Defining Security Policies for Data

Data is an important asset of any company. Enterprises store their data more and more in multi-cloud setups. How do they secure data? All cloud platforms have technologies to encrypt data but differ in how they apply encryption and store and handle keys. But data will move from one cloud to another or to user devices, so it needs to be secured in transit, next to data at rest. This is done with encryption, using encryption keys. These keys need to be secured as well, preventing non-authorized users from accessing the keys and encrypted data.

Before we discuss data protection itself, we will briefly talk about data models and how we can classify data. We will explore the different storage solutions the major clouds offer. Next, we will learn how data can be protected by defining policies for data loss prevention (DLP), labeling information to control access, and using encryption.

In this chapter, we’re going to cover the...

Storing data in multi-cloud concepts

If you ask a chief information officer (CIO) what the most important asset of the business is, the answer will very likely be data. The data architecture is therefore a critical part of the entire business and IT architecture. It’s probably also the hardest part of business and IT architecture. In this section, we will briefly discuss the generic principles of data architecture and how this drives data security in the cloud.

Data architecture consists of three layers—or data architecture processes—in enterprise architecture:

• Conceptual: A conceptual model describes the relationship between business entities. Both products and customers can be entities. A conceptual model connects these two entities: there’s a relationship between a product and the customer. That relationship can be a sale: the business selling a product to a customer. Conceptual data models describe the dependencies...

Understanding data encryption

One of the first, if not the first, encryption devices to be created was the Enigma machine. It was invented in the 1920s and was mostly known for its usage in World War II to encrypt messages. The British scientist Alan Turing and his team managed to crack the encryption code after 6 months of hard work.

The encryption that Enigma used, in those days, was very advanced. The principle is still the same: we translate data into something that can’t be read without knowing how the data was translated. To be able to read the data, we need a way to decipher or decrypt the data. There are two ways to encrypt data—asymmetric, or public key, and symmetric. In the next section, we will briefly explain these encryption technologies, before diving into the services that the leading cloud providers offer in terms of securing data.

First, let’s get into two forms of encryption: at rest and in transit. Data that is stored...

15 Implementing Identity and Access Management

Join our book community on Discord

https://packt.link/multicloud

The core principle of identity and access management in cloud is that everyone and everything in cloud is an identity. In this chapter, we will learn how we can manage identities and control their behaviour by granting them specific roles that allow them to perform only those activities that are related to the primary job of an administrator. We will see that Role-Based Access Control (RBAC) is very important to keep our cloud environments secure. We will learn about authenticating and authorizing identities, how to deal with least privileged accounts, what eligible accounts are, and why a central depository is needed. We will learn how we can federate with Active Directory from the various public clouds.

After this chapter, you will have a good understanding of technologies such as federation, single sign-on, multi-factor authentication, privileged access management, and...

Understanding identity and access management

Identity and access management (IAM) is all about controlling access to IT systems that are critical to a business. A key element of IAM is Role-Based Access Control, RBAC for short. In an RBAC model, we define who is alleged to have access to systems, what their role is, and what they are allowed to do according to that role. An important principle of RBAC is least privilege, meaning that a system administrator will only get the rights assigned that are required to perform the job assigned. For example, a database administrator needs access to the database, but it's not very likely that they will need access to network switches too.

In this chapter, we will discuss concepts such as single sign-on (SSO), multi-factor authentication (MFA), and Privileged Access Management (PAM). Before we go into that, let's have a look at the basics of IAM. There are three layers that we have to consider in our architecture:

• Managed identities: In...

Using a central identity store with Active Directory

One of the most used identity stores still is Active Directory. Before we get into Active Directory (AD) itself, it's important to understand that it should definitively not be confused with Azure Active Directory. The latter is an authentication service in Azure, whereas Active Directory really is a directory.

Understanding AD is not easy, but basic knowledge is necessary when talking about IAM. An enterprise should only have one central directory. Identities should only be kept in one place. That also comes with a risk: if the directory gets breached, an attacker will have access to all identities that exist within the enterprise. It's crucial that the directory and the IAM system is very secure and that directory data is extremely well protected. This is an area where tools such as Saviynt and CyberArk come in: they add an extra security layer on top of IAM.

Both Saviynt and CyberArk offer solutions that are deployed on...

Designing access management across multi-cloud

In the previous section, we learned that we need to have federation with AD in our public cloud environment. The next question is: how do we do that? Azure uses Azure Active Directory (AAD). Just as a reminder: AAD is not the same as AD. AAD is an authentication service in Azure, using AD as the directory. The primary function of AAD is to synchronize identities to the cloud – Azure – using the existing AD. For the synchronization, it uses Azure AD Connect.

With AAD, enterprises will have a system that provides employees of these enterprises with a mechanism to log in and access resources on different platforms. That can be resources in Azure itself or resources such as applications hosted on systems in the corporate network.

But AAD also provides access to SaaS solutions such as Office365 and applications that can integrate with Azure. AAD makes sure that users only have to log in once using SSO. It's secured by MFA, meaning...

Working with least-privilege access

Least privilege is an important principle in identity and access management (IAM) that ensures that users are only given the minimum level of access needed to perform their job functions. This principle is based on the idea that by limiting the access of users, organizations can reduce the risk of security breaches and data loss.

In an ideal scenario, a user should only have access to the specific resources and data that are necessary for them to perform their job. This reduces the risk of unauthorized access to sensitive information and prevents users from accidentally or intentionally causing damage to the system. By implementing least privilege, organizations can ensure that users are only able to access the resources they need to perform their job, while preventing them from accessing or modifying sensitive information.

Least privilege also helps organizations to comply with various regulatory requirements, such as the General Data Protection Regulation...