Cloud Security Design Principles

1. The Principle of Least Privilege (PoLP)

We first encountered this principle in the previous lesson when discussing Role-Based Access Control (RBAC). The goal of RBAC is to enforce the Principle of Least Privilege. Let's now formally define and explore it.

Definition: The Principle of Least Privilege (PoLP) is a security concept that dictates a user, program, or system should be given only the minimum levels of access—or permissions—necessary to perform its specific, required functions.

In simple terms: Give access only to what is needed, when it is needed, and nothing more.

This principle aims to limit the potential damage from a compromised account or an insider threat. If an attacker gains control of a user account with minimal privileges, their ability to access sensitive data or disrupt systems is severely restricted.

The following video provides an excellent explanation of PoLP, including common ways it is violated, such as "privilege creep."

Applying the Principle of Least Privilege in the Cloud

PoLP is not just a theoretical concept; it's implemented through concrete actions and tools in the cloud:

• Role-Based Access Control (RBAC): As we learned, you assign users to roles (e.g., 'Database Admin', 'Billing Analyst') that have a pre-defined set of permissions. This prevents over-provisioning individual users with custom, excessive rights.
• IAM Policies: Cloud providers like AWS, Azure, and GCP use IAM policies to grant fine-grained permissions. A well-written policy grants permission only for specific actions (e.g., s3:GetObject) on specific resources (e.g., arn:aws:s3:::my-report-bucket/*).
• System Hardening: This involves reducing a system's attack surface by removing unnecessary software, services, and network ports. For example, if a virtual machine only needs to serve web traffic on port 443, ports like 22 (SSH) or 3389 (RDP) should be firewalled off and accessible only from trusted IP addresses.
• Just-in-Time (JIT) Access: Instead of granting standing privileges, JIT systems provide temporary, elevated access to a resource for a limited time. For instance, a developer might request temporary admin access to a production server for a 30-minute maintenance window, after which the permissions are automatically revoked.
• Regular Access Reviews: Periodically auditing who has access to what and removing any permissions that are no longer required due to job changes or project completions. This combats "privilege creep," where users accumulate more and more permissions over time.

This image provides a simple but powerful visual of PoLP in action.

For a concise written summary of PoLP and its applications, the following resource is useful.

2. Defense in Depth

While PoLP is about limiting the scope of access, Defense in Depth is about creating layers of security to protect assets.

Definition: Defense in Depth is a security strategy that uses multiple, layered security controls to protect an asset. The core idea is that no single security measure is perfect; therefore, a series of redundant and diverse controls provides better protection. If one layer is breached, the subsequent layers are still in place to thwart an attack.

This is often referred to as the "castle analogy": a castle is protected by a moat, a drawbridge, high walls, archer towers, and guards. Each layer provides a distinct form of protection.

Layers of Defense in Depth in the Cloud

Let's watch a video that explains this concept and then map the layers to specific cloud security services.

Now, let's see how these layers are specifically applied in a cloud environment. The following video breaks this down perfectly.

Based on the videos and the diagram, here is a breakdown of the layers and their corresponding cloud security controls, which you should be prepared to list in an exam:

1. Data: This is the core asset to be protected.
   • Controls: Encryption at rest (e.g., encrypting data on S3 buckets or databases) and encryption in transit (using TLS/SSL). Data classification and masking.
2. Application: The software that processes the data.
   • Controls: Secure coding practices, vulnerability scanning, and Web Application Firewalls (WAF) to protect against attacks like SQL injection and Cross-Site Scripting (XSS).
3. Compute (Host): The virtual machines or containers running the applications.
   • Controls: OS patching, anti-malware software, host-based firewalls, and endpoint detection and response (EDR) solutions.
4. Network: The virtual networks connecting your cloud resources.
   • Controls: Virtual Private Clouds (VPCs), subnets, Network Security Groups (NSGs) or firewall rules to enforce the Principle of Least Privilege at the network level, and private connectivity (e.g., AWS PrivateLink, Azure Private Link).
5. Perimeter: The edge of your cloud network.
   • Controls: DDoS mitigation services and edge firewalls.
6. Identity & Access: Controlling who can do what.
   • Controls: IAM, Multi-Factor Authentication (MFA), and implementing the Principle of Least Privilege. This layer is often considered the new perimeter in the cloud.
7. Physical Security: The physical data centers.
   • Controls: Fences, guards, biometric access. This layer is entirely managed by the cloud service provider (CSP).

Conclusion

In this lesson, we explored two foundational principles of cybersecurity that are essential for building secure systems in the cloud. Mastering these concepts is crucial for both practical application and for achieving high marks on your exams.

Key Takeaways:

• Principle of Least Privilege (PoLP): This is a principle of authorization scope. It ensures that entities have only the minimum permissions required to do their jobs. It reduces the "blast radius" of a security breach.
• Defense in Depth: This is a principle of structural security. It involves deploying multiple, layered security controls to protect assets, ensuring that a failure in one layer does not lead to a total system compromise.

These two principles are not mutually exclusive; they are complementary and work together. For example, within a Defense in Depth strategy, the "Identity & Access" and "Network" layers are implemented using the Principle of Least Privilege.

Preview of the Next Lesson:

Having covered the mechanisms (access control models) and philosophies (PoLP, Defense in Depth) of securing cloud resources, we will next turn our attention to the data itself. Our upcoming lesson will address cloud privacy principles, including data ownership and transparency, and the different trust models in cloud computing. We will explore what it means to entrust your data to a third party and how that relationship is governed.