Table of Contents for
Practical Cloud Security
Close
Version ebook
/
Retour
Practical Cloud Security
by Chris Dotson
Published by O'Reilly Media, Inc., 2019
Cover
nav
Practical Cloud Security
Practical Cloud Security
Preface
1. Principles and Concepts
2. Data Asset Management and Protection
3. Cloud Asset Management and Protection
4. Identity and Access Management
5. Vulnerability Management
6. Network Security
7. Detecting, Responding, and Recovering from Security Incidents
Index
About the Author(s)
Colophon
Preface
Conventions Used in This Book
Using Code Examples
O’Reilly
How to Contact Us
Acknowledgments
1. Principles and Concepts
Least Privilege
Defense in Depth
Threat Actors, Diagrams, and Trust Boundaries
Cloud Delivery Models
The Cloud Shared Responsibility Model
Risk Management
2. Data Asset Management and Protection
Data Identification and Classification
Example Data Classification Levels
Relevant Industry or Regulatory Requirements
Data Asset Management in Cloud
Tagging Cloud Resources
Protecting Data in the Cloud
Tokenization
Encryption
How encryption foils different types of attacks
Summary
3. Cloud Asset Management and Protection
Differences from Traditional IT
Types of Cloud Assets
Compute assets
Storage assets
Network assets
Asset Management Pipeline
Procurement leaks
Processing leaks
Tooling leaks
Findings leaks
Tagging Cloud Assets
Summary
4. Identity and Access Management
Differences from Traditional IT
Life cycle for identity and access
Request
Approve
Create, Delete, Grant, or Revoke
Authentication
Cloud IAM Identities
Business-to-Customer and Business-to-Employee
Multi-Factor Authentication
Passwords and API keys
Shared IDs
Federated Identity
Single Sign On
Instance Metadata and Identity Documents
Secrets Management
Authorization
Centralized Authorization
Roles
Revalidate
Putting it all together in the Sample Application
Summary
5. Vulnerability Management
Differences from Traditional IT
Vulnerable areas
Data Access
Application
Middleware
Operating System
Network
Virtualized Infrastructure
Physical Infrastructure
Finding and Fixing Vulnerabilities
Network vulnerability scanners
Agentless scanners and configuration management
Agent-based scanners and configuration management
Cloud provider security management tools
Container scanners
Dynamic application scanners (DAST)
Static code scanners (SAST)
Software Composition Analysis (SCA)
Interactive code scanners (IAST)
Runtime application self-protection (RASP)
Manual code reviews
Penetration tests
User reports
Example tools for vulnerability and configuration management
Risk Management Processes
Vulnerability Management Metrics
Tool coverage
Mean time to remediate
Systems/applications with open vulnerabilities
Percentage of false positives
Percentage of false negatives
Vulnerability recurrence rate
Change Management
Putting it all together in the Sample Application
Summary
6. Network Security
Differences from Traditional IT
Concepts and Definitions
Whitelists and Blacklists
DMZ
Proxies
Software Defined Networking (SDN)
Network Features Virtualization (NFV) or Virtual Network Functions (VNFs)
Overlay Networks and Encapsulation
Virtual Private Cloud (VPC)
Network Address Translation (NAT)
IPv6
Putting it all together in the sample application
Encryption in Motion
Firewalls and Network Segmentation
Allow Administrative Access
Web Application Firewalls and RASP
Anti-DDoS
Intrusion detection and prevention systems
Egress Filtering
Data Loss Prevention
Summary
7. Detecting, Responding, and Recovering from Security Incidents
Differences from Traditional IT
What to Watch
Privileged user access
Logs from defensive tooling
Cloud Service Logs and Metrics
Operating System Logs and Metrics
Middleware logs
Secrets Server
Your Application
How to Watch
Aggregation and Retention
Parsing logs
Searching and Correlation
Alerting and Automated Response
Security Information and Event Managers (SIEMs)
Threat Hunting
Preparing for an Incident
Team
Plans
Tools
Responding to an Incident
Cyber Kill Chains
The OODA loop
Cloud Forensics
Blocking Unauthorized Access
Stopping data exfiltration and command and control
Recovery
Redeploying IT systems
Notifications
Lessons Learned
Example Metrics
Example Tools for Detection, Response, and Recovery
Putting it all together in the sample application
Monitoring the Protective Systems
Monitoring the Application
Monitoring the Administrators
Understanding the Auditing Infrastructure
Summary
Index