Information Security & Management (AL-604 (B)) - Unit 3 Short Notes

UNIT 3: Information Security & Management – Cloud Computing Focus

(Based on AL-604 (B) Past Exam Analysis)

I. Cloud Computing Fundamentals

Grid Computing vs. Cloud Computing

Definitions:

• Grid Computing: Distributed computing model where resources from multiple administrative domains are pooled to solve large-scale problems. Focus on batch processing and high-throughput tasks.

• Cloud Computing: On-demand delivery of IT resources (compute, storage, network) over the internet with elastic scaling and pay-as-you-go billing.

Key Differences:

Similarities:

• Both use distributed computing and resource pooling.

• Aim to improve resource utilization and parallel processing.

[!TIP]

Exam Focus: Grid is for collaborative, non-interactive tasks; Cloud is for on-demand, interactive services.

Computing on Demand / Utility Computing

• Concept: Delivery of computing resources (CPU, storage, network) as a metered utility, analogous to electricity or water.

• Dynamic Provisioning: Resources are allocated/released automatically based on real-time demand via APIs or management consoles.

• Enablers: Virtualization, broadband internet, standardized hardware.

Example: AWS EC2 auto-scaling groups that add/remove VMs based on CPU utilization.

Cloud Computing Reference Model & Cloud Stack

NIST Model (Five Essential Characteristics):

1. On-demand self-service

2. Broad network access

3. Resource pooling

4. Rapid elasticity

5. Measured service

Cloud Stack (Service Models):

graph TD

    A[Cloud Consumer] --> B[SaaS: Software]

    A --> C[PaaS: Platform]

    A --> D[IaaS: Infrastructure]

    B --> E[Applications]

    C --> F[Development Tools]

    D --> G[Virtual Machines, Storage]

Actors in Reference Model:

• Cloud Consumer: Uses services.

• Cloud Provider: Owns/operates infrastructure.

• Cloud Broker: Mediates between consumer/provider.

• Cloud Auditor: Independent evaluator of compliance.

• Cloud Carrier: Provides network connectivity.

[!TIP]

Diagram Requirement: Draw NIST model with actors and service stack. Label each layer’s responsibilities.

II. Cloud Service and Deployment Models

Service Models (SaaS, PaaS, IaaS)

Differentiators:

• Abstraction Level: SaaS (highest) → IaaS (lowest).

• Management Overhead: Decreases from IaaS to SaaS.

• Customization: IaaS offers maximum flexibility; SaaS offers least.

Deployment Models

Selecting a Deployment Model

Decision Factors:

1. Security & Compliance: Data sensitivity (e.g., HIPAA, GDPR) → Private/Community.

2. Cost Constraints: Budget limitations → Public (opex) vs. Private (capex).

3. Scalability Needs: Variable workloads → Hybrid/Public.

4. Expertise: In-house IT skills → Private; limited staff → Public.

5. Control Requirements: Need for customization → IaaS/Private.

[!TIP]

Common Pitfall: Assuming private cloud is always more secure—misconfigurations can make it less secure than well-managed public cloud.

III. Virtualization Technologies

Virtualization Concepts

• Abstraction: Physical hardware (CPU, memory, storage, network) is abstracted into virtual resources.

• Key Benefits:

  • Consolidation: Multiple VMs on one physical server → higher utilization (60–80% vs. 15–20%).

  • Isolation: VMs run independently; failure in one doesn’t affect others.

  • Portability: VMs can be migrated across hosts.

Hypervisors

Functions:

• Resource allocation (CPU, memory scheduling).

• Device emulation (virtual NIC, disk).

• VM lifecycle management (create, suspend, migrate).

Hardware Virtualization (HVM)

• Full Virtualization: VM runs unmodified OS; hypervisor traps privileged instructions.

  • Example: VMware ESXi, KVM.

• Para-virtualization: OS modified to use hypervisor APIs directly → better performance.

  • Example: Xen (with PV drivers).

