The goal of the Cloud Data Security domain is to inform you of the types of controls necessary to administer various levels of availability, integrity, and confidentiality (AIC) to secure data in the cloud.
You will gain knowledge on topics of data discovery and classification techniques; digital rights management; privacy of data; data retention, deletion, and archiving; data event logging, chain of custody and nonrepudiation; and the strategic use of security information and event management.
After completing this domain, you will be able to do the following:
Data security is a core element of cloud security (Figure 2.1). Cloud service providers (CSPs) often share the responsibility for security with the customer.
Roles such as the chief information security officer (CISO), chief security officer (CSO), chief technology officer (CTO), enterprise architect, and network administrator may all play a part in providing elements of a security solution for the enterprise.
The data security lifecycle, as introduced by the Securosis Blog and then incorporated into the CSA guidance, enables the organization to map the different phases in the data lifecycle against the required controls that are relevant to each phase.1
The lifecycle contains the following steps:
Not all implementations or situations align fully or comprehensively
Any element of technology will contain vulnerabilities, mobile or otherwise. Of course, there is no indication as to how many vulnerabilities each will likely have; however, one very rudimentary method of determining the number of likely vulnerabilities is based on the number of lines of code. In other words, the more the number of lines …
Data Leaking through poorly written applications is day to day biggest concern but threat level is medium. So How many apps do you have on your mobile device? If you can answer that question, then congratulations; that is impressive, but can you confirm what data these apps collect, and more importantly what they do with …
How Data Leaking through Poorly Written Applications? Read More »
There are no ways to prevent malware attacks but there are reliable ways to detect and block attacks, thus protecting your systems from being infected by malicious software. The below mention graphs depict the growth in mobile malware. New Mobile malware While the numbers vary on the exact scale of the issue, what the two …
Data Loss from Lost, Stolen Devices is a particular issue that is exuberated by how users use such devices. According to a survey of 4 of 3000 consumers conducted by McAfee in early 2021, it was found that a third of consumers surveyed fail to protect their mobile, tablet with a personal identification number. In …
A malicious insider threat to an organization is a current or former employee, contractor, or other business partners who has or had authorized access to an organization’s network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization’s information or information …
A Denial of Service (DOS) or its now more popular unruly child the DDoS attack is not a new phenomenon and has plagued information technology (IT) managers for many years. It refers to an attack that aims to overwhelm the victim with network traffic or consume resources (central processing unit, memory, for example) and subsequently …
Insecure Interfaces and APIs APIs within cloud environments are used to offer end-customers software interfaces to interact with their provisioned services. There are multitudes of APIs available within a cloud environment; these can include provisioning new hardware and monitoring the cloud services, as just two examples. According to API Management Company, Mashery, there exist three …
Cited as the number one security threat for cloud computing, data breaches refer to the loss of confidentiality for data stored within a particular cloud instance. It is of course worth noting that such a threat is likely to exist even within an on-premise solution, or traditional outsourced solution. The concern over the loss of …
Cloud data protection Frameworks: Globally, a plethora of laws, regulations and other legal requirements for organizations and entities exist to protect the security and privacy of digital and other information assets. Organization for Economic Cooperation and Development—Privacy and Security Guidelines On September 9, 2013, the Organization for Economic Cooperation and Development (OECD) published a set …
Understanding the Collection and Preservation of Digital Evidence. Forensic science is generally defined as the application of science to the law. Digital forensics, also known as computer and network forensics, has many definitions. Generally, it is considered the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of …
The following list of Legal issues in cloud is a general guide designed to help you focus on some of the areas and legislative items that might impact your cloud environments: Legal issues in cloud computing are comes under the international law, International law is the term given to the rules that govern relations between …
Cloud Application Architecture It is important that we examine the mechanisms behind the scenes that make application security and software development for the cloud work, as well as the weaknesses and vulnerabilities associated with each. The readers need to understand how to evaluate and discover these for the customer. Application programming interfaces (APIs) are the …
The organization also needs to protect Data Processing mechanism as well as Data Control in life-cycle phases other than Create. Industry standards and best practices require the creation, use, and enforcement of a host of data management policies and practices, including the areas of data retention, audit, and disposal. In this section Data Control in …
