Book Image

Enterprise Cloud Security and Governance

By : Zeal Vora
Book Image

Enterprise Cloud Security and Governance

By: Zeal Vora

Overview of this book

Modern day businesses and enterprises are moving to the Cloud, to improve efficiency and speed, achieve flexibility and cost effectiveness, and for on-demand Cloud services. However, enterprise Cloud security remains a major concern because migrating to the public Cloud requires transferring some control over organizational assets to the Cloud provider. There are chances these assets can be mismanaged and therefore, as a Cloud security professional, you need to be armed with techniques to help businesses minimize the risks and misuse of business data. The book starts with the basics of Cloud security and offers an understanding of various policies, governance, and compliance challenges in Cloud. This helps you build a strong foundation before you dive deep into understanding what it takes to design a secured network infrastructure and a well-architected application using various security services in the Cloud environment. Automating security tasks, such as Server Hardening with Ansible, and other automation services, such as Monit, will monitor other security daemons and take the necessary action in case these security daemons are stopped maliciously. In short, this book has everything you need to secure your Cloud environment with. It is your ticket to obtain industry-adopted best practices for developing a secure, highly available, and fault-tolerant architecture for organizations.

Related Content you might be interested in

Current Title:

Small book image
Enterprise Cloud Security and Governance
Zeal Vora
Dec, 2017 | 410 pages
No titles found
Table of Contents (11 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
The Fundamentals of Cloud Security
The Fundamentals of Cloud Security
Getting started
Service models
Deployment models
Cloud security
Why is cloud security considered hard?
Virtualization – cloud's best friend
Enterprise virtualization with oVirt
Service Level Agreement
Business Continuity Planning – Disaster Recovery (BCP/DR)
Policies and governance in cloud
Audit challenges in the cloud
Implementation challenges for controls on CSP side
Vulnerability assessment and penetration testing in the cloud
Summary
2
Defense in Depth Approach
Defense in Depth Approach
The CIA triad
Introducing Defense in Depth
Summary
3
Designing Defensive Network Infrastructure
Designing Defensive Network Infrastructure
Why do we need cryptography?
The TCP/IP model
Firewalls
Application layer security
The IPS functionality
A web application firewall
Network segmentation
Accessing management
Virtual Private Network
Installation of OpenVPN
Approaching private hosted zones for DNS
Summary
4
Server Hardening
Server Hardening
The basic principle of host-based security
Keeping systems up-to-date
Partitioning and LUKS
LUKS
Access control list
SELinux
Hardening system services and applications
Pluggable authentication modules
System auditing with auditd
Hosted Based Intrusion Detection System
The hardened image approach
Summary
5
Cryptography Network Security
Cryptography Network Security
Introduction to cryptography
Types of cryptography
Message authentication codes
Hardware security modules
Key management service
Envelope encryption
Credential management system with KMS
Asymmetric key encryption
Digital signatures
SSL/TLS
Perfect forward secrecy
Online certificate status protocol
OCSP stapling
AWS certificate manager
Summary
6
Automation in Security
Automation in Security
Configuration management
Attaining the desired state with Ansible pull
Terraform
AWS Lambda
Summary
7
Vulnerability, Pentest, and Patch Management
Vulnerability, Pentest, and Patch Management
Introduction to vulnerability assessment
Understanding risks
Risk mitigation
Best practices
Patch management
Organizing servers in groups
Introduction to Docker
Summary
8
Security Logging and Monitoring
Security Logging and Monitoring
Continuous security and monitoring
Choosing the right log monitoring tool
Security Incident and Event Management
Log monitoring is reactive in nature
Summary
9
First Responder
First Responder
Real world use case
Understanding the incident
Holding unexpected simulation
Summary
10
Best Practices
Best Practices
Cloud readiness
Network readiness
Server readiness
Bonus points
Summary

Virtual Private Network

VPN acts somewhat similarly to the proxy that takes in the requests of client and forwards it to the instances on the private subnet. Like bastion, VPN server needs to be on the public subnet so that users can access it.

This is the basic diagram showing how VPN fits into a typical environment:

Although it might look similar to what we had in bastion host, the purpose of VPN is wider than that of bastion hosts. Bastion hosts typically work with SSH and they do key forwarding and all that magic, but it is not meant for protocols other than SSH.

Let's take a use case. There is an application server running on port 8080 on the Private Subnet. The user wants to open the application in the browser, typically via http://Server–IP:8080/.

Since the server is on Private Subnet with a private IP, you won't be able to connect directly.

So, in this...

Previous Section
End of Section 10
Next Section