Cyberstudy
PDF p.157 In progress

Responsibility Matrix

Open PDF at p.157 25 flashcards

Summary

PDF p.157

In cloud infrastructure, security responsibilities are shared between the cloud provider and the customer. The cloud provider secures the underlying infrastructure, while the customer secures their applications and data. The shared responsibility model varies based on the service model (SaaS, PaaS, IaaS).

In plain words

Supplementary — not from your PDF

In the shared responsibility model, the provider secures the cloud itself (datacenters, hardware, the network underneath, tenant isolation). The customer secures what they put in it (identities, access controls, data, configuration and encryption keys). The split moves with the service model. In SaaS the provider handles the OS; in IaaS you secure the OS yourself.

Detailed explanation

PDF p.157
  • Cloud Service Provider (CSP) Responsibilities
    • Physical Security: Securing the infrastructure's physical components.
    • Equipment Security: Securing computer, storage, and network equipment.
    • Network Security: Protecting foundational elements like DDoS protection.
    • Backup and Recovery: Ensuring cloud storage backup and recovery.
    • Resource Isolation: Securing cloud infrastructure resource isolation among tenants.
    • Identity and Access Control: Managing tenant resource identity and access control.
    • Monitoring and Incident Response: Security monitoring and incident response for the infrastructure.
    • Datacenter Management: Securing and managing datacenters in multiple geographic regions.
  • Cloud Service Customer Responsibilities
    • Identity Management: Managing user identities.
    • Data Location Configuration: Configuring geographic locations for data storage and service execution.
    • Access Controls: Implementing user and service access controls to cloud resources.
    • Data and Application Security: Configuring security for data and applications.
    • Operating System Protection: Protecting operating systems when deployed.
    • Encryption: Using and configuring encryption, especially key protection.
  • Shared Responsibility Model
    • SaaS Model: CSP handles operating system configuration and control.
    • IaaS Model: Operating system security is shared between CSP and customer.
    • FaaS (Function as a Service): Allows execution of code in response to triggers, with dynamic scaling.

Important terms

taken from the text above
Physical Security
Securing the infrastructure's physical components.
Equipment Security
Securing computer, storage, and network equipment.
Network Security
Protecting foundational elements like DDoS protection.
Backup and Recovery
Ensuring cloud storage backup and recovery.
Resource Isolation
Securing cloud infrastructure resource isolation among tenants.
Identity and Access Control
Managing tenant resource identity and access control.
Monitoring and Incident Response
Security monitoring and incident response for the infrastructure.
Datacenter Management
Securing and managing datacenters in multiple geographic regions.
Identity Management
Managing user identities.
Data Location Configuration
Configuring geographic locations for data storage and service execution.
Access Controls
Implementing user and service access controls to cloud resources.
Data and Application Security
Configuring security for data and applications.
Operating System Protection
Protecting operating systems when deployed.
Encryption
Using and configuring encryption, especially key protection.
SaaS Model
CSP handles operating system configuration and control.
IaaS Model
Operating system security is shared between CSP and customer.
FaaS (Function as a Service)
Allows execution of code in response to triggers, with dynamic scaling.
CSP Cloud Service Provider

Examples & real-world scenarios

Supplementary — not from your PDF
  • The CSP guarding physical datacenter access.
  • The customer turning on MFA for its cloud admin accounts.
  • The customer choosing which region stores its data.

Scenario

A company's storage bucket is left open to the public and data leaks. The provider's infrastructure worked correctly; the misconfiguration was the customer's responsibility.

Common mistakes

Supplementary — not from your PDF
  • Assuming the provider secures everything once you're 'in the cloud'.
  • Forgetting that encryption key protection usually stays with the customer.

Practical skills

Supplementary — not from your PDF
  • Fill in a responsibility matrix for SaaS, PaaS and IaaS.

What I should remember

Key Points PDF p.157
  • CSP Responsibilities
    • Physical Security: Infrastructure components.
    • Equipment Security: Computer, storage, network.
    • Network Security: DDoS protection.
    • Backup and Recovery: Cloud storage.
    • Resource Isolation: Among tenants.
    • Identity and Access Control: Tenant resources.
    • Monitoring and Incident Response: Infrastructure security.
    • Datacenter Management: Multiple regions.
  • Customer Responsibilities
    • Identity Management: User identities.
    • Data Location Configuration: Geographic storage.
    • Access Controls: User and service access.
    • Data and Application Security: Configuration.
    • Operating System Protection: When deployed.
    • Encryption: Key protection.
  • Shared Responsibility
    • SaaS: CSP handles OS configuration.
    • IaaS: Shared OS security.
    • FaaS: Dynamic code execution.