CCSP

all hosts should be physically and logically isolated as much as possible

Tightly coupled:

storage devices are directly connected to a shared physical backplane

each component has same policies and rule sets

enhances perfomance bc it scales

 Loosely coupled:

greater flexibility

each node is indepentant from each other, only logically connected

disc space is apportioned to the customer and is allocated to each of the guest instances

the virtualized OS of the guest can utilize and manipulate the volume

block storage / raw disk storage

analog mounted drive

all data is stored in a filesystem

customers get access to the parts they're assigned to

file storage

user is limited to upload, storing and manipulating files (not installing and running programms)

Temporary ressource that is used for processing

instance store volumes

durable data storage

low cost and large amounts

typically used for archives and backup

not suitable for production

can't install and run programms, but can run queries

for large amounts of data that require time-sensitive communication and low latency

multimedia content

replicates portions of data at data centers physically located nearer to the end user

Human interface devices (Keyboard, Video, Mouse = KVM)

Secure Data Ports

Tamper Labels

Fixed Firmware

Soldered Circuit board

Reduces Buffer

Air-Gapped Pushbuttons

The Electronic Communication Privacy Act 

restricts government from wiretapping phone calls etc.

Graham-Leach-Bliley Act

Allow banks to merge with and own insurance companies

customer account information must be kept secure

Sarbanes-Oxley Act

Increase transparency

To help protect shareholders, employees and the public from accounting errors and fraudulent financial practices.

Health Insurance Portability and Accounability Act

U.S. Federal Law

Protect patient records and data

Family Educational Rights and Privacy Act

Prevent Academic institutions from sharing student data 

Digital Millenium Copyright Act

Update copyright for internet purposes

Clarifying Lawful Overseas Use of Data

Allows US law enforcement to compel American companies to disclose data in foreign data centers

specifically for clound computing

US Federal program that mandates standardizes approach to security assessments of cloud products and services

certification

Canada's Personal Information Protection and Electronic Documents Act

(Canada GDPR)

guidelines for information security controls applicable to could services (based on ISO 27002)

Code of practice and security techniques for processing PII in cloud services

Forensic

Collect, identify and preserve electronic evidence

Forensic

Guide for incident investigation

Forensic

Guide for digital evidence analysis

Forensics

Overview and principles of eDiscovery

American Institute of Certified Public Accounants

SOC 1: useless

SOC 2: reviews controls relevant to security 

SOC 2 Type I: reviews controls as designed

SOC 2 Type II: thorough review of controls

AICPA audit standard

SOC 1: useless (financial stuff)

SOC 2: reviews controls relevant to security 

SOC 2 Type I: reviews controls as designed

SOC 2 Type II: thorough review of controls

1. Cloud Architecture
2. Governing in the Cloud
3. Operating in the Cloud

1. Application & Interface Security (AIS)
2. Audit Assurance & Compliance (AAC)
3. Business Continuity Management & Operational Resilience (BCR)
4. Change Control & Configuration Management (CCC)
5. Data Security & Information Lifecycle Management (DSI)
6. Datacenter Security (DCS)
7. Encryption & Key Management (EKM)
8. Governance & Risk Management (GRM)
9. Human Resources (HRS)
10. Identity & Access Management (IAM)
11. Infrastructure & Virtualization Security (IVS)
12. Interoperability & Portability (IPY)
13. Mobile Security (MOS)
14. Security Incident Management, E-Discovery, & Cloud Forensics (SEF)
15. Supply Chain Management, Transparency, and Accountability (STA)
16. Threat & Vulnerability Management

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

Security and Privacy Controls for Federal Information Systems and Organizations

Resource pooling

on-demand self-service

Broad network access

Rapid elasticity

Measured service meter (utility computing)

provides an overview of cloud computing along with a set of terms and definitions. It is a terminology foundation for cloud computing standards.

All = Application Layer
People= Presentation Layer
Seem = Session Layer
To = Transport Layer
Need = Network Layer
Data = Data Link Layer
Processing = Physical Layer

Infostructure (data and information)

Applistructure (applications deployed in the cloud and application services)

Metastructure (protocols and mechanisms, provides interfaces to Infrastructure Layer)

Infrastructure (core components, moving parts)

 Cloud Computing Security Reference Architecture