Thank you for watching
Hi everyone! Welcome back to Sintra Pranayam Life Show! I am your host Sintra Pranayam and I am back with another episode of Ask Me Anything with you
And in this episode I am really excited. We have very exciting guests coming up today
We are going to talk about lots of cloud and TKLT. Before we go ahead and do that, if you are someone who is joining us for the very first time
I say we stream actually up to 8 days in a week
We do multi-streams in a day and almost like all days. So quick reminder that this is the episode number 31 of Ask Me Anything
We have been doing many other shows. For instance, on Monday we had an AI show
The result was the entire ecosystem of the services that Azure has to provide in the AI machine learning
Then on Tuesday, we have product showcase and coffee break shows. Then we do video podcasts, chit-chat with techies, talk about their life journey
And it is more like informal meet-up activities. Then on Wednesday, we have a free chat corner MVP show where we feature one of the community leaders
and talk about their journey in the field of community and followed by technical sessions
The other day, we had, actually this morning, we had Lakshweta from Seattle to talk about
My Photograph. That video is available on the chat corner. You can definitely go and watch it
Then on Thursday, as it is today, okay, so this time is going to be like Thursday, December
I don't know, you know, daylight time, as an Asian, for me, it's very challenging to keep up with the daylight time
They would just change sometimes. But the fifth time is then in Eastern on every Thursday, we do Ask Me Anything show where we invite a guest
ask them, is there anything, followed by a technical session too. So, one of my favorite shows
Then on Friday, we have Growth Mindset, where that show is hosted by the founder of Malaysian
who talks about that you just don't have to keep on putting your entire life beyond the program
and involve in some managerial decisions. He's a leader. That's what that shows about
And another show on Saturday that we do is by David McArthur, who is a 14-time Microsoft MVP
He invites people from the entire ecosystem of .NET. He has a big tribute to Matt Ferguson, .NET director Scott Hunter, Kendra Evans, and many more amazing folks in his show
Apart from that, we also have a consensus that we do. And if you want to go ahead and stay updated with anything that's happening on C Sharp.Lite
just visit CSharp.Lite at their given destination, and you will find us streaming almost every day
Having said that, in today's episode of Asking Anything, we have Vijeta, who is a – I'm going to read her bio, right
I usually mess up with the bio, so I'm just going to read her bio. She's a program manager and a technical evangelist, which means she would always go ahead and take many different events and conferences
She has experience in implementing strategies and training globally to provide a competitive edge to organizations in diverse
involved and custom environments. Currently, she is working on her passion to demystify cloud technology using web comics, animated videos by harnessing the power of storytelling and analogies
A storyteller and a technical enthusiast by heart, she wanted to use her experience to grow, give back to the profession and community
and make technology accessible, fast, scalable, and reliable. I'm really excited to go ahead and host her
So, without any further ado, let me invite our guest, Vijeta. Hi, Vijeta. How are you
Hello. Hi, Dhiraj. How are you, Stephen? I'm doing great. So, Vijeta, thank you so much for accepting the invitation
We really appreciate your time for all that you do for the community, right
We really love that. So, thank you so much once again for accepting the invitation
I think reading your bio, though, looks really amazing. But if you like to just go ahead and do a quick introduction of you, so that people watching can get to know you and what you do
Perfect. So, I'm Vijeta, like you just mentioned. I'm currently following my passion to demystify cloud computing and even emerging technologies for that matter, using the power of storytelling and analogies
So, I'm the creator and writer of clouddemystify.com. And there, actually, I'm using storytelling and simple analogies, doodles, to demystify cloud fundamentals, best practices, and just anything around cloud technologies
Apart from that, I'm also giving a lot of talk shows and presentations, academy presentations as well, just to follow my passion
So, right now. And, like, people who have visited my website know already, I have a toddler, I have a two-year-old at home
So, creativity really provides me with the fuel to look after her
It's exhausting. So, this is like, yeah. So, that is where I am at right now
And before this, I had worked as a program manager at Alchemist Technologies
And that is where I got introduced to on-premise infrastructure. And because I was just at the center stage, I could realize how difficult it is to maintain that infrastructure, all the things associated with it
And that's where I started exploring cloud computing. And here I am right now
So, that is my brief bio. Do you need anything else? Yeah, I will go ahead and switch it back
But, you know, you did tell that also the diagram section says that you are more into this cloud, right
And when I go ahead and check your blog and your profile, it seems that you are more inclined towards Google Cloud, right
So, you know, you do usually, in the AWS, and I have your camera, you usually talk a lot about these
So, what made you go ahead and move your career into Google Cloud
What was something that you liked about it? That a project was coming up, so that's why you moved
Or you kind of liked it? What's the background with that? Yeah, so very simple background with that is I wanted to learn more about cloud computing
I went to Coursera, and the first course that came up when I searched for cloud computing was Google
So, just long story short. And I didn't know what I started exploring it
So, I explored AWS, I explored GCP, I explored Azure. I'm not saying one is better than the other, but some days GCP stood out more to me
