Prerequisite : Cloud Computing
Cloud computing is the on-demand delivery of computing services such as storage, databases, networking, and applications over the Internet on a pay-as-you-use basis.
- Provides scalable and flexible computing resources.
- Eliminates the need for heavy local infrastructure.
- Widely adopted by small, medium, and large organizations.
- Offers three service models: SaaS, PaaS, and IaaS.
Cloud Deployment Models
Cloud deployment models define how cloud infrastructure is owned, managed, and made available to users. There are 4 cloud deployment models:
- Public Cloud: Shared infrastructure available to the public.
- Private Cloud: Dedicated cloud for a single organization.
- Hybrid Cloud: Combination of public and private clouds.
- Community Cloud: Shared by organizations with similar requirements.
Security in Cloud Computing
Cloud security involves protecting cloud environments, data, and applications from unauthorized access, malware, DDoS attacks, and data breaches.
- Ensures both internal and external security.
- Protects sensitive organizational data.
- Essential due to increasing cloud adoption.
- Covers data, applications, networks, and access control.
Planning of Security in Cloud Computing
- Identify which resources can be moved to the cloud.
- Assess data sensitivity and security risks.
- Choose the appropriate cloud deployment model.
- Evaluate risks based on service and deployment models.
Types of Cloud Security Controls
Cloud security controls are mechanisms designed to protect cloud environments by preventing, detecting, and responding to security threats.
1. Deterrent Controls
Deterrent controls are security measures intended to discourage malicious activities by warning potential attackers of consequences.
- Act as a psychological barrier against attackers.
- Reduce the likelihood of intentional misuse.
- Commonly used to prevent insider threats.
- Examples include security policies, warning banners, and legal notices.
- Do not stop attacks directly but discourage them.
2. Preventive Controls
Preventive controls are security measures that block or reduce vulnerabilities to stop attacks before they happen.
- Actively prevent unauthorized access.
- Strengthen the security posture of cloud systems.
- Help eliminate known security weaknesses.
- Examples include authentication mechanisms, firewalls, encryption, and access control policies.
- Most important control type for proactive security.
3. Detective Controls
Detective controls are mechanisms used to identify and detect security incidents in real time or after they occur.
- Monitor cloud environments continuously.
- Detect unauthorized access and abnormal behavior.
- Help in early identification of security breaches.
- Examples include Intrusion Detection Systems (IDS), log monitoring, and security audits.
- Support incident response and forensic analysis.
4. Corrective Controls
Corrective controls are security measures used to minimize damage and restore systems after a security incident.
- Focus on recovery and damage control.
- Help return systems to a secure state.
- Reduce the impact of security breaches.
- Examples include backups, patch management, and disaster recovery plans.
- Work closely with detective controls to resolve incidents.
Cloud security controls work together to create a layered defense strategy. Deterrent and preventive controls reduce the chances of attacks, detective controls identify threats, and corrective controls ensure recovery and continuity.