Principles of Information Security: Cloud Security (Shared Responsibility Model, CASB, IAM)

Cloud Security (Shared Responsibility Model, CASB, IAM)

Cloud Security Study Guide: Shared Responsibility Model, CASB, IAM

For CISSP, Security+, CEH, and Real-World Roles

What This Is

Cloud security ensures data, applications, and infrastructure hosted in cloud environments (AWS, Azure, GCP) are protected from breaches, leaks, and misuse. The Shared Responsibility Model defines who secures what—you (the customer) or the cloud provider—to avoid gaps like misconfigured storage (e.g., the 2017 Verizon breach exposing 14M customer records via an unsecured AWS S3 bucket). Cloud Access Security Brokers (CASBs) act as gatekeepers between users and cloud services, while Identity and Access Management (IAM) controls who gets in and what they can do. Mastering these concepts is critical for passing certs and preventing real-world incidents like ransomware encrypting cloud backups or insiders exfiltrating data via SaaS apps.

Key Terms & Concepts

• Shared Responsibility Model:
  Cloud security is a split duty between the provider (securing the infrastructure) and the customer (securing data, access, and configurations). The split varies by service model:
• IaaS (Infrastructure as a Service): Provider secures physical hardware; you secure OS, apps, and data (e.g., AWS EC2).
• PaaS (Platform as a Service): Provider secures OS/middleware; you secure apps/data (e.g., Azure App Service).

• SaaS (Software as a Service): Provider secures everything except user access and data (e.g., Salesforce, Office 365).
  Standards: NIST SP 800-144, ISO/IEC 27017.

• CASB (Cloud Access Security Broker):
  A security policy enforcement point between users and cloud services (e.g., Netskope, McAfee MVISION, Microsoft Defender for Cloud Apps). Functions:

• Visibility: Discover shadow IT (unapproved SaaS apps).
• Data Protection: Encrypt/tokenize sensitive data (e.g., credit card numbers in Dropbox).
• Threat Protection: Block malware in cloud storage (e.g., OneDrive).

• Compliance: Enforce policies (e.g., block uploads to non-HIPAA-compliant apps).
  OWASP Top 10 for Cloud: A9 (Insecure APIs) often exploited via CASB misconfigurations.

• IAM (Identity and Access Management):
  Controls who (identities) can do what (permissions) on which resources. Key components:

• Authentication: Verify identity (e.g., MFA, OAuth 2.0).
• Authorization: Assign permissions (e.g., AWS IAM policies, Azure RBAC).
• Federation: Single sign-on (SSO) across systems (e.g., SAML 2.0, OpenID Connect).

• Privileged Access Management (PAM): Monitor/administer high-risk accounts (e.g., CyberArk, AWS IAM Access Analyzer).
  Attack Example: 2020 Twitter breach (hackers phished employee credentials to tweet from high-profile accounts).

• Zero Trust:
  "Never trust, always verify"—assume breach and enforce least privilege. Core principles:

• Explicit verification (MFA, device posture checks).
• Least privilege access (just-in-time permissions).

• Assume breach (micro-segmentation, continuous monitoring).
  NIST SP 800-207 defines Zero Trust Architecture (ZTA).

• CSPM (Cloud Security Posture Management):
  Automated tools (e.g., Prisma Cloud, AWS Config) that scan for misconfigurations (e.g., public S3 buckets, open RDP ports) and enforce compliance (e.g., CIS Benchmarks, NIST CSF).
  Example: Capital One’s 2019 breach (misconfigured AWS WAF allowed data exfiltration).

• Data Encryption in the Cloud:

• At rest: AES-256 (e.g., AWS KMS, Azure Disk Encryption).
• In transit: TLS 1.2+ (e.g., HTTPS, VPNs).

• Client-side encryption: You encrypt data before uploading (e.g., Box KeySafe).
  ⚠️ Trap: "Encryption = security" is false—key management (e.g., HSMs) is critical.

• Cloud-Native Security Tools:

• AWS: GuardDuty (threat detection), Inspector (vulnerability scanning), Macie (PII discovery).
• Azure: Defender for Cloud, Sentinel (SIEM), Key Vault.

• GCP: Security Command Center, Chronicle (SIEM).

• Shadow IT:
  Unapproved cloud services used by employees (e.g., personal Dropbox for work files). CASBs detect and block these.
  Risk: Data leaks, compliance violations (e.g., GDPR fines).

• Serverless Security:
  Protecting functions-as-a-service (e.g., AWS Lambda, Azure Functions). Risks:

• Over-permissive roles (e.g., Lambda with * permissions).

• Dependency vulnerabilities (e.g., outdated Node.js packages).
  Defense: Least privilege IAM roles, static code analysis (e.g., Checkov).

• Cloud Compliance Frameworks:

• NIST CSF: Voluntary best practices (Identify, Protect, Detect, Respond, Recover).
• ISO 27017: Cloud-specific controls (e.g., virtual machine isolation).
• FedRAMP: U.S. government cloud security standard.
• GDPR: EU data protection (e.g., "right to erasure" in SaaS apps).

Step-by-Step: Applying Cloud Security

1. Define Your Shared Responsibility Model

• Step 1: Identify your cloud service model (IaaS/PaaS/SaaS).
• Example: Using AWS EC2 (IaaS) → you secure the OS; AWS secures the hypervisor.
• Step 2: Map responsibilities using the provider’s documentation (e.g., AWS Shared Responsibility Model).
• Step 3: Document gaps (e.g., "We’re responsible for patching EC2 instances, but AWS handles physical security").