So, it spoke well to me. And also, I mean, since it was so new and innovative, it's still a niche market out there
Because of that, I realized that it has a lot of potential to grow
I mean, it's not perfect, and it's not as widely adopted as AWS, to be frank
But at the same time, yeah, I think it really spoke well to me
And all the AI capabilities it has, the flexible pricing models, just some things, yeah
But just long story short, I think it was just sheer luck that I found GCP as the first course for cloud computing when I went to study
That's not interesting that you went ahead to go learn something and you find GCP and fell in love with it
To be honest, I've not interviewed many people who come from the GCP background
So, when you go and get started, it will be pretty interesting to see what GCP has to offer and all that
Yes, I think it's definitely trying to find Google. And Google is an amazing company
So, definitely they have an amazing product coming up. So, Vipin Chetan, today we're going to talk about cloud security in the next few slides
So, all the people who will be joining us in the next 25 minutes and all that, what people should be actually expecting that they're going to cover in the next 25 minutes
Yeah, so I'm just going to scratch the surface of security. I'm not going to do a lot of deep dive into it
So, this is more of an introduction to an intermediate sector. So, I'm going to talk about what cloud security means
And I'm going to use a very creative approach to explain cloud security
And you'll see that once I start the presentation. And after that, I'm just going to talk about security threat model, security shared responsibilities, and then open the ground for questions and answers
So, like I said, it's going to be very basic. I'm going to scratch the surface, but I'm going to do a little bit of deep dive in between as well
So, this is what you can expect. I'm really excited with it
I mean, GCP, I'm really excited. So, more on the technical part, I did research yourself in the QI.com, and I see some really amazing content that you have added over there
I'm really excited for it. You can go ahead and pull your screen, your web screen, and then I'm going to pull back on the live screen, and then you can go ahead and get started. Okay
Thank you so much, Shikman. I will do that. So, just want to make my screen visible
Yeah, that's what you said, and I'll add it into the screen. Perfect
So, let me start. Yeah. So, I'm just going to start with a small presentation now
I'm going to start with the process to demystify cloud security. So, since organizations host their infrastructure, applications, and data on the cloud, it is very important to secure them
Now, what is cloud security? Cloud security consists of technologies, processes, policies, and controls to secure applications on the cloud
No matter which service is provided by any of these public, private, or hybrid cloud providers, it is important to understand the security threats and design models to mitigate them
There can be security attacks from inside or outside the organization, and it is helpful to either have clear policies and processes in place to ensure safety
I'll talk a little bit about these threats and best practices to mitigate them as we go on, but before that, I want to tell you a story
I'm going to talk about the story of the three little pigs who are in the forest to start their own adventure
You may be wondering why I'm going to tell you a story, but you'll understand that once I start
So, the three little pigs decided to move out of their house into the big, dark forest filled with animals and predators
The first thing they needed to do was build their own houses
The first pig decided to build a house of straw. The second pig decided to build a house of clay
And the third pig decided to build a house of bricks. Now, it is important to remember this since the stability of these houses reflect on the strength of the security measures
The straw house being the weakest and the brick house being the strongest
The pigs went about building their houses, they were having a nice time
So, when the pigs were enjoying their freedom, a very bad wolf was spotted lurking around
The wolf was hungry, obviously, and just wanted to do some mischief. So, the pigs were actually monitoring their surroundings and found the intruder
They realized that the big, bad wolf can attract them anytime. This helped them get inside the houses on time and lock their doors
Remember, monitoring is extremely important when it comes to cloud security because it helps organizations prevent any unwanted attacks by strengthening the security measures
The big, bad wolf approached the first pig and asked him to let him in
The wolf was an outsider and didn't have access to the house. So, this process of giving proper access to organizations or groups is very important because it helps to decide who can access what data and prevent any unnecessary breaches or changes
This concept is called identity access management. This I'm going to explain in some time
So, since the wolf didn't get access to the house, he decided to try something else
He decided to blow it down. The wolf huffed and puffed and he blew the entire house down
Now, unfortunately, the first pig left all of his goodies out in the open
He didn't secure them. Because of this, the wolf got access to all the goodies and he couldn't walk outside with that
Now, what I've told you right now is one important practice that the pig missed
It's the practice of encryption. The wolf stole all the goodies because the pig did not follow an important security-based practice of encryption
What is encryption? Encryption simply means protecting the data in secret code just to hide its true meaning from outsiders
The wolf was able to get in and steal all of that
Next, the wolf was still hungry. He decided to go to the next house and he went to the straw house, clay house, sorry, which was built by the second pig
The wolf asked the pig to let him in. And as usual, the second pig had also secured the house and the wolf did not get access to that
He huffed and he puffed and he blew the house down. Now, the only difference here is the second pig thankfully had secured all of the belongings in a vault
