What Is Cloud Security Architecture?
Cloud security architecture describes all the hardware and technologies designed to protect data, workloads, and systems within cloud platforms. Developing a strategy for cloud security architecture should begin during the blueprint and design process and should be integrated into cloud platforms from the ground up. Too often, cloud architects will focus entirely on performance first and then attempt to bolt security on after the fact.
Cloud Security Core Capabilities
Secure cloud computing architecture encompasses three core capabilities: confidentiality, integrity, and availability. Understanding each capability will help guide your efforts in planning a more secure cloud deployment.
- Confidentiality is the ability to keep information secret and unreadable to the people who shouldn’t have access to that data, such as attackers or people inside an organization without the proper access level. Confidentiality also includes privacy and trust, or when a business pledges secrecy in handling their customers’ data.
- Integrity is the idea that the systems and applications are exactly what you expect them to be, and function exactly as you expect them to function. If a system or application has been compromised to produce an unknown, unexpected, or misleading output, this can lead to losses.
- Availability is the third capability and is generally the least considered by cloud architects. Availability speaks to denial-of-service (DoS) attacks. Perhaps an attacker can’t see or change your data. But if an attacker can make systems unavailable to you or your customers, then you can’t carry out tasks that are essential to maintain your business.
Secure Cloud Computing in Practice
There are numerous tools to address confidentiality, integrity, and availability in cloud platforms with the end goal of defining a trusted execution environment (TEE). These are just a few tools that cloud security architects and experts use to help safeguard systems and data, and they serve as a good starting point during your blueprint phase.
- Encryption protects text and data by translating it into ciphers that only authorized parties have the ability to decipher, access, and edit.
- Firmware resilience is about helping to prevent attacks to the firmware layer but also includes recovering from an attack and restoring the system back to a known good state.
- Establishing a root of trust includes boot integrity, which helps protect the system from malware injections during system startup.
- Stack validation seeks to establish that all components and software within a system stack have been validated and are not compromised or changed, either before delivery, in transit to cloud architects, or during deployment.
- Secure systems are designed to isolate virtual machines (VMs), containers, data, and applications from each other as a key best practice.
Why Is Cloud Security Architecture Important?
The cloud, whether it’s private cloud, public cloud, or hybrid cloud, holds the promise of agility, efficiency, and cost effectiveness. These are transformational qualities for any business, and they enable organizations to adapt to market changes with rapid services delivery and the ability to make data-informed decisions. However, businesses may be prevented from using cloud resources without exposing themselves and their data to risk. Cloud security architecture allows businesses to take advantage of all that the cloud offers—including software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS) offerings—while mitigating exposure and vulnerability. Without cloud security architecture, the risks associated with using the cloud could outweigh any potential benefit.
Cloud Security Architecture Threats
While planning your cloud deployment, you want to be prepared for common threats such as malware and privilege-based attacks. There are too many common threats to enumerate here, so instead this article will provide a snapshot of high-profile threats that industry experts are thinking about right now.
- Insider threats include both workers within your own organization who have access to systems and data and also cloud service provider (CSP) administrators. When you subscribe to CSP services, you are essentially entrusting your data and workloads to the multitude of staff who are responsible for maintaining the CSP architecture. Another consideration is whether data is accessible to governmental entities. Security experts are paying more attention to the laws, regulations, and real-life practices that demonstrate whether a government can use court orders or other means to gain access to data in a private or public cloud.
- DoS attacks are a huge area of focus. Temporary direct denial-of-service (DDoS) attacks typically involve hammering a system with requests until it shuts down. Security perimeters can deflect these attacks using network compliance policies to filter out repeated requests. CSPs can also shift workloads and traffic to other resources while they work to restore the system. Permanent DoS attacks are more destructive and often inflict damage at the firmware level to render a server unbootable. In this case, a technician needs to physically reload the firmware and rebuild the system from scratch, which can result in servers being shut down for days or weeks.
