Book Overview & Buying
Table Of Contents

Enterprise Cloud Security and Governance

By : Vora

Buy this Book

Enterprise Cloud Security and Governance

By: Vora

Buy this Book

Overview of this book

Modern day businesses and enterprises are moving to the Cloud, to improve efficiency and speed, achieve flexibility and cost effectiveness, and for on-demand Cloud services. However, enterprise Cloud security remains a major concern because migrating to the public Cloud requires transferring some control over organizational assets to the Cloud provider. There are chances these assets can be mismanaged and therefore, as a Cloud security professional, you need to be armed with techniques to help businesses minimize the risks and misuse of business data. The book starts with the basics of Cloud security and offers an understanding of various policies, governance, and compliance challenges in Cloud. This helps you build a strong foundation before you dive deep into understanding what it takes to design a secured network infrastructure and a well-architected application using various security services in the Cloud environment. Automating security tasks, such as Server Hardening with Ansible, and other automation services, such as Monit, will monitor other security daemons and take the necessary action in case these security daemons are stopped maliciously. In short, this book has everything you need to secure your Cloud environment with. It is your ticket to obtain industry-adopted best practices for developing a secure, highly available, and fault-tolerant architecture for organizations.

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

The Fundamentals of Cloud Security

Getting started

Service models

Deployment models

Cloud security

Why is cloud security considered hard?

Virtualization – cloud's best friend

Enterprise virtualization with oVirt

Service Level Agreement

Business Continuity Planning – Disaster Recovery (BCP/DR)

Policies and governance in cloud

Audit challenges in the cloud

Implementation challenges for controls on CSP side

Vulnerability assessment and penetration testing in the cloud

Summary

Defense in Depth Approach

The CIA triad

Introducing Defense in Depth

Summary

Designing Defensive Network Infrastructure

Why do we need cryptography?

The TCP/IP model

Firewalls

Application layer security

The IPS functionality

A web application firewall

Network segmentation

Accessing management

Virtual Private Network

Installation of OpenVPN

Approaching private hosted zones for DNS

Summary

Server Hardening

The basic principle of host-based security

Keeping systems up-to-date

Partitioning and LUKS

LUKS

Access control list

SELinux

Hardening system services and applications

Pluggable authentication modules

System auditing with auditd

Hosted Based Intrusion Detection System

The hardened image approach

Summary

Cryptography Network Security

Introduction to cryptography

Types of cryptography

Message authentication codes

Hardware security modules

Key management service

Envelope encryption

Credential management system with KMS

Asymmetric key encryption

Digital signatures

SSL/TLS

Perfect forward secrecy

Online certificate status protocol

OCSP stapling

AWS certificate manager

Summary

Automation in Security

Configuration management

Attaining the desired state with Ansible pull

Terraform

AWS Lambda

Summary

Vulnerability, Pentest, and Patch Management

Introduction to vulnerability assessment

Understanding risks

Risk mitigation

Best practices

Patch management

Organizing servers in groups

Introduction to Docker

Summary

Security Logging and Monitoring

Continuous security and monitoring

Choosing the right log monitoring tool

Security Incident and Event Management

Log monitoring is reactive in nature

Summary

First Responder

Real world use case

Understanding the incident

Holding unexpected simulation

Summary

Best Practices

Cloud readiness

Network readiness

Server readiness

Bonus points

Summary

Server Hardening

Server hardening is a step-by-step approach to secure an operating system and hence reduce the overall surface area for vulnerabilities.

Linux comes with a great set of inbuilt tools, such as iptables, SELinux, PAM, and auditd, that can be used in conjunction with external open source tools, such as OSSEC, LUKS, and Spacewalk to achieve a high level of security posture of any organization.

Just implementing a single set of tools cannot ensure security. We have to use various sets of tools to achieve a particular use case, and in the end, we will have many tools working together to ensure an effective security posture of your server.

Let's look at an example to understand this better. Nowadays, most cars come with a seat belt as a safety feature. However, the driver can choose not to wear the seat belt. Hence, the overall functionality of having a seat belt...

Tech Concepts

Programming languages

Tech Tools