Modern Defense in Depth

Chapter 4. How to Achieve the Integrated Approach

In this chapter, we cover the concept of cloud edge and cloud core and what technologies reside within each. Because you will hear these terms often when working with cloud environments, it makes sense to cover these terms first. The purpose of this discussion surrounding edge and core is to understand that you cannot effectively protect the core without adequately protecting the edge first. But how can organizations achieve integration with all the defensive lines previously discussed in Chapter 3? And what are the pros and cons of on-premises security operation centers (SOCs) versus outsourced SOCs? Let’s take a look at the terms “cloud edge” and “cloud core” first, before moving on to the discuss how to achieve integration. Then, we end with a comparison of SOC approaches.

Cloud Edge and Cloud Core

When looking from the perspective of a visitor (or attacker) who wants to gain access to your public-facing web applications, the traffic first arrives at what we again call the cloud edge. Today, there are cloud providers that have built their cloud edge from the ground up, implementing all the security technologies listed here:

• Edge routers

• DDoS defenses

• Managed DNS

• Reverse proxies

• Bot management

• Web application firewalls

• API defenses

• Caching

Conversely, in cloud environments, you will often hear the term cloud core. The cloud core is where the web applications reside. Inside the core, you will often find compute, storage, connectivity, ...