Q16Cloud Computing

In a massive Public Cloud (AWS, Azure), physical security is irrelevant because the servers are remote. The ONLY mathematical barrier preventing a hacker from violently deleting the entire corporate database is the Identity and Access Management (IAM) architecture. IAM strictly dictates exactly WHO can enter the cloud, and exactly WHAT they are mathematically allowed to execute.

1. Absolute Authentication (Who are you?)

The system must mathematically prove the entity's identity. Passwords are catastrophically weak. IAM strictly enforces Multi-Factor Authentication (MFA), requiring a password AND a cryptographic hardware token (like a YubiKey) or a biometric signature. Furthermore, IAM handles programmatic access via highly secure cryptographic Access Keys.

2. Granular Authorization (What can you do?)

Once inside, the user has absolutely zero permissions by default. IAM utilizes strict JSON-based Policy Documents to violently enforce the Principle of Least Privilege.

• A user is assigned a Role (e.g., Junior_Dev).
• The IAM Policy mathematically dictates: "This user is explicitly ALLOWED to read from Database-A, but explicitly DENIED the ability to delete Database-A, and explicitly DENIED access to Database-B." Every single API call is aggressively checked against these mathematical policies in milliseconds.

3. Auditing and Accounting

IAM mathematically logs every single API call ever made. If a database is deleted, the IAM CloudTrail instantly proves exactly which user ID executed the command at exactly what millisecond, providing absolute legal non-repudiation.