Cloud Security

Cloud Platform Security

Cloud providers, both private and public, require a form of authentication to prove your identity and include authorization rules, such as IAM, to control what you may access. Additionally, some cloud providers may offer the ability to enable multifactor authentication (MFA) to further verify your identity. MFA is an extra step beyond a username and password. The term multifactor authentication stems from the idea that you will authenticate using different methods, namely something you know (a username and password) and either something you are (fingerprints or other biometric data) or something you have (a token or device). While private cloud providers may be able to handle biometrics as a part of your MFA configuration, most public cloud providers rely on a token or device that generates a special numeric personal identification number (PIN), which you must enter upon logging on. This token may be a keychain-like device called a key fob, or you may be able to use your mobile phone by using a virtual authenticator application that generates the PIN. In either case, this additional form of identification helps ensure that if your username and password are compromised, the attacker would still need to have access to your token or your biometrics to gain access to your account.

Humans can log in using usernames and passwords, but when an application needs to access resources within a cloud provider, it typically uses something known as a service account. These accounts are similar to regular user accounts, but they do not have passwords, and you cannot use the accounts to log in to the cloud provider’s administrative portal. The service accounts are authenticated using special strings of characters known as application programming interface (API) keys. If you have an application that requires special access to a service within the cloud provider, you could configure the application to authenticate using the service account and API key instead of hard coding a human’s username and password combination into the application.

Security would not be complete without the ability to audit the actions that users and services take throughout the course of their normal operation. Public cloud providers keep detailed audit logs of the actions taken within their system to help you account for changes and to discover any unauthorized use of privileged credentials. Typically, after you enable and configure the logging, the public cloud providers retain these audit logs for one year, though you may be able to export them and save them for a longer duration. Private cloud providers may or may not provide detailed audit logging. The level of audit logging in a private cloud is usually based on corporate governance policies and regulatory compliance requirements.

Diagram. Public, private, and hybrid cloud deployments.

Cloud Security Best Practices

Cloud security requires attention to detail in many areas like authentication, authorization, accountability, and protecting data using encryption and regular backups. The cloud deployment model (private, public, or hybrid cloud) can have an impact on the security measures you implement as well because the deployment model indicates who is ultimately responsible for the infrastructure of the cloud services.

Private Cloud

Private clouds are scalable, single-tenant clusters of computing, storage, and networking resources owned and maintained by a single company, typically (but not always) located within a data center belonging to that company. The owner of the equipment typically holds the final responsibility for all the hardware and most, if not all, of the physical data center security concerns.

Public Cloud

Public clouds are hosted by companies, such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), and tend to offer highly scalable, multi-tenant solutions in data centers placed around the world. Public cloud providers generally are responsible for the physical data center security and most of the physical hardware security concerns.

Hybrid Cloud

A hybrid cloud is the combination of services running in both public and private clouds. The security concerns typically fall along the lines of the owners of the equipment, much like in private and public clouds, with the addition of the data link between the public and private cloud networks, which may be maintained and secured by a third party.