UNIT - 4 Cloud
Security and
Monitoring
Welcome to our comprehensive exploration of cloud security and
monitoring tools. This presentation will guide IT professionals and
Essentials
students through critical security concepts, implementation
strategies, and monitoring solutions for modern cloud
environments.
By Mrs.M.Viji , Assistant Professor / CSEBS
Presentation Agenda
Cloud Security Fundamentals
Core concepts and shared responsibility models that govern cloud
security.
Security Architecture
Design principles and implementation strategies for secure cloud
environments.
Monitoring Solutions
Tools and practices for maintaining visibility and ensuring compliance.
Compliance & Best Practices
Regulatory requirements and proven security approaches for cloud
deployments.
Cloud Security Fundamentals
Cloud-Native Security
Security tools designed specifically for cloud environments
Shared Responsibility
Division of security duties between provider and customer
Security Baseline
Foundational security controls required for all deployments
Cloud security encompasses specialized practices and technologies that protect cloud computing environments. The model
differs fundamentally from traditional on-premises security approaches.
Cloud Security Challenges
Expanded Attack Surface
Cloud environments introduce multiple new access points and management
interfaces that threat actors can target.
Visibility Limitations
Organizations often struggle to maintain comprehensive visibility across
complex multi-cloud and hybrid environments.
Misconfiguration Risks
Simple configuration errors can lead to catastrophic data exposures in cloud
environments.
Identity Management Complexity
Managing identities and access permissions across multiple cloud services
introduces significant security challenges.
Shared Responsibility Model
Provider Responsibilities Customer Responsibilities
• Physical security • Data classification
• Network infrastructure • Identity management
• Hypervisor security • Application security
• Service availability • OS patching
• Basic infrastructure patching • Access policies
The shared responsibility model clearly defines security obligations. Providers secure the cloud infrastructure while
customers secure their data within the cloud.
Shared Responsibility By Service Type
Infrastructure as a Service (IaaS)
Customers responsible for OS, applications, data, access
Platform as a Service (PaaS)
Customers responsible for applications, data, access
Software as a Service (SaaS)
Customers responsible for data, access controls
Security responsibilities shift between provider and customer based on service model. As you move from IaaS to
SaaS, the provider assumes more security responsibilities.
Security By Design Princip
Defense in Depth
Implement multiple security controls across different layers of the
cloud stack.
Least Privilege
Grant minimal access required to perform functions, reducing
potential attack surface.
Segregation of Duties
Separate critical functions to prevent single points of compromise.
4 Zero Trust Architecture
Verify every access request regardless of source location.
Zero Trust Security Model
Identity Verification
Authenticate every user with strong MFA
Device Validation
Verify device security posture before access
Session Security
Encrypt all data in transit with secure protocols
Least Privilege Access
Grant minimal permissions for required tasks
Zero Trust eliminates implicit trust assumptions. The "never trust, always
verify" approach applies regardless of connection location or network
ownership.
Identity and Access Management
Authentication Authorization
Verifying user identity through Controlling resource access with
multiple factors permissions
• Multi-factor authentication • Role-based access control
• Biometric verification • Attribute-based policies
• Token-based systems • Just-in-time access
Auditing Administration
Monitoring and reviewing access Managing identities throughout their
activities lifecycle
• Access logs • Provisioning/deprovisioning
• Anomaly detection • Access certification
• Compliance reporting • Privilege management
IAM Best Practices
Strong Role-Based Just-in-Time Principle of
Authenticatio Access Access Least
n
Implement multi- Assign permissions Grant temporary
Privilege
Provide minimum
factor authentication based on job elevated privileges. permissions needed.
for all users. Require functions. Create Implement time- Regularly review and
strong, unique standardized roles to bound access for remove unnecessary
passwords with ensure consistent sensitive operations. access rights.
regular rotation access patterns.
schedules.
Cloud Security Layers
Data Security
Encryption, classification, DLP
Application Security
SAST/DAST, WAF, API security
Host Security
Endpoint protection, host hardening
Network Security
4 Firewalls, segmentation, VPC
Identity & Access
5 IAM, MFA, SSO
Effective cloud security requires multiple layers of protection. Each layer provides distinct security controls that work together to create
comprehensive protection.
Cloud Network Security
Virtual Private Cloud (VPC) Network Segmentation
• Isolated cloud resources • Security groups
• Private IP address ranges • Network ACLs
• Subnet segmentation • Micro-segmentation
Traffic Filtering Encryption
• Web application firewalls • TLS for data in transit
• DDoS protection • VPN connections
• API gateways • Private connectivity options
Host Security in the Cloud
OS Hardening
Remove unnecessary services. Apply security baselines.
Implement host firewalls.
Vulnerability Management
Regular scanning. Automated patching. Compliance validation.
Access Controls
Strong authentication. Session management. Privileged
access security.
Monitoring & Logging
System events. Security logs. Behavior monitoring.
Cloud Data Security
Data Classification
Categorize data based on sensitivity and regulatory
requirements. Implement appropriate controls for each
classification level.
Encryption Implementation
Apply encryption for data at rest and in transit. Maintain
secure key management practices.
Access Control Enforcement
Restrict data access based on need-to-know. Implement
column-level and row-level security where needed.
Data Loss Prevention
Monitor and block unauthorized data transfers.
Implement controls to prevent exfiltration.