Even though the wolf could get inside, he was not able to access the goodies and the belongings
He was dejected. And dejected, he went out. What the second pig did, different from the first pig, was to follow an important practice of encryption
He encrypted all the goodies or all the data into a vault and secured it
So even if the wolf was able to breathe and get inside the system, he was not able to access the goodies
The wolf was still hungry. He went to the third pig. He asked the third pig to let him in
The third pig had also secured the house with a lock and did not let the wolf come inside
Again, all the three pigs, if you remember, followed the important practice of identity access management
They identified that the wolf was an outsider and they did not let the wolf come in
The wolf decided to use the same trick as he did with the first two pigs
He huffed and he puffed and he tried to blow the house down. He tried a couple of times, but if you remember, the third pig had built a house made out of bricks
And it's not simple to blow a house of bricks down. The wolf was dejected
He didn't know what to do. He started just roaming around and planning on some other alternatives
And he realized that a chimney of the house was open. He went and he jumped inside the house through the chimney
What the wolf here did was he found a vulnerability in a very strong system
So the entire house was really strong. It was made of bricks, but then it had one vulnerability
It had an open chimney. The wolf went and he jumped inside the chimney to get access
This way, the wolf was able to get access. This third pig had to take on the pig and had to mitigate the security attack
The third pig went and he lit the fireplace on fire. Because he lit the fireplace on fire, there was smoke coming up the chimney and the wolf realized it's impossible for him to get in
He ran away dejected. And with this story, all the three pigs and the wolf learned an important lesson
So why do I tell you this story about the three little pigs
I did this just to explain the entire concept of cloud security
All the three pigs have three houses. Think of these three houses as three different applications that you want to host on the cloud
All these applications need to have a really strong foundation and all the security best practices that need to be followed
The wolf was able to get inside the first house because its structure was weak
However, he was unable to get access to the goodies. He managed to get inside the second house for the exact same reason
But because the goodies were secure, he was unable to access them
The third house had a really strong foundation. He was not able to get inside the house
But he found a vulnerability and tried to enter. The third pig just thought on its feet and he mitigated that attack by lighting the fireplace on fire
So this is how the story goes. And now, why did I tell you this story
Because I wanted to use a popular story to remove cloud security out of the realm of education and situate it in our day-to-day life
So if you didn't learn anything with this story, I will just waste your time
You learned a lot. Let's see what you have learned. So the three little houses, the three houses were all in the public space, which is rendered open and vulnerable to the big bad wolves and all attachment predators
So even though all the houses had a good system, somehow in their own ways they were vulnerable
Since the fourth pig was actively monitoring the surroundings and had a good lock on the storehouse door, he was able to keep the wolf out
However, this house had very strong active monitoring and firewalls. The belongings inside were left open and not secure and the pig didn't even try to touch the frame of the house before
Just going by this, the first house had really strong monitoring and alerting system because the pig was monitoring outside and saw that the wolf was lurking by
The first house also had really strong firewalls, as in the wolf could not get inside or see inside, although the pig was able to see outside
So basically it was a one-way communication, which was completely secure. However, what the first house lacked was a really strong security model
The house was made of sticks, so it was easy to blow it down. There is a weak encryption
The goodies were left out in the open and vulnerable and there was no vulnerability testing
The pig did not try to touch the house before establishing it, just to make sure it was safe from any attack from the wolf
Because of this reason, the wolf was able to get inside and steal all the goodies
Let's talk about the second house. The second house also had really strong monitoring and alerting because we saw that the second pig was monitoring and we saw the wolf lurking around
It had really strong encryption because the second pig had stored all the goodies inside a vault
So even though the wolf could get in, he was unable to access the goodies
And it had really strong firewalls. The pig was able to recognize that the wolf is an outsider and not let him in
However, just like the first house, it did have a vulnerability testing
The second pig did not test to make sure the house was stable and it also had a very weak structure
It was easy to blow down clay houses. The third house was different than these two in that it had a really strong security model
The foundation was strong. It was made of bricks. So unless there was a cyclone or there was a natural calamity, it was not possible to blow it down with a mere house and a pup fireball
It also had strong monitoring and alerting encryption as well as it had really strong firewalls
However, the wolf was able to get in just because of one vulnerability, the kidney
So the third pig should have done vulnerability testing to make sure that the structure was really rock solid and no one could get inside
So because of this vulnerability, the wolf was able to get inside
But as we see, the security mitigation is also very important when it comes to cloud security
The pig was able to mitigate the attack and there was no harm done to him or his friends or the goodies
So I just give you a moment to breathe this in and then we'll move on