The need for the use of Cloud encryption, cryptography and encryption is universal for the provisioning and protection of confidentiality services in the enterprise. In support of that goal, the Cloud encryption blog should ensure that he understands how to deploy and use cryptography services in a cloud environment. In addition, it’s important to integrate …
Cloud identity and access management is about the people, processes, and procedures used to create, manage, and destroy identities of all kinds, Whether you are dealing with system administrators or plain users of cloud services, the creation and management of identities are key in maintaining secure operations. IAM systems consist of several components, as shown …
Multi factor authentication schema such as the use of robust tokens and requiring multi-factor authentication can reduce the likelihood of unauthorized users gaining access, and restricting authorized users to permitted activities. Cloud Multi factor authentication has become more popular and widespread in the last five years due to increased demand for better authorization security and …
Developers often face challenges when working in a new and unfamiliar environment. that’s why the organization faces challenges with cloud application security. For instance, they may be used to working in a certain language or framework that may not be available to them on a particular platform. There is also a serious lack of documentation …
An ISMS (Internal Information Security Controls System) should exist to reduce risks related to the AIC of information and assets, while looking to strengthen the stakeholder confidence in the security posture of their organization in protecting such assets. Although these systems may well vary in terms of comprehensiveness, along with how the controls are applied, …
You must take care when gathering, handling, transporting, analyzing, reporting on, and managing evidence that the proper chain of custody or chain of evidence has been maintained. Every jurisdiction has its definitions as to what this may mean in detail; however, in general, a chain of custody and chain of evidence Why need Chain of …
cloud Computing Network Security controls was discussed extensively earlier in this blog. You need to be able to follow and implement best practices for all security controls. About cloud Computing Network Security , consider the following general guidelines: Defense in depth VLANs Access controls Secure protocol usage (that is, IPSec and TLS) IDS/IPS system deployments …
In partnership with the cloud security management professionals, you need to have a detailed understanding of the management operation of the cloud environment. As complex networked systems, clouds face the traditional computer and network security issues such as AIC. By imposing uniform management practices, clouds may be able to improve on some security updates and …
Host Configuration data in the cloud environment should be part of the backup plan. You should conduct routine tests and restore hosts as part of the disaster recovery plan (DRP) to validate the proper functioning of the backup system. This thought process is the same regardless of the vendor equipment being used to supply hosts …
Performance monitoring is essential for the secure and reliable operation of a cloud environment. Data on the performance of the underlying components may provide early indications of hardware failure Traditionally, four key subsystems are recommended for monitoring in cloud environments: Network: Excessive dropped packets Disk: Full disk or slow reads and writes to the disks …
Patch management is a crucial task. All organizations must perform and Regularly patch OSs, middleware, and applications to guard against newly found vulnerabilities or to provide additional functionality. Patch management is the process of identifying, acquiring, installing, and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware. From …
Big like Google Cloud Physical Infrastructure is more powerful but doesn’t matter the blue print is same for Mid-to-large corporations and government entities, independent system vendors (ISVs), and service providers use cloud infrastructure to build private and public clouds and deliver cloud computing services. Virtualization provides the foundation for cloud computing, enabling rapid deployment of …
Google Data center design, planning, and architecture have long formed an integral part of the information technology (IT) services for providers of computing services. Over time, these have typically evolved and grown in line with computing developments and enhanced capabilities. Google Data center continue to be refined, enhanced, and improved upon globally; however, they still …
Cloud Security Threats is nothing but to secure a server, it is essential to first define the threats that must be mitigated. Organizations should conduct risk assessments to identify the specific threats against their servers and determine the effectiveness of existing security controls in counteracting the threats. They then should perform risk mitigation to decide …
Cloud network security is top end technology today we all using in the Data Center. When it comes to securing the network configuration, there is a lot to be concerned with. Several technologies, protocols, and services are necessary to ensure a secure and reliable network is provided to the end-user of the cloud-based services. Transport …
The creation and implementation of a fully tested BCDR Planning that is ready for the failover event have a great structural resemblance to any other IT implementation plan as well as other disaster response plans. It is wise to consult or even adapt existing IT project BCDR Planning and risk management methodologies. In this section, …
Business Continuity and Disaster Recovery (BCDR) Planning for IT Professionals Read More »
