Cloud Computing

Cloud computing delivers computing resources (servers, storage, applications) on demand over a network, paid for as they are used.

Characteristics

• On-demand self-service: users provision resources themselves, without asking the provider.
• Broad network access: services are reachable over the network from many kinds of device.
• Resource pooling: the provider serves many customers from shared hardware (multi-tenancy).
• Rapid elasticity: capacity grows and shrinks quickly with demand.
• Measured service: usage is metered and billed.

Service models

Deployment models

• Public cloud: shared infrastructure run by a provider for many customers.
• Private cloud: infrastructure dedicated to one organisation.
• Community cloud: shared by organisations with common needs, e.g. regulators or a sector.
• Hybrid cloud: a mix of public and private clouds connected together.
• Multi-cloud: services from several public cloud providers.

Shared responsibility model

The provider is responsible for security of the cloud: physical data centres, hardware, and the virtualisation layer. The customer is responsible for security in the cloud: their data, identities and access, configuration, and anything they deploy. The split shifts toward the provider from IaaS to SaaS, but the customer always owns their data and who can access it.

Virtualisation and containers

• Hypervisor: software that runs virtual machines; type 1 runs on bare metal, type 2 runs on a host operating system.
• Container: an isolated process sharing the host's kernel; lighter than a virtual machine (e.g. Docker).
• Orchestration: automated deployment and scaling of containers (e.g. Kubernetes).
• Container image: a packaged application and its dependencies; should come from trusted sources and be scanned for vulnerabilities.

Cloud threats

• Misconfiguration: the most common cause of cloud breaches, e.g. publicly readable storage buckets or overly broad permissions.
• Insecure interfaces and APIs: weak authentication or exposed management APIs.
• Account hijacking: stolen cloud credentials or keys used to take over resources.
• Data breach and data loss: exposure or deletion of data held in the cloud.
• Insider threat: misuse by employees of the customer or the provider.
• Abuse of cloud services: attackers using cloud resources for their own ends, such as cryptomining.
• Denial of service: disruption of availability, or runaway costs from automatic scaling.

Cloud security controls

• Identity and access management (IAM): least privilege, MFA, and no long-lived keys in code.
• Encryption: of data at rest and in transit, with careful key management.
• Logging and monitoring: cloud audit logs and alerts on unusual activity.
• Cloud security posture management (CSPM): tools that continuously check configurations against best practice.
• Cloud access security broker (CASB): enforces security policy between users and cloud services.
• Backups and redundancy: across availability zones or regions.
• Secure baselines: infrastructure defined as code and reviewed before deployment.