The document discusses cloud security architecture and covers the following topics: 1. Governance, risk management, and compliance to maintain effective security. 2. Implementing measures to minimize threats and vulnerabilities like maturity models and risk portfolios. 3. Ensuring proper user access and privileges through identity and access management. 4. Managing threats, vulnerabilities, compliance testing and penetration testing. 5. Securing servers, endpoints, networks and applications. 6. Managing the data lifecycle and protecting data and intellectual property. 7. Developing security policies and standards based on business requirements.

1. CLOUD SECURITY

2. Cloud Security Architecture

3. 1.Governance,Risk Management and Compliance
This deals with the identification and implementation of appropriate organizational structures, processes
and controls to maintain effective information security governance , Risk Management and Compliance
2.Information Security Management
This sub-domain deals with implementation of appropriate measurements like capability maturity models,
capability mapping models, security architecture roadmaps, risk portfolios etc. to minimize or eliminate the
impact that security related threats and vulnerabilities might have on an organization
3. Privilege Management Infrastructure
This sub-domain is to ensure that the users have access and privileges required to execute their duties and
responsibilities with Identity and Access Management functions like Identity Management, Authentication
Services, Authorization Services and Privilege usage management.
4.Threat and Vulnerability Management
It deals with core security such as vulnerability management, threat management, compliance testing and
penetration testing
5.Infrastructure Protection Services
The objective of this sub-domain is to secure server, End-point, Network and application layers
6. Data Protection
This sub-domain deals with data lifecycle management, data leakage prevention, intellectual property
protection with digital rights management, cryptographic services such as Key Management and
PKI/Symmetric encryption
7.Policies and standards
Security Policies and standards are derived from risk-based business requirements and exist at a number of
different levels including Information Security Policy, Physical Security Policy.

4. 1. SAML
SAML stands for security assertion markup language
which developed by OASIS.
Authentication

5. 2. Kerberos
It is an open authentication protocol developed at MIT. It
uses tickets for authenticating client to a service that
communicate over an un-secure network. It provides
mutual authentication-both client and the server
authenticate with each other.

6. 3.One time Password
Authentication Mechanism in which a password is of single use for a single session or
transaction only. OTP tokens are send through SMS. Time based OTP Algorithm - popular
time synchronization based algorithm for generating OTP’s

7. Authorization
OAuth
OAuth is an open-standard
authorization protocol or
framework that describes how
unrelated servers and services
can safely allow authenticated
access to their assets without
actually sharing the initial,
related, single logon
credential. In authentication
parlance, this is known as
secure, third-party, user-agent,
delegated authorization.

8. 1. Symmetric Encryption - Same secret key is used for encryption and decryption. The secret key is shared between
the sender and receiver. Symmetric encryption is best suited for securing data at rest since the data is accessed by the
known entities from known locations.
Popular symmetric encryption algorithms are:
Advanced Encryption Standard (AES) - AES is the data encryption standard established by the US National
Institute of Standards and Technology(NIST).It uses Rjindael cipher and is widely accepted encryption algorithm. It
works with different key and block sizes.
Twofish - It is a symmetric key block cipher with a block size of 128 bits and key size of 256 bits.It uses pre-
computed key-dependent S-boxes and a relatively complex key schedule
Blowfish - Blowfish has a 64-bit block size and a variable key length from 32 bits up to 448 bits. It is a 16-round
Feistel cipher and uses large key-dependent S-boxes.
Triple Data Encryption Standard(3DES)- It is a variant of Data Encryption Standard(DES). 3DES uses a key
bundle comprising of 3 keys of 56 bits.In the first step DES is used to encrypt plaintext using the first key, then the
data is decrypted using the second key and finally the third key is used to encrypt the data using DES.
Serpent - It is symmetric key block cipher that uses a block size of 128 bits and supports a key size of 128 or 256
bits. The cipher is a 32-round substitution–permutation network operating on a block of four 32-bit words. Each
round applies one of eight 4-bit to 4-bit S-boxes 32 times in parallel.
RC6 - It is a symmetric key block cipher designed by RSA Security.RC6 has a block size of 128 bits and supports
key sizes of 128, 192, and 256 bits up to 2040 bits. It may be parameterized to support a wide variety of word-
lengths, key sizes, and number of rounds.
MARS - It is a block cipher designed by IBM. It has a 128-bit block size and a variable key size of between 128 and
448 bits. It has a heterogeneous structure: several rounds of a cryptographic core are "jacketed" by unkeyed mixing
rounds, together with key whitening.