2. Deploy a CASB for Visibility & Control

• Step 1: Discover shadow IT (e.g., Netskope’s "Cloud Risk Assessment").
• Step 2: Classify data (e.g., tag PII in Salesforce using DLP policies).
• Step 3: Enforce policies (e.g., block downloads from unmanaged devices to Box).
• Step 4: Monitor for anomalies (e.g., 10GB upload to Google Drive at 3 AM).

3. Harden IAM with Least Privilege

• Step 1: Inventory identities (users, service accounts, APIs).
• Tool: AWS IAM Access Analyzer, Azure AD Identity Protection.
• Step 2: Apply least privilege (e.g., grant s3:GetObject instead of s3:*).
• Step 3: Enable MFA for all human accounts (e.g., TOTP, FIDO2).
• Step 4: Rotate credentials (e.g., AWS IAM access keys every 90 days).
• Step 5: Audit permissions (e.g., "Who has admin access to our GCP project?").

4. Automate Compliance with CSPM

• Step 1: Scan for misconfigurations (e.g., public S3 buckets, open security groups).
• Tool: Prisma Cloud, AWS Config Rules.
• Step 2: Remediate (e.g., auto-close ports in Azure NSGs).
• Step 3: Enforce baselines (e.g., CIS AWS Foundations Benchmark).
• Step 4: Generate reports for auditors (e.g., SOC 2, ISO 27001).

5. Encrypt Data End-to-End

• Step 1: Enable encryption at rest (e.g., AWS EBS volumes with KMS).
• Step 2: Enforce TLS 1.2+ for all data in transit (e.g., Azure Front Door).
• Step 3: Use client-side encryption for highly sensitive data (e.g., AWS KMS with envelope encryption).
• Step 4: Manage keys securely (e.g., AWS CloudHSM, Azure Key Vault).

Common Mistakes

Certification Exam Tips

CISSP

• Shared Responsibility Model: Know the exact split for IaaS/PaaS/SaaS. Trap: "Who secures the OS in PaaS?" (Answer: Provider.)
• IAM: Focus on federation (SAML/OIDC) and PAM (e.g., CyberArk). Trap: "Which protocol is used for SSO?" (Answer: SAML 2.0, not OAuth.)
• CASB: Understand the 4 pillars (Visibility, Compliance, Data Security, Threat Protection). Trap: "CASBs replace firewalls" (False—they complement them).

Security+

• Cloud Models: Memorize IaaS/PaaS/SaaS definitions and examples (e.g., EC2 = IaaS, Lambda = PaaS).
• IAM: Know MFA methods (TOTP, HOTP, FIDO2) and RBAC vs. ABAC.
• Encryption: Differentiate at rest (AES-256) vs. in transit (TLS). Trap: "SSL is secure" (False—TLS 1.2+ is required).

CEH

• Cloud Attacks: Focus on misconfigured storage (e.g., S3 buckets) and IAM privilege escalation (e.g., iam:CreatePolicyVersion).
• CASB Bypass: Know how attackers evade CASBs (e.g., using personal devices or unsanctioned apps).
• Tools: Be familiar with ScoutSuite (cloud misconfiguration scanner) and Pacu (AWS exploitation framework).

Quick Check Questions

1. A company uses AWS Lambda (serverless) to process customer data. Under the Shared Responsibility Model, which of the following is the customer’s responsibility?

• A) Patching the underlying OS
• B) Securing the hypervisor
• C) Managing IAM permissions for the Lambda function
• D) Physical security of the data center

Answer: C) Managing IAM permissions for the Lambda function.
Explanation: In PaaS (Lambda), the provider secures the infrastructure (OS, hypervisor, physical security); you secure access and data.

2. An organization wants to block employees from uploading sensitive files to personal Google Drive accounts. Which tool should they deploy?

• A) SIEM
• B) CASB
• C) WAF
• D) IDS

Answer: B) CASB.
Explanation: A CASB provides data protection and shadow IT control by enforcing policies on cloud apps (e.g., blocking uploads to unsanctioned services).

3. During an audit, a security team discovers that an AWS IAM user has s3:* permissions on all S3 buckets. Which principle is violated?

• A) Separation of Duties
• B) Least Privilege
• C) Defense in Depth
• D) Job Rotation

Answer: B) Least Privilege.
Explanation: Least privilege requires granting only the minimum permissions needed (s3:GetObject instead of s3:*).

Last-Minute Cram Sheet

1. Shared Responsibility Model:
2. IaaS: You secure OS, apps, data.
3. PaaS: You secure apps, data.

4. SaaS: You secure data, access.

5. CASB 4 Pillars: Visibility, Compliance, Data Security, Threat Protection.

6. IAM Core Components: Authentication (MFA), Authorization (RBAC), Federation (SAML/OIDC).

7. Zero Trust: "Never trust, always verify" (NIST SP 800-207).

8. CSPM Tools: AWS Config, Prisma Cloud, Azure Defender for Cloud.

9. Encryption:

10. At rest: AES-256 (AWS KMS, Azure Disk Encryption).

11. In transit: TLS 1.2+.

12. Cloud Compliance: NIST CSF, ISO 27017, FedRAMP, GDPR.

13. ⚠️ Exam Trap: "Cloud provider secures everything in SaaS" (False—you secure data/access).

14. Ports to Remember:

15. HTTPS: 443 (TLS).
16. SSH: 22 (secure remote access).

17. RDP: 3389 (⚠️ often exposed in cloud misconfigurations).

18. Key Formula: ALE = SLE × ARO (Annualized Loss Expectancy = Single Loss Expectancy × Annual Rate of Occurrence). Used for cloud risk assessments.