Module Overview

1. Cyber Threats 5. Network security model

2. Modern cyberattack strategy 6. Security operating platform
3. MITRE ATT&CK framework 7. Cloud native technologies
4. Cyber attack techniques and types 8. Cloud native security

1
 Module Objectives
After completing this module, you should be able to:
▪ Explain attacker motivations and the Cyberattack Lifecycle.
▪ Describe cyberattack techniques and types, including malware, vulnerabilities, exploits, spamming, phishing, bots
and botnets, advanced persistent threats, and Wi-Fi attacks.
▪ Explain various network security models, concepts, and principles, including perimeter-based security and the Zero
Trust model.
▪ Discuss the key capabilities of the Security Operating Platform and its key components.
▪ Describe cloud-native technologies — including virtual machines, containers, and orchestration and serverless
computing.
▪ Discuss cloud-native security — including Kubernetes security, DevOps, and DevSecOps and visibility, governance,
and compliance challenges.

2
Agenda – Module 2
Topic Duration

Lecture 60 mins

Break 10 mins

Lecture continued 30 mins

Classroom Discussion 15 mins

Break or Revision time 15 mins

Quiz 45 mins

Total 175 mins

3
SECTION 1: CYBER INFO-636

THREATS Module 2: Cloud Security

4
 ATTACKER PROFILES AND
MOTIVATION
Modern cyberattacks are more sophisticated and dangerous adversaries, motivated
by more sinister purposes:
1. Cybercriminals
2. State-affiliated groups
3. Cybercrime Vendors
4. Hacktivists
5. Cyberterrorists

5
ATTACKER PROFILES AND
MOTIVATION

Cybercriminals. Acting independently or as part of a criminal

organization, cybercriminals commit acts of data theft,
embezzlement, fraud, and/or extortion for financial gain. According
to the RAND Corporation, “In certain respects, the black market for
cybercrime can be more profitable than the illegal drug trade, and
by many estimates, cybercrime is now a US$1 trillion industry.

6
ATTACKER PROFILES AND
MOTIVATION

State-affiliated groups. Sponsored by or affiliated with

nation-states, these organizations have the resources to launch very
sophisticated and persistent attacks, have great technical depth
and focus, and are well funded. They often have military and/or
strategic objectives such as the ability to disable or destroy critical
infrastructure, including power grids, water supplies, transportation
systems, emergency response, and medical and industrial systems.

7
ATTACKER PROFILES AND
MOTIVATION
Cybercrime vendors. Capitalizing on the service model of cloud computing, many
threat actors now rent or sell their malware and exploits – including business email
compromise (BEC) and ransomware – as cybercrime-as-a-service (CaaS) offerings on
the dark web. Vendors profit from the purchase or rental of their services and
potentially earn a commission from the attacks themselves. Additional services often
include mix-and-match bundles, collection services, volume discounts, and 24-hour
support.

8
ATTACKER PROFILES AND
MOTIVATION

Hacktivists. Motivated by political or social causes, hacktivist

groups (such as Anonymous) typically execute denial-of-service
(DoS) attacks against a target organization by defacing their
websites or flooding their networks with traffic.

9
ATTACKER PROFILES AND
MOTIVATION

Cyberterrorists. Terrorist organizations use the internet to recruit,

train, instruct, and communicate, and to spread fear and panic to
advance their ideologies. Unlike other threat actors, cyberterrorists
are largely indiscriminate in their attacks, and their objectives
include physical harm, death, and destruction.

10
KEY TERMS

The term hacker was originally used to refer to anyone with highly specialized
computing skills, without connoting good or bad purposes. However, common misuse of
the term has redefined a hacker as someone who circumvents computer security with
malicious intent, such as a cybercriminal, cyberterrorist, or hacktivist, cracker, and/or
black hat.

11
KEY TERMS

Business email compromise (BEC) is the unauthorized use of email leading to

financial fraud. BEC techniques including spamming and phishing, among others.

12
SECTION 1
1) Modern cyberattacks are perpetrated by
KEY TAKEAWAYS far more sophisticated and dangerous
adversaries, motivated by far more
sinister purposes
2) There are five different groups of
adversaries.
3) Every adversary has different motive

13
 SECTION 2: MODERN INFO-636

CYBERATTACK STRATEGY Module 2: Cloud Security

14
MODERN CYBERATTACK STRATEGY
Modern cyberattack strategy has evolved from a direct attack against a high-value
server or asset (“shock and awe”) to a patient, multistep process that blends exploits,
malware, stealth, and evasion in a coordinated network attack (“low and slow”).
The Cyberattack Lifecycle (figure in next slide) illustrates the sequence of events that
an attacker goes through to infiltrate a network and exfiltrate (or steal) valuable
data. Blocking of just one step breaks the chain and can effectively defend an
organization’s network and data against an attack.

