Cloud Concepts, Architecture and Design · Topic 3 of 5
Security Concepts for Cloud Computing
CCSP cloud security concepts: key management, identity, sanitization and crypto erase, network and virtualization security, cloud threats and hygiene.
- 5 min
- Key control options run from provider managed to customer held keys outside the provider.
- Protect the management plane first: privileged access to it controls everything.
- Cryptographic erase is the customer's practical sanitization method in the cloud.
What it is
The classic security concepts still apply in the cloud, but each one changes shape. You cannot shred a provider's disk, so sanitization becomes cryptographic erase.
You cannot plug in a firewall appliance, so network controls become software rules. Tenants share hardware, so isolation becomes the core virtualization concern.
This page gives the cloud version of each concept the outline lists. Later domains go deeper into each one.
How it works
Cryptography and key management
Encrypt data at rest, in transit (TLS) and, where possible, in use (confidential computing). The hard part is the keys: who generates, stores, rotates and can use them.
| Key option | Who controls the key | Note |
|---|---|---|
| Provider managed | Provider | Simplest; protects against stolen media only |
| Customer managed in provider KMS | Customer controls policy and rotation | Common balance of control and ease |
| Bring your own key (BYOK) | Customer generates, imports to provider | Provider service still uses the key |
| Hold your own key (HYOK) or external key manager | Customer keeps keys outside the provider | Most control; reduces provider features |
Keys should be stored separately from the data they protect, ideally in an HSM.
Identity and access control
Three kinds of access need control:
- User access: people using applications, ideally through federated identity with MFA.
- Privileged access: administrators of the management plane, protected with strong MFA, just in time elevation and session recording.
- Service access: workloads calling other services, using roles and short lived credentials rather than embedded keys.
Compromise of the management plane console or API gives control over everything in the account, so privileged access is the highest priority.
Data and media sanitization
Customers cannot physically destroy provider media. Options are:
- Overwriting: writing patterns over storage. Unreliable in the cloud because you do not control where data was physically written or replicated.
- Cryptographic erase (crypto shredding): encrypt the data, then destroy every copy of the key. The ciphertext that remains is unreadable.
NIST SP 800-88 treats cryptographic erase as a valid sanitization technique when the encryption and key destruction are sound. Physical destruction of drives remains the provider's job and should appear in its audit reports.
Network security
| Control | Cloud form |
|---|---|
| Network security groups | Stateful filtering rules applied to instances, interfaces or subnets |
| Traffic inspection | Virtual firewalls, IDS and IPS, traffic mirroring to inspection tools |
| Geofencing | Restricting access or resource creation by geographic location or region |
| Segmentation | Separate virtual networks and subnets per tier or tenant |
A deny by default rule set, with only needed ports open from needed sources, is the baseline.
Virtualization security
- Hypervisor security: the hypervisor is a high value target because escaping a guest to the hypervisor exposes every tenant on the host.
- Container security: containers share the host kernel, so isolation is weaker than between virtual machines; scan images and run with least privilege.
- Ephemeral computing: short lived instances limit attacker persistence but also destroy evidence unless logs are shipped off the instance.
- Serverless technology: the provider runs the runtime; the customer secures code, permissions and event triggers.
- Isolation: the property all of these protect, between tenants and between workloads.
Common cloud threats
Recent CSA Top Threats reports (earlier editions were known as the Treacherous Twelve and Egregious Eleven) rank misconfiguration, identity and access management failures, insecure interfaces and APIs and lack of cloud security strategy near the top. Other common threats are account hijacking, data breaches, insider threats, insecure third-party resources, denial of service and abuse of cloud services.
Security hygiene
| Practice | Meaning |
|---|---|
| Patching | Apply fixes promptly; in PaaS and SaaS the provider patches its layers |
| Baselining | Define an approved secure configuration and detect drift from it |
| Hardening | Remove unneeded services, accounts and ports |
| Immutable architecture | Never modify running servers; replace them with new instances built from an updated image |
Immutable architecture makes patching a rebuild and removes configuration drift.
A worked example
A retailer decommissions a customer database hosted in IaaS. Its policy says to overwrite disks three times. The architect points out that block storage may have been moved, snapshotted and replicated by the provider, so overwriting the visible volume does not reach all copies.
The architect instead confirms the volumes and snapshots were encrypted with a customer managed key, deletes the data and snapshots, then schedules destruction of the key. The provider's SOC 2 report covers physical drive destruction.
How the exam asks about this
- "What is the MOST reliable way for a customer to sanitize data stored with a public cloud provider?" Cryptographic erase.
- "Which component, if compromised, gives an attacker control of all resources in a cloud account?" The management plane.
- "Servers are replaced rather than patched in place. What principle is this?" Immutable architecture.
What to remember for the exam
- Key control options run from provider managed to customer held keys outside the provider.
- Protect the management plane first: privileged access to it controls everything.
- Cryptographic erase is the customer's practical sanitization method in the cloud.
- Containers share a kernel, so they isolate less strongly than virtual machines.
- Misconfiguration and identity failures are the most common real causes of cloud breaches.
Ephemeral and serverless workloads disappear with their local logs. Send logs to central storage, or the evidence of an attack disappears when the instance does.
Common mistakes
Keeping keys with the data. Encryption keys stored in the same account and protected by the same credentials as the data add little protection.
Relying on overwriting. You cannot see every physical location your data reached in a provider's storage.
Treating containers as virtual machines. A kernel exploit in one container can affect others on the same host.
Check yourself
What does cryptographic erase rely on?
Data being encrypted with a sound algorithm, and every copy of the key being securely destroyed so the remaining ciphertext cannot be read.
What are the three kinds of access the CCSP outline names?
User access, privileged access and service access, each of which needs its own controls.
What is immutable architecture?
An approach where running servers are never changed; updates are made by building and deploying new instances from an updated image.
Topic 3 of 5 in Cloud Concepts, Architecture and Design
Test yourself on Cloud Concepts, Architecture and Design
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.