Narrator: These days, cloud computing
seems to be the big trend within our industry.
With the promise of increased availability,
higher resiliency, and unlimited elasticity,
the cloud definitely can provide our organizations
with a lot of advantages
over traditional network architectures.
But cloud computing can also bring numerous
unique security challenges
into our environments that we must be aware of.
To better understand these,
we first have to look at the different types
of cloud solutions and architectures
that are currently available in the environments.
There are six types of cloud deployment models available,
public,
private,
hybrid,
community,
multitenancy,
and single tendency.
The most common type of cloud architecture
is the public cloud.
Under this model,
a service provider makes resources available
to end users over the internet.
There are numerous public cloud solutions available today
including those from Google, Microsoft, and Amazon.
For example, Google Drive is a public cloud service
that's offered both free and on a pay per use model.
Now public clouds can often be an inexpensive way
for an organization to gain a required service
both quickly and efficiently.
The second option is a private cloud.
This service requires
that a company creates its own cloud environment
that only it can utilize as an internal enterprise resource.
With a private cloud,
the organization's responsible for the design,
implementation, and operation of the cloud resources
and servers that host them.
For example, the United States government
runs its own private cloud known as GovCloud.
And this is used by different organizations
within the government.
But your company and my company can't get access to it
and use it like we would with Google Drive or AWS or Azure.
Generally, a private cloud is going to be chosen
with security is more important to your organization
than having a lower cost.
A hybrid cloud solution can combine the benefits
of both public and private cloud options.
Under this architecture,
some resources are going to be developed and operated
by the organization itself,
much like a private cloud would be,
but the organization can also utilize
some publicly available resources
or outsource services to another service provider,
like the public cloud does.
Because of the mixture of public
and private cloud resources,
strict rules should be applied
for whatever type of data is being hosted
in each portion of the hybrid cloud.
For example, any confidential information should be hosted
in the organization's private cloud portion.
The fourth option is a community cloud.
Under this model, the resources and costs
are shared among several different organizations
who all have a common service need.
This is similar to taking several private clouds
and connecting them all together to lower the cost.
The security challenges here
is going to be that each organization
may have their own security controls
and we have to mitigate that
as we combine these things together.
Remember, if you connect your network to another network,
you're inheriting their security risks as well.
This doesn't change just because we moved
into the cloud environment.
Now, in addition to the four cloud deployment models,
we also have to look at the other two models
that you need to be aware of.
This is multitenancy and single tendency.
The first one here is multitenancy model.
Under this model, the same resources are used
by multiple organizations.
This allows for a large gain in efficiency
because most organizations don't use all the capacity
of a single server or set of servers.
But when two or more organizations
are sharing the same physical resource,
you're going to have some security concerns here.
For example, if your website is hosted on a shared server
with 20 other customers,
and one of those customers is the victim
of a denial service attack,
that entire server will be undergoing that same attack.
And this can also make your stuff go offline
as collateral damage
during the denial service against that other server.
Now, this is just one of the dangers and risks
assumed under a multitenancy model.
To combat the risk assumed under a multitenancy model,
there's also a single user model known as single tenancy.
Now under this model, a single organization is assigned
to a particular resource.
Because of this,
single tenancy solutions tend to be less efficient
than multitenancy solutions.
And they're also more expensive
because it requires more hardware to run it properly.
So which of these six models or combination of these models
is going to be right for your organization?
Well, that really depends upon your security needs
and your cost restrictions and your risk tolerance.
It is going to be cheapest for you to use a multitenancy model
with the public cloud model being combined together.
But this also increases the risk
to your information's confidentiality and availability.
As with many things we consider as security practitioners,
there is no single right answer here,
instead, it's our job to weigh the benefits
and the drawbacks of each of these models
and then decide which is the right one
based upon our organization's specific needs and concerns.