97 Things Every Information Security Professional Should Know

Chapter 29. An Introduction to Security in the Cloud

Gwyneth Peña-Siguenza

The building of the fundamental infrastructure for cloud services on a global scale has been one of the most significant architectural achievements in the past decade.¹ Its connections to the global internet rely on the capacity and security of all its networks, and it is essential that everyone assesses their cloud security in order to develop a strategy to protect their data.

Cloud security is a centralized security system that protects cloud-based systems against external and internal cybersecurity threats. It offers all of the functionality of traditional IT security, delivers 24/7 protection, and reduces administrative overhead.² Cloud security and security management best practices are designed to prevent unauthorized access to keep data private and safe across cloud-based infrastructure, applications, and platforms. The assessment of business resources and needs, through joint responsibility of the cloud customer and cloud solution provider, will determine the approach for integrating a comprehensive security strategy.

The full scope of cloud security, regardless of responsibility, is designed to protect the following components: physical networks, data storage, data servers, computer virtualization frameworks, operating systems, middleware, runtime environments, data, applications, and end-user ...