D320 - Managing Cloud Security Study Notes

Cloud Service Models
- Infrastructure as a Service (IaaS): The customer has the most control over resources, including operating systems and storage.
- Platform as a Service (PaaS): Provides a framework for developers to build and deploy applications without managing underlying infrastructure.
- Software as a Service (SaaS): The provider manages everything; the customer has the least amount of responsibility and control.
Cloud Deployment Models
- Public: Owned and operated by a cloud provider for use by the general public.
- Private: Provisioned for exclusive use by a single organization.
- Hybrid: A combination of two or more distinct cloud infrastructures (Private, Community, or Public).
- Community: Shared ownership among an affinity group with shared concerns (e.g., colleges, government agencies).
Virtualization and Hypervisors
- Type 1 Hypervisor: Also known as "Bare-metal"; runs directly on hardware for mission-specific security and efficiency.
- Type 2 Hypervisor: Runs on top of a host operating system and is dependent on that OS for security.
- VM Escape: An attack where a guest virtual machine penetrates the hypervisor to gain access to the host or other VMs.
- Orchestration: The process of automatically provisioning, configuring, and managing virtual machines and resources.

Cloud Data Life Cycle Phases
1. Create: Data is generated or imported. Data labeling and classification first occur here.
2. Store: Data is committed to storage. Encryption should be applied.
3. Use: Data is processed. This is the hardest phase to secure without technologies like Homomorphic Encryption.
4. Share: Data leaves the original system. Rights management (IRM/DRM) is essential.
5. Archive: Long-term storage for regulatory or business needs. Format and recoverability must be tested.
6. Destroy: Secure removal. Crypto-shredding (destroying keys) is the preferred method for cloud environments.
Data Storage Types
- Volume Storage: Associated with IaaS; includes block-level storage like LUNs.
- Object Storage: Associated with PaaS/SaaS; uses a key-value structure for unstructured data like multimedia.
- Ephemeral Storage: Temporary storage allocated to a VM instance that is lost once the instance is stopped or deleted.
Obfuscation Techniques
- Masking: Replacing sensitive data with opaque characters (e.g., asterisks for credit card numbers).
- Tokenization: Replacing sensitive data with a non-sensitive equivalent (token) that maps back via a secure database.
- Anonymization: Removing identifiers to prevent the identification of specific individuals in a data set.
- Hashing: A one-way mathematical function used to ensure data integrity or securely store passwords.

Risk Management Strategies
- Avoidance: Eliminating the risk by stopping the activity causing it.
- Mitigation: Implementing controls to reduce the impact or probability of a risk.
- Transference: Shifting the risk to a third party, such as an insurance company or cloud provider.
- Acceptance: Continuing operations as normal while being aware of the risk.
Quantitative Risk Assessment Formulas
- Single Loss Expectancy (SLE): $SLE = AV \times EF$
- Annualized Loss Expectancy (ALE): $ALE = SLE \times ARO$
- Asset Value (AV): The value of the resource.
- Exposure Factor (EF): The percentage of loss a threat would cause to the asset.
- Annualized Rate of Occurrence (ARO): How often the threat is expected to occur in a year.
Regulatory Frameworks
- General Data Protection Regulation (GDPR): EU privacy law mandating notice and opt-in consent for personal data processing.
- Health Insurance Portability and Accountability Act (HIPAA): US law protecting healthcare data (PHI).
- Sarbanes-Oxley Act (SOX): US law regulating accounting and financial practices to protect shareholders.
- Gramm-Leach-Bliley Act (GLBA): US law governing how financial institutions handle private personal information.
- Payment Card Industry Data Security Standard (PCI DSS): Global standard for vendors accepting credit card payments.
- CLOUD Act: US law requiring federal officials be provided data even if stored overseas.

Uptime Institute Data Center Tiers
- Tier 1: Single path for power/cooling; no redundancy.
- Tier 4: Multiple isolated systems; fault-tolerant; most resilient.
ASHRAE Environmental Standards
- Temperature: $64.4 - 80.6^{\circ}\text{F}$ ( $18 - 27^{\circ}\text{C}$ ).
- Humidity: $40 - 60\%$ relative humidity to prevent static discharge or condensation.
BC/DR Recovery Metrics
- Recovery Time Objective (RTO): The maximum amount of time allowed to recover operations after a failure.
- Recovery Point Objective (RPO): The maximum amount of data (measured in time) an organization can afford to lose.
- Recovery Service Level (RSL): The percentage of production capability required during a disaster situation.

SOC Reports (Service Organization Control)
- SOC 1: Focused on financial reporting controls.
- SOC 2: Focused on Security, Availability, Processing Integrity, Confidentiality, and Privacy.
  - Type 1: Report on the design of controls at a specific point in time.
  - Type 2: Report on the operational effectiveness of controls over a period (minimum six months).
- SOC 3: General use report; provides a high-level summary for public release.

STRIDE Threat Model
- S: Spoofing
- T: Tampering
- R: Repudiation
- I: Information Disclosure
- D: Denial of Service
- E: Elevation of Privilege
Testing Methodologies
- SAST (Static Application Security Testing): Analysis of source code or binaries without executing them (white-box).
- DAST (Dynamic Application Security Testing): Testing the application in its running state (black-box).
- IAST (Interactive Application Security Testing): Combines aspects of SAST and DAST during the testing phase.