Tackling Security Challenges in Cloud Computing, Explained

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 8.7 Free with a free account

Tackling Security Challenges in Cloud Computing

System Analysis and Design · Chapter 8: Maintenance, Risk, and SecuritySection 8.7 · lesson 59 of 698 min · free with a free account

← Multi-Layered Systems Security: Firewalls, Encryption, Authentication, and Data Center Protection StrategiesNext lesson: What Makes Up Project Management? Components and Characteristics →

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

Shared responsibility, misconfiguration, IAM, multi-tenancy, data residency, and CASBs.

  • Explain the shared responsibility model across IaaS, PaaS, and SaaS
  • Explain misconfiguration, and cloud identity and access management
  • Explain multi-tenancy, data residency, and compliance
  • Explain what a CASB is and what it does

Transcript

Everything said in the video, section by section (1,017 words). Read along, or search it.

Maintenance, Risk, and Security

Security Challenges in the Cloud

Moving to the cloud changes who does what for security. But it never removes the customer from the picture. This section covers the shared responsibility model, the misconfigurations behind many incidents, and cloud identity and access management. Then multi-tenancy, data residency and compliance, and a tool built for cloud security, the C A S B.

Shared Responsibility

The Vendor Does Not Take It All

Moving a system to the cloud does not hand all security responsibility to the vendor. The shared responsibility model divides security duties between the cloud provider and the customer organization. Where that line falls depends on the deployment option, on-premises, I A A S, P A A S, or S A A S. As more of the technical stack is handed to the vendor, more of the security responsibility for that stack goes with it. It is often summarized like this. The provider is responsible for security of the cloud. The customer remains responsible for security in the cloud.

Figure 8.3

How Responsibility Shifts

Here is how the split shifts, layer by layer. With I A A S, the provider secures the physical hardware, the network, and the host operating system and virtualization. The customer secures the runtime and middleware, the application, and data and identity. With P A A S, the provider also takes on the runtime and middleware. With S A A S, the provider even manages the application itself. But look at the top row. Data and identity stay with the customer in every single model. Even under S A A S, the customer still decides who can access its data, and keeps that access properly controlled.

Misconfiguration

A Leading Cause of Cloud Incidents

A large share of real-world cloud security incidents trace back, not to a sophisticated attack, but to a misconfiguration. That is a security setting the customer was responsible for, and simply set incorrectly. A storage container might be left open to the public internet, when it should have been restricted. A user or service might be granted far more access than its role actually requires. A resource might still use the vendor's default username and password. Or sensitive data might be stored without encryption, even though the option was available. Every one of these sits on the customer's side of the shared responsibility line. So misconfiguration is a risk no matter how much of the stack the vendor manages.

Cloud IAM

Who Gets In, and What They Can Do

Identity and access management, or I A M, is the set of practices and tools that control who can access a cloud resource, and what they can do there. It rests on two ideas. Authentication verifies that a user or service really is who it claims to be, such as requiring multi-factor authentication at login, not just a password. Authorization determines what an authenticated user or service is allowed to do. A support agent, for example, might get read-only access to customer records, rather than full edit access. A guiding rule is the principle of least privilege. Every user, service, or system gets only the access it actually needs to do its job, and nothing more. That limits how much damage one compromised account, or one misconfigured permission, can actually cause.

Multi-Tenancy

Shared Hardware, Separate Customers

Public cloud providers get much of their efficiency from multi-tenancy. Many customers, called tenants, share the same underlying physical infrastructure. The provider keeps each tenant's resources separated logically, rather than physically. That logical separation is what makes cloud computing cost-effective. But it brings a security concern that dedicated, single-tenant hardware does not have. If the provider's isolation between tenants ever fails, one customer's data could become visible to another. So judging how seriously a provider treats tenant isolation is part of assessing any multi-tenant service.

Data Residency and Compliance

Where Is the Data, Really?

Data residency is the physical, or geographic, location where an organization's data is actually stored. It matters because different countries and regions impose different legal requirements on data. And a cloud provider's data centers may be spread across many locations worldwide. A healthcare organization, or a company under a law requiring data to stay within one country's borders, needs to know, and often control, exactly where its data lives. Using a cloud vendor does not transfer compliance obligations to that vendor. The organization stays accountable for the rules that apply to its data, even when a third party hosts it. That is why cloud contracts often specify exactly which regions data may be stored and processed in.

CASBs

Cloud Access Security Brokers

A cloud access security broker, or C A S B, is a security tool that sits between an organization's users and the cloud services they use. It gives the organization visibility into cloud activity, and one place to enforce security policy across many services at once. A C A S B typically discovers which cloud services employees actually use, including ones I T never approved. It enforces data loss prevention rules. It controls access based on context, such as the device or the location. And it flags risky or unusual activity. Picture a hospital whose staff use a dozen different S A A S applications. A C A S B gives it one consistent place to apply policy across all of them, rather than configuring each service separately.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. The shared responsibility model describes how security duties split between the provider and the customer. A misconfiguration is a customer-owned security setting that was set incorrectly. Least privilege means granting only the access that is needed, and nothing more. Multi-tenancy means customers share infrastructure, separated logically. Data residency is where data is physically stored. And a C A S B brokers visibility and policy across an organization's cloud services.

Key Takeaways

What to Carry Forward

To pull this together. The shared responsibility split shifts across I A A S, P A A S, and S A A S, but data and identity always remain the customer's responsibility. Misconfiguration, not sophisticated attack, is a leading cause of real-world cloud security incidents. Cloud I A M rests on authentication and authorization, guided by the principle of least privilege. Multi-tenancy adds the risk of isolation failure, and compliance obligations stay with the customer, even when a vendor hosts the data. And a C A S B gives visibility, and consistent policy enforcement, across the many cloud services an organization uses.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Tackling Security Challenges in Cloud Computing

What is the shared responsibility model in cloud computing?
The shared responsibility model divides security duties between the cloud provider and the customer. It is often summarized as the provider handling security of the cloud and the customer handling security in the cloud. The provider takes on more of the stack moving from IaaS to PaaS to SaaS, but data and identity remain the customer's responsibility in every model.
What causes most cloud security breaches?
A large share of real-world cloud security incidents trace back to misconfiguration rather than sophisticated attacks. Common examples include a storage container left open to the public internet, a user or service granted far more access than its role needs, a resource still using the vendor's default credentials, and sensitive data stored without encryption. These settings sit on the customer's side of the responsibility line.
What is the principle of least privilege in cloud IAM?
The principle of least privilege means every user, service, or system gets the access it needs to do its job and nothing more. It guides cloud identity and access management, which rests on authentication, verifying who someone is, and authorization, deciding what they may do. A support agent might get read-only access to customer records, limiting the damage a compromised account could cause.
What is a CASB in cloud security?
A cloud access security broker, or CASB, is a security tool that sits between an organization's users and the cloud services they use, giving visibility and one place to enforce policy. It typically discovers which cloud services employees use, including unapproved ones, enforces data loss prevention rules, controls access by context such as device or location, and flags risky or unusual activity.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →