1.
Cloud Computing
CNG 256 Vulnerability Assessment
Red Rocks Cybersecurity Program

2.
What is the Cloud
• Everything is being put in the cloud
– Companies do not want to own hardware
anymore
• On Demand Self Service
• Broad Network Access
• Resource Pooling
• Rapid Elasticity
• Measure Services

3.
Forms of Cloud
Services
• SaaS – Software as a service
– Only need a browser to access services
• Office 365
• Google Docs
• Gmail

4.
Forms of Cloud
Services
• PaaS – Platform as a Services
– Targeted for developers
– Development, testing and deployment of
applications

5.
Forms of Cloud
Services
• IaaS – Infrastructure as a Service
– Deploying whole OS
– Network Devices
– Firewalls

6.
Providers
• AWS – Amazon Web Services
– Hosts both private and public clouds
• Private cloud is for government
• Netflix is a customer
• Salesforce
• ADP

7.
Threats and
Assessments
• How is data segregated?
• Multi-Tenancy Environments
– Shared Services
• What is the scanning policy?
– Options? Letter?
• How is data transmitted from local to
hosted?

8.
Controls for Cloud
Security
• Security Design and Architecture
– Three tier architecture
• Firewalls
• Virtual Machines
• Storage Encryption
• IDS / IPS
• Identity and Access Management (IAM)
– Authentication, Authorization and Access
Control

9.
Controls for Cloud
Security
• Governance
– Risk Assessment and Surveys
• PII
• PHI
• PCI
– Compliance
• Industry
• Types of data

10.
Controls for Cloud
Security
CIA
• Confidentiality
• Integrity
• Availability
– What is the SLA. What does “four 9’s” mean?