Design Principles of Secure Cloud Computing

What it is

Secure design means building security into a cloud solution from the start instead of adding it after go-live. The CCSP expects you to design around the data lifecycle, plan continuity using the cloud's strengths, justify controls with a business impact analysis, avoid lock-in, and assign responsibilities correctly for each service category.

Design patterns and DevOps security give you repeatable ways to do this at cloud speed.

How it works

Cloud secure data lifecycle

The CSA data lifecycle has six phases. Controls attach to each phase.

Data does not always move through every phase in order, and it can be in several phases at once in different copies.

Cloud based BC and DR planning

The cloud makes continuity cheaper: regions and availability zones, snapshots, and capacity you pay for only when you fail over. It also adds new failure modes, such as a provider wide outage, a lost account or a misconfigured replication rule. Design choices include:

• Spreading workloads across availability zones and, for critical services, across regions.
• Keeping backups in a separate account or with a separate provider so one compromise cannot delete both.
• Using infrastructure as code so the environment can be rebuilt.

Recovery targets (RTO, RPO) and plan testing are covered in Domain 3.

Business impact analysis, CBA and ROI

A business impact analysis identifies critical processes, the impact of their loss over time and the resources they depend on. It produces the recovery priorities and targets that drive design.

Cost-benefit analysis compares the cost of a control with the loss it avoids. Return on investment expresses the benefit as a ratio of the cost.

Expected annual loss without control:  $200,000
Expected annual loss with control:      $50,000
Annual cost of control:                 $60,000
Net benefit = 200,000 - 50,000 - 60,000 = $90,000
ROI = 90,000 / 60,000 = 150%

A cloud migration CBA should include hidden costs: data egress, retraining, dual running and exit costs.

Functional security requirements

Lock-in is not always wrong. A proprietary managed service can be the secure, economic choice if the exit risk is understood and accepted.

Responsibilities by service category

The main SaaS concerns are identity, data handling and configuration. PaaS adds secure code and dependency management. IaaS adds hardening, patching and network design.

Cloud design patterns

• Well-Architected Frameworks: provider guidance organized into pillars, one of which is always security, used to review a design against best practice.
• CSA Enterprise Architecture: a reference architecture from the CSA that combines ideas from SABSA, ITIL, TOGAF and the Jericho Forum, used to plan cloud security capabilities.
• Established security principles taught by SANS and others: least privilege, defense in depth, separation of duties, fail secure, economy of mechanism and complete mediation.
• Secure by design: products should be secure without extra customer effort, with safe defaults and security as a design requirement.

DevOps security

DevSecOps builds security into the pipeline so it keeps pace with frequent releases:

Infrastructure as code templates are scanned for misconfiguration before deployment, and the pipeline itself is protected as a privileged system.

A worked example

An insurer plans to move its claims system to PaaS. The BIA rates claims processing as critical with a maximum tolerable downtime of one day. The design uses two availability zones, daily cross-region backups held in a separate account, and infrastructure as code for rebuild.

The CBA shows the multi-zone design costs less per year than one expected day of lost claims. The architect also records that the managed database is proprietary, notes the exit cost, and the business owner formally accepts that lock-in risk.

How the exam asks about this

• "What should be completed FIRST to decide the recovery priorities for cloud workloads?" A business impact analysis.
• "In which data lifecycle phase should data be classified?" Create.
• "Which approach BEST reduces the risk of vendor lock-in?" Designing with open standards and portable formats, with a documented exit strategy.