Domain 1: Cloud Computing Concepts and Architecture - Deployment Models, Security Architecture

Domain 1: Cloud Computing Concepts and Architecture - Deployment Models, Security Architecture

NIST:
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

Cloud is:
Transformative
Disruptive
Exponential growth
Agility (move fast)
Resiliency (reduce downtime)
Economy (save money)

Cloud User / Client
Cloud Provider

Concepts: Abstraction and Orchestration
Note: Traditional virtualization lacks orchestration

Multi tenancy

Service Models:
PAAS
SAAS
IAAS

Deployment Model
Public
Community
Private
Hybrid

Cloud Logical Model and security
Infrastructure → infrastructure security
Metastructure → management plane (not present in traditional on-prem env)
Infostructure → data security
Applistructure → application security

Cloud Reference Model:
Abstraction
Orchestration

API / REST
Cloud Management Plane

Extremely important to protect your management plane in terms of security

IAAS - Computer, Network, Storage
PAAS - Azure SQL, App Engine
SAAS - Microsoft 365, Azure AD

Types of Cloud Security Models:
Conceptual models or frameworks -CSA logical model
Controls models or frameworks - CSA CCM
Reference architectures - can be detailed
Design patterns are - reusable solutions

The CSA Enterprise Architecture
The CSA Cloud Controls Matrix
ISO/IEC FDIS 27017 Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services.

CSA - Areas of Critical Focus - 13 domains
Governance and Enterprise Risk Management
Legal Issues: Contracts and Electronic Discovery
Compliance and Audit Management
Information Governance
Management Plane and Business Continuity
Infrastructure Security
Virtualization and Containers
Incident Response, Notification and Remediation
Application Security
Data Security and Encryption
Identity, Entitlement, and Access Management
Security as a Service
Related Technologies

Recommendations:
Cloud providers: clearly document internal security controls and customer security features
Consensus Assessment Initiative Questionnaire (CAIQ) v3.1

Cloud users: build a responsibilities matrix to document responsible parties implementing various controls
Cloud Controls Matrix v4

[su-]

You are amazing I thing I found what I was looking for a long time 😃