97 Things Every Information Security Professional Should Know

Chapter 66. Cloud Security

Nathan Chung

The more things change, the more they stay the same. In the 1960s and 1970s, computing models used mainframes where computing power was centralized. In the 1980s and 1990s, the world shifted to client servers that use the distributed computing model. Now cloud computing is the new normal. Some people call mainframes the cloud before the cloud. It is now essential for cybersecurity professionals to know how to attack and defend the cloud since it is a key skill.

When Amazon introduced Amazon Web Services (AWS) in 2006, cloud computing went mainstream. AWS quickly became the top cloud computing provider in the world with Microsoft and Google introducing cloud services a few years after. Common cloud models include software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS). By moving computing resources to a cloud provider, significant amounts of money, energy, and resources are saved while allowing computing resources to be scalable as well as available on demand; this is known as elasticity. In 2020, at the height of the COVID-19 pandemic, the global workforce shifted to remote work, accelerating migrations to the cloud. It is often assumed that cloud computing resources are more resilient to cyberattacks, but that is unfortunately not true.

Cloud resources, especially in public clouds, are hosted on ...