Best practices for cloud security are crucial to build the robust environment that prevent upcoming vulnerability/ Attacks. The actual settings for the hardware depending on the chosen operating system (OS) and virtualization platform. Servers Best practices for cloud security Implement the following best practice recommendations to secure host servers within cloud environments: Secure build: To …
Security testing of web applications through the use of testing software is generally broken into two distinct types of automated testing tools. This section looks at these tools and discusses the importance of penetration testing, which generally includes the use of human expertise and automated tools. The section also looks at secure code reviews and …
There are several characteristics of the cloud environment that you need to consider for your BCDR plan. They represent opportunities as well as challenges. First, though, it pays to have a more detailed look at some different scenarios in which you might want to consider BCDR. The following sections discuss these scenarios, BCDR planning factors, …
The Secure software development life cycle in cloud computing is one of the most interesting concept. Although some view a single point-in-time vulnerability scan as an indicator of trustworthiness, much more important is a holistic evaluation of the people, processes, and technology that delivered the software and will continue to maintain it. Several software development …
Secure software development life cycle in cloud computing Read More »
Cloud Threat Modeling is performed once an application design is created. The goal of Cloud Threat Modeling is to determine any weaknesses in the application and the potential ingress, egress, and actors involved before the weakness is introduced to production. It is the overall attack surface that is amplified by the cloud, and the threat …
The cloud further heightens the need for applications to go through a software development lifecycle process Following are the phases in all software development lifecycle process models: Business and security requirements and standards are being determined. This phase is the main focus of the project managers and stakeholders. Meetings with managers, stakeholders, and users are …
Cloud Security risks its an main concept whether run in the platform as a service (PaaS) or infrastructure as a service (IaaS) deployment model, applications running in a cloud environment may enjoy the same security controls surrounding them as applications that run in a traditional data center environment. This makes the need for an application …
What are the security risks of the cloud computing? Read More »
OWASP Top 10 Vulnerabilities 2021 is nothing but an Applications run in the cloud should conform to best practice guidance and guidelines for the assessment and ongoing management of vulnerabilities. As mentioned earlier, the implementation of an application risk-management program addresses not only vulnerabilities but also all risks associated with applications. The most common software …
Security risks for cloud computing is become increases from last decade, Because information technology (IT) is typically deployed to serve the interests of the organization, the goals, and management practices in that organization are an important source of guidance to cloud risk management. From the perspective of the enterprise, cloud computing represents outsourcing, and it …
For you to understand disadvantages of cloud storage first we need to understand On a technical level, persistent mass storage in cloud computing typically consists of spinning hard disk drives or solid-state drives (SSDs). For reliability purposes, disk drives are often grouped to provide redundancy. The typical approach is the Redundant Array of Inexpensive Disks …
The Hypervisor becomes important about the compute resources of a host is the ability to manage and allocate these resources effectively, either on a per-guest operating-system (OS) basis or on a per-host basis within a resource cluster. The use of reservations, limits, and shares offers the contextual ability for an administrator to allocate the compute …
Cloud Storage Encryption is an important technology to consider and use when implementing systems that allow for secure data storage and usage from the cloud. Although having encryption enabled on all data across the enterprise architecture reduces the risks associated with unauthorized data access and exposure, there are performance constraints and concerns to be addressed. …
The cloud infrastructure consists of data centers and the hardware that runs in them, including compute, storage, and networking hardware; virtualization software; and a management layer The Physical Environment of the Cloud Infrastructure Just like traditional or onsite computing, cloud computing runs on real hardware that runs in real buildings. At the contemporary scale of …
DRM is not just the use of standard encryption technologies to provide confidentiality for data it is much more. Here is a shortlist of some of its features and use cases: DRM adds an extra layer of access controls on top of the data object or document. The ACL determines who can open the document …
Data Discovery implementation is the solution that provides an operative foundation for effective application and governance for any of the P&DP fulfillments Data Discovery From the customer’s perspective The customer, in his role of the data controller, has full responsibility for compliance with the P&DP laws obligations. Therefore, the implementation of data discovery solutions with …
Data classification as part of the information lifecycle management (ILM) process can be defined as a tool for the categorization of data to help an organization effectively answer the following questions: What data types are available? Where is certain data located? What access levels are implemented? What protection level is implemented, and does it adhere …
