Cloud Security Services and Design Principles: Zero Trust and IAM
When designing software and networks in the cloud, security cannot be an afterthought. Cloud architects follow globally recognized design principles and deploy specialized security services.
1. Core Cloud Security Services
Essential Cloud Security Services
1. IAM (Identity & Access)
Controls user logins, roles, and granular file/server permissions
2. KMS (Key Management)
Creates, stores & rotates cryptographic encryption keys
3. WAF (Web App Firewall)
Filters malicious HTTP traffic like SQL Injection & Cross-Site Scripting
4. SIEM & Audit Logging
Centralizes and analyzes security event logs in real time
2. Fundamental Security Design Principles
1. Principle of Least Privilege (PoLP)
- Users and programs should only be given the bare minimum permissions needed to perform their job, and nothing more.
- Example: A junior intern hired to write documentation should only have “Read” access to documentation folders, never “Administrator / Delete” access to the production database.
2. Zero Trust Architecture (“Never Trust, Always Verify”)
- Old Security Model (Castle-and-Moat): Trust everyone inside the office network, block outsiders. (Dangerous because if a hacker enters via one infected laptop, they can access everything).
- Zero Trust Model: Assume threats exist both inside and outside the network. Verify every user, every device, and every request every single time, even if they are sitting inside the office building!
3. Defense-in-Depth (Layered Security)
- Never rely on just one security barrier. Build multiple layers of protection:
- Layer 1: Multi-Factor Authentication (OTP on phone).
- Layer 2: Web Application Firewall (WAF).
- Layer 3: Network Security Groups & VPC Subnets.
- Layer 4: Hard Disk Encryption (AES-256).
- If a hacker bypasses Layer 1, they are still stopped by Layer 2 and Layer 3!
4. Separation of Duties
- Critical operations must require approval from two different people. For instance, one developer writes code, but a separate security lead must approve the deployment to production servers.
💡 DAVV Exam Tip
Question (10 Marks): “Explain the key design principles of Cloud Security. What is Zero Trust Architecture?”
- Clearly state the Zero Trust motto: “Never Trust, Always Verify.”
- Explain Principle of Least Privilege and Defense-in-Depth with simple real-world examples.
- Name key cloud security services: IAM (Identity and Access Management) and KMS (Key Management Service).