Yeah, so organizations have to host infrastructure on a shared space in the cloud, which is very similar to the houses we saw in the forest
This means the burden is able to attack, attack the people inside as well as outside the organization
It is a shared responsibility of the cloud providers and the users of the organization to ensure security, best practices and compliance with strong regulatory standards
Just because your house has a lock doesn't mean that it is safe from the big bad wolf
The wolf can also find other ways. He can blow the house down. He can get in through the kidney
Similarly, attackers can use active affluent password means to get inside your system and your data can get compromised
So let's talk about the kinds of attacks now, because it's important to understand and just think from the mindset of the attacker to understand what are the types of attacks that can happen
What is the threat model we have and what we should do to make sure that doesn't happen
So moving on, broadly classified, there are two types of attacks which we can expect for the data on cloud
The first attack is called active attack. This is actually a direct attack on the data after breaching or making use of any vulnerabilities
The very foundation of this attack is the method. So the intruder can get inside. These firewall rules, inconsistent IAM rules, IAM means Identity Access Management rules or other character in the structure can provide access to the intruders to get inside to get to your data
The next type of attack is passive attack. Using this method, the attacker manipulates the system and gets inside using password-registering means
So they lurk around, keep a watch and just watch out for any slippages to get inside the data
This kind of attack is extremely dangerous since organizations can miss noticing the intruder, which may, for example, lead to big databases
I'll just give you an example. Someone can impersonate you when you're working for a company, pretend to be the employer of a company and get access to the data
This is a great habit because people might not even notice that someone else is there accessing the data
So just to address any of these attacks, we need to have a really strong foundation
What do I mean by foundation? By this, I mean really strong policies, processes and designation of roles and responsibilities
Now just think of this as a foundation of the house. If the foundation is strong, heavy rain, wind or any other thing won't damage it that much
So having a strong foundation is extremely important. So the second one we have is monitoring
You need to actively monitor any suspicious activities that is happening from outside
So this can prevent any attackers from manipulating the system. Think of this as a CCTV, which monitors suspicious people or activities on your property just so you can take necessary action before any damage happens
I keep mentioning the word shared responsibility again and again, and I'm going to mention it once more
Security is the responsibility of both the cloud providers and the organization
Having a very strong security system is really important because users need to be vigilant and monitor any suspicious activities which might compromise their data
Now let's talk about a security model, which was created by Microsoft, but it is used extensively in the industry right now to understand the types of attacks you can expect on cloud applications
This model is called the STRIVE model. STRIVE is an acronym that stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Allegation of Privilege
The reason I'm mentioning the STRIVE model is because we need to think from the mind of an attacker
What kind of attacks can happen? Because once we do that, we'll be able to mitigate or even prevent those attacks from happening in the first place
Now let's start with the first letter. What is spoofing? Spoofing basically uses someone's identity or a false identity to gain access into the system
This attack is a violation of confidentiality since the attacker is using the identity of someone else to gain access to the data
For example, an attacker can use the identity of a company's employee and gain the credentials to gain access to some confidential data
That is why it is very important to have your username, system or even your address's identity secure
since anyone can misuse them by pretending to be you. Having a really strong password, password rotation, key management services, all of this is very important to prevent this kind of attack from happening
Now, the second letter is T. And T stands for tampering. Just as the word, just what the word says, this means making unauthorized changes to the data, whether it is in transit or in storage
Simply put, it tampers with the data, active or stored, and it is a violation of integrity as well as availability
Using this, the attackers can make some important data unavailable to the user, causing system failures or even causing the entire system to crash
Having really strong policies and clearly defined rules can help prevent this kind of attack from happening
Organizations should provide authority to only a select few to make changes to the data
Otherwise, anyone can get inside, make changes to the data and make them unavailable on a very important occasion for the user
For example, they can get inside a popular shopping website and make it unavailable during Thanksgiving
Now you can imagine the kind of losses that would incur. Now, the next letter we have is R, where R stands for retaliation
This means the ability of the attacker to deny any activity or action to be performed
The attacker can gain unauthorized access and prevent an important action from taking place
This is a violation of confidentiality. For example, the attackers can stop users from going to the next page of a website or the next level of a popular game
What would this do? This would make the users lose trust in the website or the organization and also cause a lot of financial loss
This would cause a lot of inconvenience and also sometimes loss of revenue
Again, having clearly defined policies and processes can help mitigate this kind of attack
I'm going to move on to the next letter, which is I, where I stands for information disclosure