How to do data discovery ? Data discovery is a departure from traditional business intelligence in that it emphasizes interactive, visual analytics rather than static reporting. The goal of data discovery is to work with and enable people to use their intuition to find meaningful and important information in data. This process usually consists of …
DLP, also known as data leakage prevention or data loss protection, describes the controls put in place by an organization to ensure that certain types of data (structured and unstructured) remain under organizational controls, in line with policies, standards, and procedures. Controls to protect data form the foundation of organizational security and enable the organization …
Data Masking is a process that need to provide confidentiality protection for data in cloud environments is a serious concern for organizations. The ability to use encryption is not always a realistic option for various reasons including performance, cost, and technical abilities. As a result, additional mechanisms need to be employed to ensure that data …
Cloud Security Standards slogan is “If it cannot be measured, it cannot be managed“. This is a statement that any auditor and security professional should abide by regardless of his focus. How can someone have confidence, awareness, and assurances that he and the CSP are taking the correct steps to ensure that data is secured …
Cost Benefit Analysis of Cloud Computing is often identified as a key driver for the adoption of cloud computing. The challenge with decisions being made solely or exclusively on cost savings can come back to haunt the organization or entity that failed to take a risk-based view and factor in the relevant effects that may …
Business Continuity and Disaster Recovery planning and management is the process by which risks and threats to the ongoing availability of services, business functions, and the organization are actively reviewed and managed at set intervals as part of the overall risk-management process. The goal is to keep the business operating and functioning in the event …
Business Continuity and Disaster Recovery planning Read More »
Cloud Security Framework System and subsystem product certification is used to evaluate the security claims made for a system and its components. Although there have been several evaluation frameworks available for use over the years, such as the Trusted Computer System Evaluation Criteria (TCSEC) developed by the United States Department of Defense, the Common Criteria …
Cloud Computing Security Considerations can be a subjective issue, viewed differently across different industries, companies, and users, based on their needs, desires, and requirements. Many of these actions and Cloud Computing Security Considerations appetites are strongly influenced by compliance and other regulatory requirements. Within IaaS, a key emphasis and focus must be placed on the …
The Open Web Application Security Project (OWASP) has provided the 10 most critical web application security threats that should serve as a minimum level for application security assessments and testing. The open web application security project (OWASP) top 10 covers the following categories: Injection Injection flaws, such as SQL, OS, and LDAP injection occur when …
The deployment of cloud solutions, by its nature, is often deemed a technology decision by Cloud Security Posture Management; however, it’s truly a business alignment decision. Although cloud computing no doubt enables technology to be delivered and utilized uniquely, potentially unleashing multiple benefits, the choice to deploy and consume cloud services should be a business …
The concept of Identity management and access control in cloud computing covers most areas of technology, access control is merging and aligning with other combined activities. Some of these are automated using single sign-on capabilities; others operate in a standalone, segregated fashion. The combination of access control and effective management of those technologies, processes, and controls has …
Identity management and access control in cloud computing Read More »
Cloud Computing elements is a very important concept we need to consider before moving to the cloud environment. Below, Anything as a service (XaaS): The growing diversity of services available over the Internet via cloud computing as opposed to being provided locally or on-premises. Apache CloudStack: An open-source cloud computing and IaaS platform developed to …
Cloud Attacks Surface Essentials is the process where Cloud data centers can be perceived as similar to DMZs in legacy enterprises. Because everything in the cloud can be accessed remotely, it can be considered exposed to the Internet, to a greater or lesser extent. Instead of the discrete perimeter of a private network, cloud configurations …
The vendor offering cloud services. The CSP will own the datacenter, employ the staff, own and manage the resources (hardware and software), monitor service provision and security, and provide administrative assistance for the customer and the customer’s data and processing needs. Cloud Computing Roles & Responsibilities Examples include Amazon Web Services (AWS), Rackspace, and Microsoft’s …
Private cloud security risks. A private cloud configuration is a legacy configuration of a data center, often with distributed computing and BYOD capabilities. The organization controls the entire infrastructure (hardware, software, facilities, administrative personnel, security controls, and so on). A private cloud configuration is a legacy configuration of a data center, often with distributed computing and …
