Security Considerations

The most important aspect of public cloud security is the split responsibility model: the cloud provider is responsible for infrastructure security, but you're still responsible for securing your deployment.

This section describes the basics of public cloud security, how you could evaluate the security posture of your public cloud provider, and concludes with an overview of what you could do to secure your public cloud environment.

In this section you'll learn how to set up your public cloud platform accounts and how to protect them. In addition, Cloud IAM solutions offer the possibility to use the platform accounts for your application stack as well - and we will explore security challenges and opportunities of this approach.

Cloud environments offer new logging mechanisms which differ from traditional technologies. We will explore how you could use cloud storage to save the logs, and analyze them using additional cloud services, or how you could send the cloud events to external services for further analysis.

One of the biggest advantage of public cloud environments is their capability to modify any object via an API call or use infrastructure-as-code templates to deploy, modify or destroy whole application stacks, as well as monitor the compliance of actual deployment with desired state specified in the template.

This section describes how you can leverage this capability to increase the security of your deployments, and how the modern IaC and CI/CD methodologies affects traditional security testing approaches.

In this section Matthias Luft reviewed the public cloud security groundwork detailed in Cloud Security webinar, and then dived into details needed to develop cloud security, establish zero-trust model, and interact with a cloud-native security team.

AWS offeres several layers of network security within a VPC:

• Stateful security groups applied to VM interfaces;
• Stateless network ACLs applied to subnets;
• Validation of source and destination IP addresses.

All these mechanisms (and the logging and mirroring functionality available with flow logs and VPC traffic mirroring) are described in this section.

When you want to secure traffic entering or leaving a VPC, you could use a number of AWS services, including:

• Network Firewall: scale-out layer-4 firewall combined with Suricata IPS
• Web Application Firewall: a Layer-7 HTTP(S) firewall
• AWS Shield: a rudimentary DDoS protection service

Azure offers numerous network security mechanisms. This section covers intra-VNet mechanisms including:

• Network Security Groups;
• Application Security Groups;
• Packet capture and flow logging;
• Monitoring tools like IP Flow Verify.

Azure Firewall is described in a separate section.

In this assignment you'll implement traffic filters, add web application firewall to protect your web server, log SSH traffic to your SSH bastion host and create multiple users with different privilege levels.