Secure Cloud Computing

Cloud Computing: Concepts, Technology, and Architecture, Prentice Hall, 2013, ISBN 9780133387520, by

Objectives

1. Cloud offerings and various deployment models
2. Business proposition of Cloud Computing
3. Risks, threats, and vulnerabilities found in a typical Cloud infrastructure
4. Security countermeasures for combating risks, threats, and vulnerabilities commonly found in a
Cloud infrastructure
5. Real hands-on experience with developing various secure cloud models using Amazon Cloud
resources.
6. Developing of Virtual Firewalls, Software Defined Networks (SDN) and IPsec through cloud

Takeaways

- Capacity refers to the maximum amount of work an IT resource can handle.
- Different strategies for capacity management include lead-adding, lay-adding, and match-adding.
- Estimating usage fluctuations is important for capacity planning.
- Costs associated with capacity include acquiring new infrastructure and ongoing ownership expenses.
- Operating overhead includes personnel, upgrades, patches, utility bills, security, access control, licenses, and support.
- Agility refers to an organization's responsiveness to change.
- Clustering involves interconnected systems working as a single unit, while grid computing is more distributed and heterogeneous.
- Virtualization is the creation of virtual instances of IT resources.
- Cloud provisioning allows for scalable and measured IT resource allocation.

- Roles in the cloud include cloud provider, cloud consumer, cloud service owner, and resource administrator.
- Additional roles include auditor, broker, and carrier.
- Boundaries in the cloud include organizational boundaries and trust boundaries.
- Cloud characteristics include on-demand provisioning, ubiquitous access, multitenancy, elasticity, measured usage, and resilience.
- Delivery models in the cloud include IaaS, PaaS, and SaaS.
- IaaS provides infrastructure-centric IT resources, PaaS offers pre-configured environments, and SaaS provides shared cloud services.
- Comparison of models shows differences in administrative control and management responsibilities.
- Combination models can include a mix of IaaS and PaaS.
- Deployment models include public, community, private, hybrid clouds, as well as other models like VPC and inter-cloud.

- ISPs are categorized into Tier 1 (international), Tier 2 (regional), and Tier 3 (local).
- Connectionless Packet Switching divides data into packets for transmission and routing.
- Router-Based Interconnectivity allows routers to connect to multiple networks and forward packets.
- The OSI model consists of the application, presentation, session, transport, network, data link control, and physical layers.
- TCP/IP is a protocol suite with layers including application, transport, internet, network access, and physical layers.
- Connectivity issues can arise for on-premises and cloud-based IT resources.
- Network bandwidth refers to transmission capacity, while latency is the time it takes for packets to travel.
- Virtualization includes server, storage, and network virtualization, enabling hardware independence and server consolidation.
- Resource replication allows for easy replication, migration, and backup of virtual servers.
- OS-based virtualization involves installing virtualization software in a pre-existing operating system.
- Hardware-based virtualization allows virtual servers to interact with hardware directly.
- Virtualization management is supported by virtualization infrastructure management tools.
- Other considerations include performance overhead, hardware compatibility, and portability.

Multitenancy:
- Ensures tenants have access only to their own data and configuration information.
- Includes user interface, business process, data model, and access control.
- Common characteristics include usage isolation, data security, application upgrades, scalability, metered usage, and data tier isolation.

Containerization:
- Operating system-level virtualization technology for deploying and running applications and cloud services.
- Applications and services run in containers without the need for a virtual server for each solution.
- Containers share the operating system kernel and run as isolated processes in the user space.
- Containers are more lightweight and consume less storage space compared to virtual servers.
- Benefits include portability and efficient resource utilization.

Virtualization:
- Involves virtual servers, virtual storage, and virtual disk.
- Virtualization software runs on a physical server known as a host or physical host.
- Virtual servers have their own guest operating systems.
- Hypervisor or virtual machine manager (VMM) is used for managing virtual machines.
- Hardware independence allows easy migration of virtual servers.
- Server consolidation enables multiple virtual servers to share one physical server.
- Resource replication supports standardized virtual machine images, migration, scalability, and backup.

OS-based virtualization:
- Installation of virtualization software in a pre-existing host operating system.
- Management tools for the physical host include backup and recovery, directory services integration, and security management.
- Issues include resource consumption, decreased performance due to hardware traversal, and licensing requirements.

Hardware-based virtualization:
- Virtual servers directly interact with hardware without intermediary actions from the host operating system.
- Hypervisor exists as a thin layer of software for hardware management.
- Compatibility with hardware devices can be a challenge.

Virtualization management:
- Supported by virtualization infrastructure management (VIM) tools.
- Centralized management module or controller runs on a dedicated computer.

Other considerations:
- Performance overhead, hardware compatibility, and portability are important factors to consider.