This simply means disclosing unauthorized information by the attacker. The attackers can gain access to confidential or private information and distribute them to others
This is a violation of confidentiality. For example, the attackers can gain access to a confidential document on the website and misuse it to compromise the security of the users
This attack stems from a weak access process and the confidential information should have multiple layers of security to make sure it is secure
It is not just going, logging in and accessing the data, but there needs to be either dual or multiple layers of security to make sure any confidential data or any confidential document is kept secure on the cloud
Every employee, internal or external, needs to go through a very solid authentication process, whether it is dual or multiple, in order to access confidential data
The next letter we have is B. This is a very common attack, which all of you might have heard at some point or the other, and it is called denial of service or DOS
Basically, this simply means overloading a website or application with a lot of traffic so it is not able to handle the load and this causes it to go down
This is a violation of availability. Hackers use bots or online robots to send a huge amount of corrective requests or traffic, bringing down the entire system
Having a strong foundation, ability to monitor and prevent access to bots can help this attack from happening
The capture numbers or image selection you see while you are trying to access websites are just to make sure you are not a robot and you are actually a real person
This is a very common kind of attack and, like I said, having strong policies and processes is extremely important
The last letter which I am going to talk about is E. The E stands for Elevation of Privilege
Just as the word means, it means that the attacker can give themselves more access than what was granted to them
For example, the manager must have given someone a viewer access but they can change that access to editor just to make some unwanted changes
This is a violation of confidentiality, integrity as well as availability. Having strong processes around access control and authentication is necessary to prevent this attack from happening
This is one of the most dangerous attacks since the attacker or the hacker has unlimited access to do any kind of damage they want
because they can elevate their privilege to anything they want. They can be an owner as well
This kind of attack is really dangerous. Now, since I talked about all of these threats and attacks, it is very important to understand what responsibility is there to ensure security
Is it the responsibility of the cloud provider? Is it the responsibility of the organization
In short, it is the responsibility of both of them. There is a shared security model which we need to follow in order to secure the applications on the cloud
I'll just move on. Talking about shared responsibility, what I'm going to do right now is break this down into services
The first service is IaaS or Infrastructure as a Service. The second is Platform as a Service and the third is Software as a Service
This falls under cloud fundamentals. I'm not going to go too much into detail
It basically means getting infrastructure services through the cloud. The second one would be getting a platform to host your applications where you are responsible for your applications and the data
Software as a Service just means getting a software where the people can go and write their own code
These are the three basic models that cloud providers give. I'm going to break this down into responsibility of people
By people, I mean people inside and outside the organization. Data, that is the data that is there in your applications on the cloud
Third is applications. These can be applications that are running on the cloud
The last one is the operating system, the operating system of your applications
Talking about the shared security responsibility. Each of these offerings have people, data, and applications and operating systems, like I mentioned, which needs to be kept safe from attackers
The cloud providers and users are equally responsible for ensuring the safety, depending upon the services which they are hosting
Let's start with the security model for infrastructure as a service, or IaaS offerings
Since IaaS are highly customizable in nature, the users are responsible for the software and the operating system configuration
The users of the organizations are responsible for ensuring the safety of people, data, applications, as well as the operating system
Basically, whenever you take infrastructure as a service, since I'm well-acquainted with Google Cloud Platform, it's kind of a compute engine
As soon as you have that in place, you need to make sure that you have kept the people, data, applications, and the operating system sector, and it is your responsibility
Just because it is so highly customizable in nature and not as managed as software as a service, or platform as a service, it provides the organizations with flexibility as well as responsibility
So, with responsibility, security is a very important concern. Now, let's move on to platform as a service, or SaaS
This provides organizations with the hardware and the operating system, like I mentioned
So, the operating system falls under the responsibility of the cloud providers, where they have to manage system factors, security policies, important security updates, and the organization is responsible for people, data, and applications
And like I mentioned, operating system security falls under the cloud providers
This doesn't mean that you can just wash your hands of security measures. You have to stay on top of what is happening
It's just that the cloud provider is responsible for the security factors and maintenance of the operating system
The third model we have is SaaS, or software as a service
This provides organizations with the software and hardware services, and the users just need to go inside and write their code or document
Because it is such a hands-off offering, cloud providers are responsible for ensuring the security of their applications as well as the operating system, and the organization is still in charge of people and data