9. Network Level
Encryption is best suited for cases where the threats to data are at network or storage level . Network level encryption is performed when moving the data from
a creation point to its destination using a specialized hardware that encrypts all incoming data in real time. Network level encryption is operating sysetm
independent. Advantage of the network level encryption is that it is simple to implement and requires no changes on the existing data infrastructure.
Keys are managed in hardware. Disadvantage is that it is least scalable of all levels- as data volumes increases, a single encryption appliance can become a
bottleneck.
Device Level
It is performed on the disk controller or a storage. It is easy to implement and best suited for cases where the primary concern about data security is to protect
data residing in storage media. Device level encryption is operating system, application, host and transport independent. Encryption is performed in hardware in
this method. Device level encryption requires no changes in the existing data infrastructure. Disadvantage is that all data that is transmitted to and from the
storage media is unencrypted.

10. Data Security - Securing Data at Motion

11. Identity and Access Management

12. Provider Cloud identity
system
Amazon Web Services Amazon
IAM
Microsoft Azure Azure Active
Directory B2C
Google Compute Cloud Cloud Identity
IBM Cloud Cloud IAM

13. Provider Customer identity management system
Amazon Web Services Amazon Cognito
Microsoft Azure Azure Active Directory B2C
Google Compute Cloud Firebase
IBM Cloud Cloud Identity
Auth0 Customer Identity Management
Ping Customer Identity and Access Management
Okta Customer Identity Management
Oracle Oracle Identity Cloud Service
ID management systems

14. Auditing Objectives :
•Verify efficiency and compliance of identity and access management controls as per established access policies.
•Verifying that the authorized users are granted access to data and services based on their roles.
•Verify whether access policies are updated in a timely manner upon change in the roles of the users.
•Verify whether the data protection policies are sufficient.
•Assessment of support activities such as problem management.
Auditing in Cloud Computing

15. •Define a Strategic IT Plan: The use of IT resources should align with company business
strategies. When defining this objective, some key considerations should include whether IT
investments are supported by a strong business case and what education will be required during
the rollout of new IT investments.
•Define the Information Architecture: The information architecture includes the network,
systems, and security requirements needed to safeguard the integrity and security of
information. Whether the information is at rest, in-transit or being processed.
•Define the IT Processes, Organization, and Relationships: Creating processes that are
documented, standardized, and repeatable creates for a more stable IT environment. Businesses
should focus on creating policies and procedures that include organization structure, roles and
responsibilities, system ownership, risk management, information security, segregation of
duties, change management, incident management, and disaster recovery.
•Communicate Management Aims and Direction: Management should make sure its
policies, mission, and objectives are communicated across the organization.
•Assess and Manage IT Risks: Management should document those risks that could affect the
objectives of the company. These could include security vulnerabilities, laws and regulations,
access to customers or other sensitive information, etc.
•Identify Vendor Management Security Controls: As companies are relying on other vendors
such as AWS to host their infrastructure or ADP for payroll processing, companies need to
identify those risks that could affect the reliability, accuracy, and safety of sensitive
information.

16. Auditing Objectives :
•Verify efficiency and compliance of identity and access management controls as per established access
policies.
•Verifying that the authorized users are granted access to data and services based on their roles.
•Verify whether access policies are updated in a timely manner upon change in the roles of the users.
•Verify whether the data protection policies are sufficient.
•Assessment of support activities such as problem management.