Networking and Cloud Security Concepts

Picture one ordinary request: a laptop on hotel Wi-Fi opens a virtual private network (VPN) tunnel to headquarters, then reaches a payroll application hosted by a cloud provider. A remote-access VPN protects communications between individual hosts and an organization's network. Its tunnel runs between the user's client device and the organization's VPN gateway; application software and data at rest on that device are not protected by the tunnel. Network firewalls control the flow of traffic between networks or hosts, and attacks sent from one internal host to another often do not pass through them. A service model (SaaS, PaaS or IaaS: software, platform or infrastructure as a service) sets which parts of the cloud infrastructure the customer manages or controls. Customers' security responsibilities differ greatly based on their choice of service model. A cloud service's availability level needs to be addressed in the customer's contingency and continuity planning.

This domain (21.3% of the exam) follows that request outward through three questions, one per page: the traffic question, the boundary question and the responsibility question. The traffic question (Understand Network Security) asks how a message travels and which control acts on it, covering the Open Systems Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) layer models, Internet Protocol (IP) addressing, VPNs, firewalls, intrusion detection and prevention systems (IDS and IPS), Wi-Fi and Bluetooth, and embedded, industrial control system (ICS) and Internet of Things (IoT) devices. The boundary question (Understand Network Security Architecture) asks where boundaries sit and what may cross them, covering network segmentation into zones down to a boundary around a single workload (micro-segmentation), defense in depth (several complementary layers, so one failure is not fatal) and Zero Trust (no implicit trust granted solely because of network location or device ownership). The CC exam outline names firewall zones, virtual local area networks (VLANs) and micro-segmentation as examples of network segmentation. The responsibility question (Understand Cloud Security) asks who runs and secures each part when systems live with a cloud provider, covering the NIST definition of cloud computing (NIST is the U.S. National Institute of Standards and Technology): five essential characteristics, three service models, and four deployment models: private, community and public cloud differ in who may use the cloud infrastructure (a single organization, a specific community with shared concerns, or the general public), while a hybrid cloud is a composition of two or more distinct cloud infrastructures. The shared responsibility model outlines the different responsibilities of the customer and the cloud service provider.

Firewalls should block all inbound and outbound traffic that has not been expressly permitted by the firewall policy, a practice known as deny by default, which decreases the risk of attack. Zero Trust assumes no implicit trust is granted to assets or user accounts based solely on their network location or on asset ownership, and it authenticates and authorizes each access request. In the cloud, customers often incorrectly assume that the cloud service provider manages aspects of safeguarding resources that are not its responsibility. Defense in depth involves creating multiple layers of security, because if one layer of defense becomes compromised, another layer is there to contain the attack.