So, talking about this, for software as a service, the organization is responsible for ensuring the safety of people, for the data on the cloud, that is, they need to make sure it is encrypted and it is safe, even if a predator gets inside
So, the organization is responsible for that, but as far as the application and operating system goes, the cloud provider is responsible for this
Now, it is important that under no circumstances can organizations wash their hands of security
They are responsible for ensuring the security of their applications, operating system, and overall, they have to overlook whatever is happening on the cloud
So, that is why I am mentioning the word shared responsibility as far as active monitoring
The organizations cannot just take it for granted that the cloud provider is making sure the application and the operating system is safe and not watch out for monitoring services
They have to monitor whatever is happening. So, remember, security is a shared responsibility of both the cloud providers and the organizations, which follows a mix of strong foundation and active monitoring, like I mentioned before
Just because you have a house or a brick house with a strong structure does not mean that it is safe from these bad rules
You need to be careful and vigilant of your belongings, and it is important not to trust anyone inside or outside your organization, and keep policies and processes equal for everyone
You cannot have a different set of policies for people inside your organization and a different set of policies for people outside
Now, take a moment to digest this, and then I will move on to security best practices using which you can ensure safety for your data on the cloud
So, take a moment to digest this. Security best practices
We have almost moved to the end of the presentation. The first one is identity access management, or IAM, which I had mentioned before
Every internal and external user should only get access to the data they need access to on the cloud
You're already following this by spreading documents on Google Documents or Office 365, for example
You give editor access only to people who need to edit the document, right
This is called the principle of least privilege. You only give your access to people or groups who don't need to edit the data in your application
This can ensure that no one tampers with the code. Going back to the Three Little Pigs example, the Three Little Pigs had policies which allowed their friends to come inside the house with a knock just because they had given them insider privilege
But the minute they saw the big bad wolf, they did not allow the wolf to come inside because they knew the wolf was an intruder
So having clear policies around identity and access is important to secure your applications on the cloud
Next, we have is active monitoring or keeping an eye out on any unwanted users from malicious activities
I have mentioned this a lot of times during the presentation. The good news here is that all cloud providers have free monitoring services using which you can prepare gaffers and keep anything seems out of place
So why not make best use of that, right? This can ensure that proactive responses by ensuring the hackers don't do any damage
Think of it like a CCTV outside your house. You're monitoring to make sure there's no malicious activity happening or no one is just trying to get inside your house
Next, we have data encryption. With this, the data is converted into a secret code that hides its true meaning
Have you ever encountered your password getting converted into some weird, simple password you had within a box
That is because it gets encrypted. This way, attackers or hackers won't be able to understand a word of the data, even if they somehow managed to get access to it
This is important because encryption needs to be for people inside as well as outside the organization
You cannot compromise your users' data or people who trust you with their data by leaving it out in the open
Going back to the three little pigs example, this is like the goodies for the second pig and the third pig
They have secured it inside a wall, so even if these were gone inside, you are unable to access it
Next, we have testing. This basically means attacking the code or the application from within to test its durability
A team of testers within an organization look for loopholes in the code or the user interface before attackers can gain access to them
This way, the organization can fix any vulnerabilities before an outsider can access them
This is what the three little pigs were missing. They did not test their own structure. They just took it for granted that it was safe because that is how much their knowledge went
If they had someone to test the structure, the first pig would have realized that the storehouse was so easy to blow down
Similarly, the second pig and the third pig would have noticed that the chimney has easy access for intruders
So, testing is very, very important. You should not undermine the value of testers and testing
Next, we have establishing and managing firewalls. A firewall, like I mentioned, is nothing but a barrier attached to the system, avoiding any intruders from getting inside
This blocks any unauthorized access inside the system while allowing for outward communication
For example, Amazon can publish updates to their shopping website and let you shop, but you cannot get inside their system and make changes
So, it is a one-way communication just to make sure that there is data going outward, but no one can get inside the system
So, having really strong firewall rules are very important to secure your application
Now, remember, all of the security best practices are to ensure your data is secure on the cloud
Having a zero-trust model or simply not trusting anyone inside or outside the organization is very important
And it is necessary for ensuring the high level of security of your data
Anyone can impersonate an employee on gaining access to the system rights. That is why it is important to do that
Have your policies and authentication safe for everyone. Define policies well. Keep testing your code from within the organization and keep your data in an encrypted format
