Enterprise Virtual, Cloud, and Wireless Network Protection · Topic 3 of 5
Cloud Fundamentals, Security and Evaluating a Provider
Learn cloud computing fundamentals, cloud security insights and how to evaluate a cloud service provider before consuming a service, for the CND exam.
- 5 min
- The five characteristics are on demand self service, broad network access, resource pooling, rapid elasticity and measured service.
- IaaS gives the customer the most control, SaaS the least.
- The customer always owns its data and its access control.
What it is
Cloud computing delivers computing resources over a network, on demand, from a shared pool run by a cloud service provider (CSP). The customer pays for what it uses instead of owning the hardware.
Cloud security is about knowing which part of the stack the customer must protect, and checking that the provider meets your requirements before you move data there.
How it works
Cloud computing fundamentals
NIST SP 800-145 defines the cloud with five essential characteristics, three service models and four deployment models.
| Characteristic | Meaning |
|---|---|
| On demand self service | The customer provisions resources without contacting the provider |
| Broad network access | Services are reached over the network from many device types |
| Resource pooling | Resources are shared across many customers (multi-tenancy) |
| Rapid elasticity | Capacity scales up and down quickly |
| Measured service | Usage is metered and billed |
| Service model | The customer manages | Example |
|---|---|---|
| IaaS (infrastructure) | Operating system, applications, data | Virtual machines, storage |
| PaaS (platform) | Applications and data | A managed runtime or database platform |
| SaaS (software) | Only data and user access | Hosted email or CRM |
| Deployment model | Description |
|---|---|
| Public | Run by a provider for many customers |
| Private | Used by one organization, on site or hosted |
| Community | Shared by organizations with common concerns |
| Hybrid | Two or more models linked together |
NIST SP 500-292 describes the cloud actors: consumer, provider, auditor, broker and carrier.
Insights of cloud security
The shared responsibility model divides the work. The provider secures the cloud itself (facilities, hardware, hypervisor). The customer secures what it puts in the cloud (data, identities, configuration). The more managed the service, the more the provider handles, but the customer always owns its data and its access control.
Main cloud risks:
- Misconfiguration such as public storage or open network rules
- Weak identity and access management, and leaked keys
- Insecure APIs and management interfaces
- Data loss, lack of visibility and shadow IT
- Multi-tenancy and compliance gaps
Core cloud controls:
| Control | Purpose |
|---|---|
| IAM with MFA and least privilege | Limit who can do what |
| Encryption at rest and in transit | Protect data, with keys under customer control where needed |
| Logging and monitoring | See who did what |
| CSPM | Find misconfiguration and drift |
| CASB | Enforce policy between users and cloud services, and find shadow IT |
| Backup and recovery | Survive loss and ransomware |
Evaluating a CSP before consuming a service
Do the assessment before signing, and repeat it at renewal. The questions fall into a few groups.
| Area | What to check |
|---|---|
| Assurance | Independent audits and certifications such as ISO/IEC 27001, ISO/IEC 27017 (cloud controls), ISO/IEC 27018 (personal data in cloud), SOC 2 Type II and the CSA STAR program |
| Compliance fit | Support for your rules, such as PCI DSS, HIPAA or GDPR, and FedRAMP for US government work |
| Data location | Where data is stored and processed, and whether you can restrict regions |
| Data protection | Encryption options, key management, who can access your data and how it is deleted |
| Availability | The service level agreement (SLA), uptime, redundancy and disaster recovery |
| Incident handling | How and how fast the provider reports a breach to you |
| Access and audit | Logs you can obtain, and your right to audit or review reports |
| Subcontractors | Which third parties handle your data |
| Exit | Data portability, return and deletion when the contract ends, and risk of vendor lock in |
| Financial and legal | Provider stability, liability terms and applicable law |
An SLA mainly covers availability and support, not security. Security duties and breach notice must be written in the contract.
A worked example
A company wants to place customer records with a new SaaS vendor. The vendor offers a low price and a 99.9 percent uptime SLA, but cannot show an independent audit, will not say where data is stored, and gives no commitment on breach notification.
Uptime alone does not meet the need. The defender requires a SOC 2 Type II or ISO/IEC 27001 report, a stated data location, encryption with clear key control, and a breach notification clause before approval.
How the exam asks about this
- "Under the shared responsibility model, who is always responsible for the customer's data?" → The customer.
- "Which cloud model is used by a single organization?" → Private cloud.
- "Which cloud characteristic means usage is metered and billed?" → Measured service.
What to remember for the exam
- The five characteristics are on demand self service, broad network access, resource pooling, rapid elasticity and measured service.
- IaaS gives the customer the most control, SaaS the least.
- The customer always owns its data and its access control.
- Check certifications, data location, SLA, incident notice, audit rights and exit terms before choosing a CSP.
- A CASB governs use of cloud services, and CSPM checks configuration.
A provider certification covers the provider's part only. It does not make the customer's own configuration secure.
Common mistakes
Assuming the provider secures everything. Misconfigured access and open storage are customer problems.
Choosing on price and uptime. An SLA does not prove security or compliance.
Skipping the exit plan. If you cannot get your data back, you are locked in.
Check yourself
Which service model gives the customer the most responsibility?
IaaS, because the customer manages the operating system and above.
Name two things to check about a CSP's data handling.
Where the data is stored, and how it is encrypted and deleted.
What does a hybrid cloud combine?
Two or more deployment models, such as private and public, linked together.
Topic 3 of 5 in Enterprise Virtual, Cloud, and Wireless Network Protection
Test yourself on Enterprise Virtual, Cloud, and Wireless Network Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.