Book Image

Enterprise Cloud Security and Governance

By : Zeal Vora
Book Image

Enterprise Cloud Security and Governance

By: Zeal Vora

Overview of this book

Modern day businesses and enterprises are moving to the Cloud, to improve efficiency and speed, achieve flexibility and cost effectiveness, and for on-demand Cloud services. However, enterprise Cloud security remains a major concern because migrating to the public Cloud requires transferring some control over organizational assets to the Cloud provider. There are chances these assets can be mismanaged and therefore, as a Cloud security professional, you need to be armed with techniques to help businesses minimize the risks and misuse of business data. The book starts with the basics of Cloud security and offers an understanding of various policies, governance, and compliance challenges in Cloud. This helps you build a strong foundation before you dive deep into understanding what it takes to design a secured network infrastructure and a well-architected application using various security services in the Cloud environment. Automating security tasks, such as Server Hardening with Ansible, and other automation services, such as Monit, will monitor other security daemons and take the necessary action in case these security daemons are stopped maliciously. In short, this book has everything you need to secure your Cloud environment with. It is your ticket to obtain industry-adopted best practices for developing a secure, highly available, and fault-tolerant architecture for organizations.

Related Content you might be interested in

Current Title:

Small book image
Enterprise Cloud Security and Governance
Zeal Vora
Dec, 2017 | 410 pages
No titles found
Table of Contents (11 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
The Fundamentals of Cloud Security
The Fundamentals of Cloud Security
Getting started
Service models
Deployment models
Cloud security
Why is cloud security considered hard?
Virtualization – cloud's best friend
Enterprise virtualization with oVirt
Service Level Agreement
Business Continuity Planning – Disaster Recovery (BCP/DR)
Policies and governance in cloud
Audit challenges in the cloud
Implementation challenges for controls on CSP side
Vulnerability assessment and penetration testing in the cloud
Summary
2
Defense in Depth Approach
Defense in Depth Approach
The CIA triad
Introducing Defense in Depth
Summary
3
Designing Defensive Network Infrastructure
Designing Defensive Network Infrastructure
Why do we need cryptography?
The TCP/IP model
Firewalls
Application layer security
The IPS functionality
A web application firewall
Network segmentation
Accessing management
Virtual Private Network
Installation of OpenVPN
Approaching private hosted zones for DNS
Summary
4
Server Hardening
Server Hardening
The basic principle of host-based security
Keeping systems up-to-date
Partitioning and LUKS
LUKS
Access control list
SELinux
Hardening system services and applications
Pluggable authentication modules
System auditing with auditd
Hosted Based Intrusion Detection System
The hardened image approach
Summary
5
Cryptography Network Security
Cryptography Network Security
Introduction to cryptography
Types of cryptography
Message authentication codes
Hardware security modules
Key management service
Envelope encryption
Credential management system with KMS
Asymmetric key encryption
Digital signatures
SSL/TLS
Perfect forward secrecy
Online certificate status protocol
OCSP stapling
AWS certificate manager
Summary
6
Automation in Security
Automation in Security
Configuration management
Attaining the desired state with Ansible pull
Terraform
AWS Lambda
Summary
7
Vulnerability, Pentest, and Patch Management
Vulnerability, Pentest, and Patch Management
Introduction to vulnerability assessment
Understanding risks
Risk mitigation
Best practices
Patch management
Organizing servers in groups
Introduction to Docker
Summary
8
Security Logging and Monitoring
Security Logging and Monitoring
Continuous security and monitoring
Choosing the right log monitoring tool
Security Incident and Event Management
Log monitoring is reactive in nature
Summary
9
First Responder
First Responder
Real world use case
Understanding the incident
Holding unexpected simulation
Summary
10
Best Practices
Best Practices
Cloud readiness
Network readiness
Server readiness
Bonus points
Summary

Credential management system with KMS

Software systems generally need to access shared passwords that can be credentials to access database or tokens to access other web applications.

It's not ideally a best practice to store these credentials within the code itself, as there have been many incidents of code leaks or developers pushing code that contains keys to public repositories, which leads to systems getting compromised.

So, we need a secure way to store credentials in an encrypted form and retrieve it on the go from the servers whenever required.

CredStash is a great tool that makes use of envelope encryption to store the shared secrets in DynamoDB (NoSQL database).

Let's look into how it works. Whenever we want to store a credential (username and password ), credstash will call AWS KMS and generate a new data encryption key.

The data encryption key encrypts the...

Previous Section
End of Section 8
Next Section