Now, I move on to the final slide and I'll give you a little brief about what we talked about now
Cloud providers are either public, private, or hybrid in nature. They provide infrastructure, platform, or software services
And security is the shared responsibility of the cloud provider and the organization
Understanding the type of cloud provider you have chosen as well as the type of service you have chosen is very important to understand your shared security responsibility model
Organizations as well as the cloud providers are responsible for ensuring safety
And it is necessary to establish a really robust security model before moving your data on the cloud
Security is also very important for moving your data on the cloud or cloud migration
And it is an ongoing responsibility because there are new policies, new processes that come up
So, staying in touch with all the regulatory and compliance requirements as well as the new best practices that crop up
This is not an exhaustive list. It can keep changing and new things can keep getting added to it
So, that is the responsibility of everyone. I'll do one thing. I'll just give you a moment to breathe and process all of this and then I'll open the floor for questions
Stephen, do you want to open the ground for questions now? That was an amazing question. I really enjoyed sitting back and listening to everything
You covered the entire system starting point, what cloud security is, you covered everything in tips and all that
I really loved it. I think it was a very detailed question
Quickly, I wanted to go ahead and add a slide that had cloud service providers and IaaS SaaS application
What I could actually feel is that in the IaaS, it's more about the person, it's more responsibility on the individual and the organization
And as we move towards SaaS, it's really leaving some of the responsibilities on the cloud service provider
So, a quick question here is if someone wants to go ahead and think about cloud security, which model should they go for
Should they go for SaaS, SaaS, SaaS? What do you think should work best in any generic environment or situation
I think it completely depends upon the kind of services the people need
So, cloud service providers, they should have all of these. So, if they, for example, have a developer who just wants to go in and write a code, this SaaS application is best for them
They can just get inside and they can concentrate on their code without having to worry about the underlying infrastructure or even maintenance of that
Because security, maintenance, and all the other infrastructure needs are taken care of by the cloud providers
With that, of course, the security and last part of the security is also covered by the cloud providers
However, if they want a more customizable model, like if they want to host their own website and they want to host their own operating system
I'll give a very simple example. If you want to go and create a PC game on Google Cloud Platform, you will take the iOS offering because in that you can choose your own operating system and kernel
And it is highly customizable. But this highly customizable, you also have the added responsibility of managing your services on your own
So, that's just a long story short. It will depend upon the kind of use case people have
But with each of these models, the security responsibility also alters. Yeah, you did mention a couple of times about shared responsibility, both the responsibility of the organization and the cloud service provider to go ahead and take care of the data
And interesting, in the beginning and also in the transition, you did mention about increased feedback and how important it is
And I love that comment that you stated. So, what specific data transmissions that are happening should be included
I know API needs to be done. Then SAP request should be done
What other kind of data should be encrypted? Any solution for that? Sure
So, just in short, any data that is either in transit or at rest should be encrypted
So, even if you have data that you're storing, you should not take it for granted
Even if it is something like a storage bucket that you're not going to access in the next 10 years, you still need to have the data sector
There are policies around that. So, even that data, any data you're storing or any data that is moving through your application needs to be encrypted in the best way possible
That makes sense. I mean, usually people would get, if they have a hot storage and a cold storage, they would really worry about data that's in hot storage
They would take care of it. But I think even the data that is not in use, that's not worth that
They could also take care of it. So, there's so much to go ahead and take care and this is perfect
I kind of messed with the background. So, there's so much to answer about the cloud securities, right
And it may be very challenging to go ahead and while the application is in development, it's in the security process, it may be very challenging to have a look at it
So, is there any tool or something that the cloud service provider provides to go ahead and monitor on how well is their application working on security basis
Is there any metrics that they provide? Anything like that? Yeah, so each cloud provider has something different
Because I'm well-experienced with GCP, so they have monitoring systems. Like you can have monitoring dashboards in which you can see if there is anything suspicious, anything that seems out of place
So, that helps you assess the overall health of not only your application, but also the security breaches that might happen or that's about to happen
So, every cloud provider has a different one. So, definitely they have a lot of tools and services
And making use of monitoring and alerting dashboards. Sometimes you might want to do it 24-7, but then you have an alert that's popping up, which makes you realize that something is out of place
So, that is extremely important. Yeah, monitoring is something that I think organizations are using a lot
And it has grown and it has grown really mature. And yeah, I think monitoring is something people should look
So, quick, quick, one last question. This is out of my curiosity, right