Logical Partitioning (LPAR)

• Definition: Firmware-level partitioning of a physical server (e.g., IBM Power Systems) into isolated logical partitions.

• Architecture:

  • Hypervisor (PHYP) manages physical resources.

  • Each LPAR gets dedicated/virtualized CPU, memory, I/O.

• Benefits:

  • Resource Allocation: Fine-grained (e.g., 0.1 CPU shares).

  • Isolation: Hard partition boundaries; no VM escape.

  • Flexibility: Dynamic resource reallocation without reboot.

• Disadvantages:

  • Complexity: Requires expertise to configure.

  • Overhead: Hypervisor consumes resources (~2–3%).

  • Vendor Lock-in: Typically proprietary (IBM, HP).

Virtualized Data Center Architecture

Components:

1. Virtualized Servers: Hypervisors on x86/Power hardware.

2. Virtualized Storage: SAN/NAS abstracted into virtual disks (vDisks).

3. Virtualized Networking: Software-defined networking (SDN) with virtual switches (vSwitch), VLANs.

4. Management Layer:

   • Orchestration: Automates provisioning (e.g., OpenStack Heat).

   • Monitoring: Metrics collection (e.g., vCenter, Nagios).

Flow:

User request → Orchestration engine → Hypervisor/Storage/Network APIs → Resource allocation.

Storage Virtualization

• Concept: Abstract physical storage devices into a single logical pool.

• SAN (Storage Area Network): Block-level access via Fibre Channel/iSCSI.

  • Example: VMware VMFS datastore.

• NAS (Network Attached Storage): File-level access via NFS/CIFS.

  • Example: Network home directories.

• Benefits:

  • Simplified Management: Single pane of glass.

  • Thin Provisioning: Allocate on-demand.

  • Data Migration: Non-disruptive moves between arrays.

Virtualization Platform Requirements

[!TIP]

Exam Alert: Know hardware assist requirements (VT-x/AMD-V) for Type 1 hypervisors.

IV. Cloud Security

Importance and Challenges

• Business Risks: Vendor lock-in, data sovereignty, compliance violations, downtime costs.

• IT Risks: Data breaches, insecure APIs, account hijacking, malicious insiders.

• Shared Responsibility Model:

  
  graph LR
  
      A[Cloud Provider] --> B[Security *OF* Cloud<br>Physical infra, hypervisor, network]
  
      C[Cloud Consumer] --> D[Security *IN* Cloud<br>Data, apps, access, OS (IaaS)]
  
  

  Responsibility shifts from IaaS (consumer manages OS) to SaaS (provider manages almost all).

Security Aspects

1. Data Security:

   • Encryption: AES-256 at rest (e.g., S3 SSE), TLS in transit.

   • Integrity: HMAC, digital signatures.

   • Lifecycle: Secure deletion (crypto-shredding), retention policies.

2. Network Security:

   • Segmentation: VPCs, subnets, security groups.

   • Firewalls: Host-based (iptables), network-based (AWS NACL).

   • IDS/IPS: Snort, Suricata in cloud VPCs.

3. Identity and Access Management (IAM):

   • Principle of Least Privilege.

   • Multi-Factor Authentication (MFA).

   • Federation: SAML, OAuth 2.0 for single sign-on.

4. Compliance & Legal:

   • Audit Trails: CloudTrail (AWS), Audit Logs (GCP).

   • Governance: Cloud Security Alliance (CSA) controls, ISO 27001.

Secure Execution Environments

• Encryption:

  • At Rest: Transparent encryption (e.g., Azure Storage Service Encryption).

  • In Transit: TLS 1.2+, SSH for management.

• Secure Protocols:

  • TLS/SSL: For data APIs (HTTPS).

  • SSH: For secure shell access (replace Telnet).

• Secure Bootstrapping:

  • Measured Boot: TPM records boot components.

  • Trusted Platform Module (TPM): Hardware root of trust.

Virtual Machine Security

• VM-Specific Risks:

  • VM Escape: Breakout from guest to host (e.g., CVE-2020-0551).

  • VM Migration: Interception during live migration.

