vulnerability

A flaw in code, system, or process that can be exploited.

Patch

A fix released by vendors to remediate vulnerabilities.

Window of Exposure

The time between when a vulnerability is discovered and when it is patched.

Vulnerability Scanning

Automated probing of systems for known weaknesses.

Backups

Copies of data used to restore availability after disruptions.

Snapshots

User-controlled backup mechanism in services like AWS EC2.

Identity and Access Management (IAM)

Processes that manage identification, authentication, and authorization for system access.

Identification

The act of claiming an identity (e.g., entering a username).

Authentication

Verifying an identity using credentials (e.g., password, biometrics).

Authorization

Granting permissions to access specific services/resources after authentication.

Authentication Factors

Categories of proof used to verify identity — something you know, are, or have.

Something You Know

Knowledge-based authentication such as a password or PIN.

Something You Are

Biometric authentication such as fingerprints, eye scans, or facial recognition.

Something You Have

A physical item like a smartphone, smart card, or key fob used for authentication.

Multifactor Authentication

Combining two or more authentication factors from different categories (e.g., password + fingerprint).