Q21Cloud Computing
Question
10 marks
Discuss the major security and privacy issues in Cloud Computing. Propose a framework to mitigate these risks.
Answer
A critical analysis of Security and Privacy in Cloud architectures. Analyzes catastrophic vectors like Hypervisor VM Escape and Data Breach multitenancy, and proposes a rigid mathematical framework including AES-256 encryption, strict IAM, and Data Loss Prevention to mitigate them.
When a corporation migrates to a Public Cloud, they mathematically surrender physical control of their servers and hard drives. This creates completely unprecedented, catastrophic security vectors that do not exist in traditional on-premises data centers.
- 1. Multi-Tenancy & VM Escape: The most horrific cloud-specific threat. Your VM shares the same physical RAM as a malicious hacker's VM. If the hacker finds a zero-day flaw in the Hypervisor architecture (VM Escape), they can violently punch through the mathematical isolation barrier and read your raw RAM, stealing encryption keys.
- 2. Data Breaches via Misconfiguration: Unlike physical servers, cloud databases (like AWS S3) are internet-facing by default. A single incorrect click in an IAM policy document instantly exposes a Petabyte database containing 100 million credit cards to the public internet.
- 3. Insecure APIs: The entire cloud is controlled by Web APIs. If the API authentications are weak, a hacker can violently issue a command to instantly delete every single server the corporation owns.
- 4. Data Privacy & Sovereignty: If a European company stores data on an AWS server physically located in the US, the US Government can legally seize it (Patriot Act), violating the horrific mathematical fines of the EU GDPR.
To survive in the cloud, corporations must implement a rigid, multi-layered security architecture:
- Layer 1: Absolute Encryption (Data at Rest and Transit): All data must be violently encrypted using AES-256 before it ever leaves the corporate building. The cloud provider must NEVER possess the private decryption keys (Customer Managed Keys). If the cloud is breached, the hackers only steal mathematical gibberish.
- Layer 2: Zero Trust Identity and Access Management (IAM): Implement strict Multi-Factor Authentication (MFA) for every API call. Enforce the Principle of Least Privilege—no human or script gets broad admin rights, only exact mathematical permissions required for the specific task.
- Layer 3: Network Micro-Segmentation: Do not rely on one massive firewall. Wrap every single VM in its own mathematical Security Group (micro-firewall), strictly blocking all lateral network traffic to prevent a virus from spreading across the cloud.
- Layer 4: Continuous Automated Auditing: Deploy AI-driven Cloud Security Posture Management (CSPM) tools that mathematically scan the entire cloud architecture every 60 seconds, violently instantly shutting down any database that is accidentally exposed to the public internet.