Cloud Security
S.Venkatesan
Acknowledgement: The contents, example scripts and some figures are copied from various sources.
Thanks to all authors and sources made those contents public and usable for educational purpose
2
NIST reference architecture
Security Requirements
Cloud-based control approach
Statistics
• 92% Enterprises Have a Multi-Cloud Strategy in Place
• 98% of Organizations Experienced a Cloud Security Breach
in Past 18 Months
• 72% of IT Security Leaders Rank Cloud as Top Digital
Transformation Priority
• ~90% of Data Breaches Target Servers
• 96% of Web App Attack-Based Mail Server Compromises
Involve the Cloud
TPM
Google Cloud Security
• Communications over the internet to Google public cloud
services are encrypted in transit.
• To protect DoS Google Cloud Armor
• Identities, users, and services are strongly authenticated.
Access to sensitive data is protected by advanced tools like
phishing-resistant security keys (Titan Security Key).
• Data stored on Google infrastructure is automatically
encrypted at rest and distributed for availability and
reliability.
Layers of encryption
Data at Google is broken up into encrypted
chunks for storage& Key Hierarchy
Protecting Data at Rest on Amazon S3 Glacier
• Data at rest stored in Amazon S3 Glacier is
automatically server-side encrypted using 256-bit
Advanced Encryption Standard (AES-256) with
keys maintained by AWS.
• The encryption key is then encrypted itself using
AES-256 with a master key that is stored in a
secure location.
• The master key is rotated on a regular basis.
Protecting Data at Rest on Amazon RDS
• INSERT INTO Customers (CustomerFirstName,CustomerLastName) VALUES
(AES_ENCRYPT('John',@key), AES_ENCRYPT('Smith',@key);
Harden the VMs – Google Cloud
• Integrity of the VMs will be checked.
• Secure Boot
• Virtual Trust Platform Module (TPM) - Platform
integrity, Disk encryption, Password protection.
• Google Titan Chip (similar to TPM) - securely identify
and authenticate legitimate access at the hardware
level, minimizing the chances of running altered
software.
Harden Your VMs with Shielded Computing
Cloud Next '19
Integrity of the Data
• One of the problems associated with
outsourcing data to cloud service providers is
the data integrity of outsourced data.
• Data integrity encompasses the
– Completeness
– Correctness and
– Freshness
Merkle Tree
Feifei Li, Marios Hadjileftheriou, George Kollios, and Leonid Reyzin, Authenticated Index Structures for Outsourced
Databases Handbooks on Database Security
An Example
Merkle Tree
Radix Path Identifier
Merkle Hash Tree with Radix Path Identifiers
Properties
Single Authentication Table
Level Based Authentication Table
Multi-Join Query
References
• Erik Kajati, Peter Papcun, Chao Liu, Ray Y. Zhong,
Jiri Koziorek, Iveta Zolotova, Cloud based cyber-
physical systems: Network evaluation study,
Advanced Engineering Informatics, Volume 42,
2019.
• https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nists
pecialpublication500-292.pdf
• https://www.apriorit.com/dev-blog/545-
sandbox-evading-malware