  • Snapshot Exposure: Sensitive data in VM snapshots.

• Hardening Techniques:

  • Minimal Images: Remove unnecessary packages.

  • Patching: Regular OS/application updates.

  • Network Segmentation: Micro-segmentation with security groups.

• Monitoring:

  • Log Collection: Agent-based (osquery) or agentless (AWS CloudWatch Logs).

  • Anomaly Detection: Unusual login patterns, network traffic.

Role-Based Access Control (RBAC)

• Principles:

  • Role Hierarchy: Senior roles inherit permissions.

  • Least Privilege: Grant minimum necessary access.

  • Separation of Duties: Prevent conflict (e.g., requester ≠ approver).

• Implementation in Cloud IAM:

  • AWS: IAM Policies attached to Roles/Users/Groups.

  • Azure: Role-Based Access Control (RBAC) with built-in roles (Owner, Contributor, Reader).

  • GCP: IAM Roles (primitive, predefined, custom).

• Best Practices:

  • Use roles instead of direct user permissions.

  • Regular access reviews to revoke unused permissions.

[!TIP]

Common Mistake: Confusing IAM “users” (human) with “roles” (assumable by services/instances).

V. Cloud Architecture and Design

Service-Oriented Architecture (SOA) in Cloud

• SOA Principles:

  • Services: Self-contained business functions (e.g., “Payment Service”).

  • Loose Coupling: Services interact via standardized interfaces (APIs).

  • Interoperability: Technology-agnostic (XML/JSON over HTTP).

  • Reusability: Services can be composed into new applications.

• Facilitating Cloud Integration:

  • Cloud services naturally align with SOA (e.g., AWS Lambda as a service).

  • Enterprise Service Bus (ESB) in cloud (e.g., MuleSoft on AWS).

SOA for Interoperability and Integration

• APIs: RESTful (JSON) or SOAP (XML) for service exposure.

• Messaging Patterns:

  • Queue-based: Decouple producers/consumers (e.g., AWS SQS).

  • Publish-Subscribe: Event-driven (e.g., AWS SNS).

• Orchestration vs. Choreography:

  • Orchestration: Centralized workflow (e.g., AWS Step Functions).

  • Choreography: Decentralized event-based coordination.

Example: E-commerce app:

User Service → Order Service (via REST) → Payment Service (via message queue) → Inventory Service.

Role of Independent Software Vendors (ISVs)

• Developing E-Business Apps: ISVs build SaaS products (e.g., Salesforce, Workday) hosted on cloud platforms.

• Deployment Models:

  • Multi-Tenant: Single instance serves multiple customers (cost-efficient).

  • Single-Tenant: Dedicated instance per customer (more control).

• Partnerships with Providers:

  • Marketplace Listings: AWS Marketplace, Azure Marketplace.

  • Co-selling: Joint go-to-market with cloud providers.

  • Technical Integration: Use provider APIs/services (e.g., AWS RDS, Azure AD).

Cloud Design Using SOA

• Architectural Patterns:

  • Microservices: Fine-grained SOA (each service owns its data).

  • API Gateway: Single entry point, handles auth, rate limiting.

  • Circuit Breaker: Prevent cascading failures (e.g., Hystrix).

• Best Practices:

  • Service Decomposition: By business capability (not technical layer).

  • Governance: API versioning, deprecation policies.

  • Observability: Distributed tracing (e.g., Jaeger, AWS X-Ray).

VI. Cloud Management and Performance

Quality of Service (QoS)

• Definition: Measurable service characteristics agreed upon in SLA.

• Key Metrics:

  • Availability: $$\displaystyle \text{Availability} = \frac{\text{Uptime}}{\text{Total Time}} \times 100\% $$ (e.g., 99.9% = ~8.76 hours downtime/year).

  • Throughput: Requests per second (RPS).

  • Latency: Response time (ms).

  • Reliability: Mean Time Between Failures (MTBF).

• QoS Issues:

  1. Multi-Tenancy: Noisy neighbor problem (one tenant hogs resources).

  2. Resource Contention: Overcommitment leads to performance degradation.

  3. SLA Enforcement: Penalties for missed targets; need monitoring.

  4. Elasticity vs. Performance: Scaling may introduce latency (cold starts).

Cloud Infrastructure Benchmarks

• Purpose: Compare performance across providers/configurations.

• Tools & Standards:

  • SPEC Cloud (SPECvirt): Virtualization benchmark.

  • CloudHarmony (by Gartner): Cross-cloud performance data.

  • YCSB (Yahoo! Cloud Serving Benchmark): NoSQL database benchmarking.

• Benchmarked Resources:

  • Compute: CPU throughput (e.g., LINPACK), integer vs. floating-point.

  • Storage: IOPS, throughput (MB/s), latency.

  • Network: Bandwidth, jitter, packet loss.

Utility Computing Considerations

• Metering: Fine-grained resource usage tracking (per VM, per GB).

• Billing Models:

  • Pay-as-you-go: Hourly/secondly billing.

  • Reserved Instances: Commit 1–3 years for discount (up to 75%).

  • Spot Instances: Auction-based pricing (cheap, interruptible).

• Cost Optimization:

  • Auto-scaling: Scale down during off-peak.

  • Right-sizing: Match VM size to workload.

  • Reserved Instances: For steady-state workloads.

VII. Cloud Platforms and Tools

OpenNebula

• Overview: Open-source IaaS management platform for building private/hybrid clouds.

• Architecture:

  • Front-end: CLI/GUI (Sunstone) for management.

  • Cluster Nodes: Hypervisors (KVM, LXC) + storage/network.

  • Database: MySQL/PostgreSQL for state.

• Use Cases:

  • On-premises IaaS for research institutions.

  • Hybrid cloud bursting to AWS/OpenStack.

• Key Features:

  • Multi-hypervisor support (KVM, VMware, Hyper-V).

  • Marketplace: Pre-built VM templates.

  • Integration: With Docker, Kubernetes.

Nimbus

• Features:

  • Cloud Toolkit: Open-source tools for IaaS (Nimbus Context Broker, Workspace Service).

  • Standards-based: Implements OGF (Open Grid Forum) standards.

• Deployment Scenarios:

  • Scientific Clouds: Used by CERN, NASA for research computing.

  • Testbeds: For cloud research (e.g., EmuLab).

• Role: Provides infrastructure provisioning (VMs, networks) with focus on reproducibility for scientific experiments.

VIII. Specialized Cloud Services and Applications

Cloud Storage (Storage Cloud)

Models:

Key Characteristics:

• Durability: 11 nines (99.999999999%) for object storage.

• Scalability: Petabyte-scale, automatic growth.

• Cost: Object < File < Block (per GB).

Data Management and Analytics: OLAP

• Definition: Online Analytical Processing – technology for multidimensional data analysis.

• Functionality:

  • Multidimensional Model: Data organized in cubes (dimensions + measures).

  • Fast Query Performance: Pre-aggregated data, columnar storage.

• OLAP Operations:

  1. Slice-and-Dice: Select subset (e.g., sales in Q1).

  2. Drill-Down: Navigate from summary to detail (Year → Quarter → Month).

  3. Drill-Up/Roll-Up: Aggregate to higher level (City → Country).

  4. Pivot (Rotate): Reorient cube (swap rows/columns).

  5. Top-N: Rank items (e.g., top 10 products).

• Cloud Implementation:

  • Managed Services: Amazon Redshift, Google BigQuery, Snowflake.

  • Separation of Compute/Storage: Scale independently.

[!TIP]

Exam Distinction: OLAP (analytical, historical, aggregated) vs. OLTP (transactional, current, normalized).

\boxed{\text{Key Exam Topics: Grid vs Cloud, SaaS/PaaS/IaaS, Deployment Models, Virtualization (Hypervisors, LPAR), Cloud Security (Shared Responsibility, RBAC), SOA, QoS, Storage Models, OLAP}}