I know Eleanor is talking about that, hey, blockchain is going to help make your system better
It's going to look at your transitions and make it more secure
So, do you think blockchain will anyway in the near future or maybe in the next 10 years help this cloud security in any way to help the transitions or something
Do you think that will happen? That's a very loaded question. So, yeah, I think it completely depends upon how well it evolves
So, yeah, both of these spaces are extremely vulnerable, like I mentioned
So, even the cloud provider, it's a public cloud provider. So, I use all the businesses, simple example, like a house
And you are occupying that house when you move out. Someone else occupies that house
Or even a more shared space where a public cloud provider, like two people stay inside a pager or a hostel, for example
So, it's an open space. You have your own space, which you need to secure
So, and similarly, when it comes, when we talk about blockchain, it has its own security concerns
But at the same time, yeah, like I said, we just need to see how it evolves. It's a very loaded question for me to answer in yes or no right now
Yeah, I'm just really curious because people, we face a lot of like forums, conferences, where they talk about how blockchain is going to help in terms of security, your foundations, and everything on that
And also, we see Bitcoin doing a lot of things, which is not blockchain. I know this is an example of blockchain
But that was a pretty great session, Ritu. Thank you so much
We really enjoyed it. We're going to put it on archive so that people can come back and watch it
Any last thing you want to go ahead and say before we just wrap it up
I see you're going to put your clouddemystify.com so everyone can go ahead and see that
Any last words you want to say before we close it? So, I want to leave any questions that people want to answer
Maybe I'll just give them a moment or two to absorb the entire presentation and ask if they have any questions
And I see one conclusion at the comment. Like I said, it is very important to understand the overall structure and the overall foundation of cloud before even going into cloud security
If you don't know what a cloud provider is when it comes to public, private, or hybrid cloud providers, or even what the services are all about
So, infrastructure or even blockchain as a service, which we talked about right now, which is also coming into the cloud
So, once you understand the entire model behind that, we have a strong foundation
It is only then that we can secure our data on the cloud. Just one note here. I've seen many people being apprehensive of the cloud
They keep telling me it's a shared space. So, that means it is vulnerable to attacks
Is the data safe and secure? I just want to reiterate out there that it is secure in this
I mean, if you just look at the broader scheme of things, whether it is cloud or on-premise
I've seen the kind of trouble that comes with on-premise infrastructure as well
So, sometimes even something as simple as, hey, the cable got stolen from the data center
I've heard that also happens. It is crazy out there. But at the same time, when it comes to cloud, you have the backing of the cloud provider
their experience, and everything that they have dealt with. But it's also a shared responsibility
You can't wash your hands of, is it secure, the security model we choose. So, just one note, not to be afraid of moving to the cloud just because of security concerns
They have a lot more policies and processes we can think about. They have compliance measures, like they have FedRAMP compliance, PCI compliance
just depending on the type of data you have on the cloud. So, that's just what I wanted to put in there
Yeah, thank you. But that's great because, you know, we recently moved from right space to right space
Like we moved entirely to the right space. I'm not going to say why it was it
Because we got attacked. We got attacked. I think maybe right space won't just help us
So, we had to kind of go ahead and move to right space
We moved everything to ITF. Earlier we were somewhere on AWS, Google Cloud, and right space
Now we move everything on ITF. And it's all good. It's all smooth
It runs everything well. They take care of a lot of it. They have very secure data centers
No one can just step in. So, that helps the cloud is a good space
Quick last question, Vijeta. If someone wants to go ahead and learn more about cloud security
what are the resources you would suggest to people to wrap up
I have a lot of resources out there. So, I mentioned them on the website as well
So, if you go to clouddemystify.com and you click on cloud security, I have some resources
I think it's copy-pasted. Actually, I don't have the resources here right now
I'm so sorry. But, yeah, definitely going through any of the courses, like I said, course-related things to do that
Or just going, all the cloud providers have great documentation as well
So, if you go on their website, we have documentation around security best practices
and all the security tools and services available. So, just depending upon the cloud provider, because everyone has a different security protocol
So, it's better to just deep dive and then get an overview of what cloud security is all about
So, definitely that would be really helpful. And if the users are interested, I can always write an article with all the resources that they would find helpful
on cloud security and C-Sharp. So, they can leverage that as well
Yes, that sounds interesting. So, thank you so much, Lisa. That was amazing
Thank you so much for your time. I, Vin Simon, on behalf of the entire C-Sharp corner, would like to thank you for all that you do for the community
And we would love to have you back when you're available. Maybe when you move back to India
That would be exciting. We do these offerings on sensors in Delhi
Definitely, you can move there too. So, we would love to host you in those offline conferences too
So, thank you so much, Lisa. And thank you, everyone, for joining. And we will see you in the next particular meeting
All right, everyone. Thank you. Thank you. Thank you so much, Jason
Thank you, everyone. Bye-bye. Bye-bye