Storage technologies:
- Hard Disk Arrays (RAIDS), I/O caching, hot-swappable hard disks, storage virtualization, and data replication mechanisms.
- Storage categories include Storage Area Network (SAN) and Network-Attached Storage (NAS).

Containerization:
- Operating system-level virtualization technology for deploying and running applications and cloud services.
- Does not require deploying a virtual server for each solution.
- Containers package code and dependencies and share an operating system kernel.
- Containers run as isolated processes in the user space.
- Containers offer portability and efficient resource utilization compared to virtual servers.

Confidentiality, Integrity, Authenticity, Availability (CIA):
- CIA are key aspects of security.
- Confidentiality ensures data is accessible only to authorized parties.
- Integrity ensures data has not been altered by unauthorized parties.
- Authenticity ensures data is provided by an authorized source.
- Availability refers to being accessible and usable during a specified time period.

Threats, Vulnerabilities, and Risks:
- Threats are potential security violations, and vulnerabilities are weaknesses that can be exploited.
- Risk is the possibility of loss or harm, calculated as the product of vulnerability and threat.
- Different threat agents include anonymous attackers, malicious service agents, trusted attackers, and malicious insiders.

Security Threats:
- Traffic eavesdropping, malicious intermediary, denial of service (DoS) attacks, insufficient authorization attacks are common threats.
- Containerization can introduce security threats by lacking isolation from the host operating system.

Remote Administration System:
- Includes Usage and Administration Portal and Self-Service Portal.
- APIs enable data transmission between software products.
- Virtual Infrastructure Manager (VIM) coordinates server hardware for creating virtual server instances.
- VIM manages virtual IT resources, enforces usage and security policies, and monitors operational conditions.

SLA Management System:
- Manages Service Level Agreements (SLAs) and collects SLA data based on predefined metrics.
- Uses SLA monitor mechanisms to collect data for usage and administration portals.
- Aligns metrics with SLA guarantees in cloud provisioning contracts.

Billing Management System:
- Collects and processes usage data for cloud provider accounting and consumer billing.
- Relies on pay-per-use monitors and a data repository for billing, reporting, and invoicing.

Encryption:
- Encryption is a digital coding system used for confidentiality and integrity.
- Uses a standardized algorithm called a cipher to transform plaintext into ciphertext.
- Encryption key is used to encrypt and decrypt data.
- Security threats include traffic eavesdropping, malicious intermediary, insufficient authorization, and overlapping trust boundaries.
- Symmetric encryption uses the same key for encryption and decryption (secret key cryptography).
- Asymmetric encryption uses two different keys: private key (known only to the owner) and public key (commonly available, public key cryptography).

Hashing:
- One-way, non-reversible data protection method.
- No key is provided to unlock the hashed message.
- Message digest is a fixed-length string derived from a message using a hashing formula.
- Message digests protect the integrity of data and detect changes.

Digital Signature:
- Provides data authenticity and integrity through authentication and non-repudiation.
- Ensures the message received is from the rightful sender.
- In two-way communication, involves private and public keys of both sender and recipient.

Public Key Infrastructure (PKI):
- System of protocols, data formats, rules, and practices for secure use of public key cryptography.
- Relies on digital certificates to bind public keys to identities.
- Digital certificates are signed by a certificate authority (CA).

Identity and Access Management (IAM):
- Authentication verifies user identities using credentials like usernames, passwords, digital signatures, etc.
- Authorization defines access controls and relationships between identities, access rights, and IT resources.
- User management creates new user identities, manages passwords, and defines privileges.
- Credential management establishes identities and access control rules for user accounts.

IAM for Security Threats:
- IAM counters threats like insufficient authorization, denial of service, overlapping trust boundaries, virtualization attacks, and containerization attacks.

Single Sign-On (SSO):
- Enables authentication by a security broker for accessing multiple cloud services or resources.
- Useful when accessing services across different clouds.

Cloud-Based Security Group:
- Determines access based on security policies.
- Segmented into logical groups forming network perimeters.
- Virtual servers can be hardened through a hardening process to enhance security.

IaaS (Infrastructure as a Service):
- Defined by properties like operating system, memory capacity, processing capacity, and virtualized storage.
- Data centers can be linked for resiliency and placed in different locations for lower failure chances.
- Scalability achieved through dynamic vertical scaling or manual scaling.
- Monitoring includes virtual server lifecycles, data storage, network traffic, failure conditions, and event triggers.
- Security mechanisms include encryption, hashing, digital signatures, PKI, IAM, SSO, cloud-based security groups, hardened virtual server images, and usage monitors.

