Network, Infrastructure, and Security Controls

In cloud networks, access is controlled primarily through virtual networks and their associated networking resources. Cloud systems use virtual networks to enable communication between components inside a cloud. A virtual network is a networking system that emulates a physical network by combining the hardware and software network resources into a single entity. A virtual network contains network resources and capabilities including firewalls, virtual routers, load balancers, and network management.

In the cloud, virtual networks are managed via Software-Defined Networking (SDN). SDN is a category of technologies designed to allow virtualized networking functions that can be managed through software. SDN enables the creation of virtual networks by emulating physical firewalls, routers, and other networking devices used in traditional networks.

Deploying virtual networks on the cloud is fairly simple. New infrastructure can be quickly...

Security control centers

Each of the three major cloud service providers offers functionality and configurable controls to support setting up virtual private networks for your cloud resources. The cloud service providers have designed their portals to make it intuitive for anyone to set up a virtual private network for cloud resources.

AWS refers to its virtual network as a Virtual Private Cloud (VPC), Azure refers to its virtual network as a Virtual Network (VNet), and GCP refers to its virtual network as a Virtual Private Cloud. A virtual network is divided into subnetworks, also known as subnets.

Amazon Virtual Private Cloud

Amazon’s VPC is a core AWS service and allows you to create a virtual network for resources in an isolated section of the Amazon Web Services cloud. Within the VPC, a user can define network configurations such as IP address range as well as route tables and manage network gateways and subnets. Subnets are smaller separate parts of the overall...

Network controls

Virtual networks in the cloud are exposed to the internet by default. As a result, they can be susceptible to attacks such as denial-of-service attacks or data exfiltration among others. It is critical to ensure network controls have been configured securely to protect cloud resources from unauthorized access or attack.

The basic network control in the cloud is the security group, which represents a virtual firewall for your instance/server/virtual machine. You can use a security group to manage inbound and outbound network traffic to your instance/server/virtual machine.

In traditional networks, network traffic is protected via a dedicated network firewall. A network firewall is essentially the barrier that sits between a private internal network and the public internet. The network firewall’s main purpose is to allow traffic in from authorized sources and to keep malicious traffic out. In contrast, in the cloud, instead of having a dedicated network...

Security policies

As we said earlier in this chapter, it is important to review industry-standard security benchmarks such as CIS Amazon Web Services, CIS Microsoft Azure Benchmarks, and CIS Google Cloud Platform Benchmarks to understand best practices around security policies when configuring virtual networks. At the time of writing, the benchmarks from the Center for Internet Security can be found at https://www.cisecurity.org/cis-benchmarks.

For each benchmark, we will look at the recommendations around the networking policies.

Amazon Virtual Private Cloud

The following security policies related to networking in the CIS Amazon Web Services are recommended:

• 5.1 Ensure no network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports
• 5.2 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports
• 5.3 Ensure the default security group of every VPC restricts all traffic
• 5.4 Ensure routing tables for VPC peering...

Data security

Cloud networks have public frontends and the ability to communicate with the broader internet. As we said earlier in this chapter, cloud infrastructure is exposed to the internet. As a result, it can be susceptible to attacks such as denial-of-service attacks, data exfiltration, and so on.

A denial-of-service attack is the act of flooding your network with tons of illegitimate network traffic to overload your network and prevent you from fulfilling the real requests. Data exfiltration is a type of security breach that leads to the unauthorized transfer of data. There are many attack paths an adversary can take once they have obtained some sort of access to a cloud network.

Securing networks running in the cloud is essential to providing data security. The following security controls can mitigate the risks presented by the cloud:

• Encryption: To protect data in transit, network traffic should be encrypted, regardless of whether the traffic goes over public...

Summary

In this chapter, we looked at network security controls for the three major cloud providers: AWS, Azure, and GCP. We covered how to identify the security control center within each cloud service provider portal and functionality, as well as how to implement industry-standard security benchmarks within security policies. In addition, we also learned how to examine data security controls.

In the next chapter, we’ll review financial resources and change management.