- The cloud edge can refer to cloud-connected edge systems, but for a CSP it also refers to server architecture that is not under the CSP’s direct control. Global CSPs cannot build and run their own facilities in every corner of the planet, so they rely on partners to deliver services to smaller, geographically isolated, or rural regions. As a result, these CSPs don’t have total control to monitor and ensure physical box integrity for the hardware or physical attack protections such as locking down access to USB ports.
- Customer control influences how customers evaluate public cloud offerings. From the customer perspective, users are nervous about moving sensitive workloads to the public cloud. On the other hand, big cloud providers are typically much better equipped and have a much higher level of expertise in cloud security than the average enterprise running a private cloud. Generally, customers find it reassuring to be in total control of their most sensitive data, even if their security tools aren’t as sophisticated.
- Hardware limitations mean that even with the most robust cloud security architecture in the world, a server can’t help you create a better password. Passwords are one of the most common vectors of attack. Cloud security architects are focused on hardware, firmware, and software protections, but it will still fall on the shoulders of everyday users to follow best practices.
Cloud Security Architecture for SaaS, PaaS, and IaaS
From an IT perspective, there are big differences in security practices between cloud service models for SaaS, PaaS, and IaaS. For cloud architects, the tools to help build confidentiality, integrity, and availability across SaaS, PaaS, and IaaS are essentially the same and include encryption, firmware resilience, stack validation, and establishing a root of trust.
PaaS providers must pay attention to multiparty usage and establish trust in moving data to and from the platform. IaaS providers must focus on runtime encryption and orchestration capabilities that empower customers to manage key encryption for any application they use in the cloud.
SaaS includes productivity software suites and is widely used by businesses and individuals alike. SaaS must be secured at the CSP level—by the CSP. Users and customers in these cases have little control over the SaaS offerings, but their contribution to security takes place through adherence to best practices. Using strong passwords and two-factor authentication, being careful with personally identifiable information on social media, and avoiding email phishing scams all factor in.
Intel Cloud Security Architecture Products and Solutions
It would be difficult to list every single technology that contributes to cloud security architecture. Intel has been building security features into processors and other technology offerings for decades, and its security technologies continue to evolve generation over generation. The goal of more recent advances and offerings is to further the paradigm of confidential computing in the cloud.
Intel® Software Guard Extensions (Intel® SGX) helps create a trusted environment by integrating security capabilities for data while being processed in memory. Developers can use Intel® SGX to establish memory enclaves that provide extra layers of workload isolation. Cryptographic accelerators such as Intel® QuickAssist Technology (Intel® QAT) help deliver high performance even when heavy encryption and compression loads are needed.
The latest addition to the Intel® Xeon® Scalable platform also adds Intel® Total Memory Encryption (Intel® TME) and Intel® Platform Firmware Resilience (Intel® PFR). Intel® TME helps ensure that all memory accessed from the Intel® CPU is encrypted, including customer credentials, encryption keys, and other personally identifiable information. Intel® PFR equips cloud architects with the tools to increase protection against firmware interception, detect firmware corruption, and restore systems to a known good state.
Lastly, Intel collaborates with ecosystem partners to abstract and expand trusted execution capabilities and further the paradigm of confidential computing. This helps proliferate key technologies across a vast field of developers, system vendors, and system integrators. For example, Microsoft Azure uses Intel® SGX in building their cloud security architecture, and this benefits Microsoft Azure users even if they’re not aware of it.
Security as Critical to Business Transformation
Confidential computing and platforms that deliver confidentiality, integrity, and availability are prerequisites to taking advantage of cloud resources. Businesses need their cloud infrastructure to be performant, but they also need it to be reliable and trustworthy. Effective cloud security architecture is reliant on cloud architects who understand that a trusted foundation has to be a top-of-mind consideration during the initial planning stages and not something to be tacked on after the fact. Security isn’t a commodity; it is an essential ingredient.