PaaS (Platform as a Service):
- Scalability addressed through dynamic scalability, workload distribution, and resource pooling.
- Monitoring includes ready-made environment instances, data persistence, network usage, failure conditions, and event triggers.
- Specific requirements based on the business logic of the SaaS-based cloud service.
- Architectural models include service load balancing, dynamic failure detection, storage maintenance window, elastic resource and network capacity, and cloud balancing.
- Controls include service provisioning agreements, software platform selection, lifecycle control, versioning, availability and reliability configurations, credentials management, security settings, SLA monitoring, usage and cost management, and scalability control.

SaaS (Software as a Service):
- Requirements based on the business logic of the SaaS-based cloud service.
- Architectural models include service load balancing, dynamic failure detection, storage maintenance window, elastic resource and network capacity, and cloud balancing.
- Controls include security configurations, availability and reliability options, usage cost management, user account management, SLA selection and monitoring, and scalability options.

Overall, the three cloud service models (IaaS, PaaS, and SaaS) have different control mechanisms and monitoring approaches, tailored to their specific characteristics and requirements.

Up-front costs:
- Initial investments required to fund IT resources.
- Cost of capital represents the cost of raising funds.
- Sunk costs are existing paid-for IT resources.
- Integration costs for making IT resources compatible in a new environment.
- Locked-in costs can limit portability in cloud environments.

Cost metrics:
- Network usage metrics: inbound network usage, outbound network usage, intra-cloud WAN usage.
- Server usage metrics: on-demand and reserved instances.
- Storage device metrics: on-demand storage and I/O data transferred.
- Cloud service usage metrics: application subscription duration, number of nominated users, number of transactions.

Cost management considerations:
- Cloud service design and development.
- Cloud service deployment.
- Cloud service contracting.
- Cloud service offering.
- Cloud service provisioning.
- Cloud service operation.
- Cloud service decommissioning.

Influencers of pricing model:
- Market competition and regulatory requirements.
- Overhead incurred during design, development, deployment, and operation.
- Opportunities for expense reduction through resource sharing and data center optimization.

Pricing model:
- Cost metrics and associated prices.
- Fixed and variable rates definitions.
- Volume discounts based on resource scaling.
- Cost and price customization options.

Pricing templates:
- IaaS: Pricing based on resource allocation and usage.
- PaaS: Pricing based on network data transferred, virtual servers, and storage.
- SaaS: Pricing based on application modules, nominated consumers, and transactions.

Additional considerations:
- Negotiation of pricing.
- Payment options: pre-payment and post-payment.
- Cost archiving for tracking historical billing information.

SLA (Service Level Agreement):
- Human-readable documents issued by cloud providers that describe quality-of-service features, guarantees, and limitations.
- SLA metrics include availability, reliability, performance, scalability, and resiliency.

Characteristics of SLA metrics:
- Quantifiable: Metrics should have a clear unit of measure based on quantitative measurements.
- Repeatable: The methods of measuring the metric should yield identical results under identical conditions.
- Comparable: The units of measure used should be standardized and comparable.
- Easily Obtainable: Metrics should be based on a non-proprietary, common form of measurement easily understood by cloud consumers.

Availability metrics:
- Description: Percentage of service up-time.
- Measurement: Total up-time divided by total time.
- Frequency: Weekly, monthly, yearly.
- Cloud Delivery Model: IaaS, PaaS, SaaS.

Reliability metrics:
- Mean-Time Between Failures (MTBF) metric.
- Description: Expected time between consecutive service failures.
- Measurement: Sum of normal operational period duration divided by the number of failures.
- Frequency: Monthly, yearly.
- Cloud Delivery Model: IaaS, PaaS.
- Reliability rate metrics: Percentage of successful service outcomes under pre-defined conditions.

Service performance metrics:
- Network capacity metric: Bandwidth or throughput in bits per second.
- Storage metric: Storage size in GB.
- Server metric: Number of CPUs, CPU frequency, RAM size, and storage size.
- Web application metric: Rate of requests per minute.
- Instance starting metric: Length of time required to initialize a new instance.
- Response time metric: Time required to perform a synchronous operation.
- Completion time metric: Time required to complete an asynchronous task.

Service scalability metrics:
- Horizontal scalability (storage and server capacity changes) and vertical scalability (server capacity fluctuations).

Service resilience metrics:
- Measure the ability of an IT resource to recover from operational disturbances.
- Applied in design, operational, and recovery phases.
- Mean-Time to Switchover (MTSO) metric: Time expected to complete a switchover from severe failure.
- Mean time system recovery metric: Time expected for a resilient system to perform a complete recovery.

SLA guide considerations:
- Mapping business cases to SLAs.
- Working with cloud and on-premise SLAs.
- Understanding the scope of an SLA.
- Defining penalties for non-compliance.
- Incorporating non-measurable requirements.
- Disclosure of compliance verification and management.
- Archiving SLA data.
- Disclosing cross-cloud dependencies.