15
MODERN CYBERATTACK STRATEGY

16
MODERN CYBERATTACK STRATEGY
1. Reconnaissance. Attackers meticulously plan their
cyberattacks. They research, identify, and select targets, often
extracting public information from targeted employees’ social
media profiles or from corporate websites, which can be useful
for social engineering and phishing schemes.
Attackers will also use various tools to scan for network
vulnerabilities, services, and applications that they can exploit,
such as:

1. Network Analyzers 5. Port Scanners

2. Network Vulnerability scanners 6. Web Application vulnerability scanners
3. Password crackers 7. Wi-Fi vulnerability scanners

17
MODERN CYBERATTACK STRATEGY
2. Weaponization
Next, attackers determine which methods to use to compromise a
target endpoint. They may choose to embed intruder code within
seemingly innocuous files such as a PDF or Microsoft Word document
or email message. Or, for highly targeted attacks, attackers may
customize deliverables to match the specific interests of an
individual within the target organization.
Breaking the Cyberattack Lifecycle at this phase of an attack is
challenging because weaponization typically occurs within the
attacker’s network. However, analysis of artifacts (both malware
and weaponizer) can provide important threat intelligence to
enable effective zero-day protection when delivery (the next step)
is attempted.
18
MODERN CYBERATTACK STRATEGY
3. Delivery:
Attackers then attempt to deliver their weaponized payload to
a target endpoint; for example, via email, instant messaging
(IM), drive-by download (an end user’s web browser is
redirected to a webpage that automatically downloads
malware to the endpoint in the background), or infected file
share.
Breaking the Cyberattack Lifecycle at this phase of an attack
requires visibility into all network traffic (including remote and
mobile devices) to effectively block malicious or risky websites,
applications, and IP addresses, and preventing known and
unknown malware and exploits.

19
MODERN CYBERATTACK STRATEGY
4. Exploitation
After a weaponized payload is delivered to a target endpoint, it must be
triggered. An end user may unwittingly trigger an exploit, for example, by
clicking a malicious link or opening an infected attachment in an email, or an
attacker may remotely trigger an exploit against a known server
vulnerability on the target network.
As during the Reconnaissance phase, breaking the Cyberattack Lifecycle at
this phase of an attack begins with proactive and effective end-user security
awareness training that focuses on topics such as malware prevention and
email security. Other important security countermeasures include vulnerability
and patch management; malware detection and prevention; threat
intelligence (including known and unknown threats); blocking risky,
unauthorized, or unneeded applications and services; managing file or
directory permissions and root or administrator privileges; and logging and
monitoring network activity.

20
MODERN CYBERATTACK STRATEGY
5. Installation
Next, an attacker will escalate privileges on the compromised
endpoint, by, for example, establishing remote shell access and
installing rootkits or other malware. With remote shell access, the
attacker has control of the endpoint and can execute commands in
privileged mode from a command-line interface (CLI) as if physically
sitting in front of the endpoint. The attacker will then move laterally
across the target’s network, executing attack code, identifying other
targets of opportunity, and compromising additional endpoints to
establish persistence.
The key to breaking the Cyberattack Lifecycle at this phase of an
attack is to limit or restrict the attackers’ lateral movement within the
network. Use network segmentation and a Zero Trust model that
monitors and inspects all traffic between zones or segments, and
granular control of applications that are allowed on the network.
21
MODERN CYBERATTACK STRATEGY
6. Command and Control
Attackers establish encrypted communication channels back to
command-and-control (C2) servers across the internet in order to
modify their attack objectives and methods as additional targets of
opportunity are identified within the victim network, or to evade any
new security countermeasures that the organization may attempt to
deploy if attack artifacts are discovered. Communication is essential to
an attack because it enables the attacker to remotely direct the attack
and execute attack objectives. C2 traffic must therefore be resilient
and stealthy for an attack to succeed. Attack communication traffic is
usually hidden with various techniques and tools, including:

1. Encryption 4. Fast Flux or Dynamic DNS

2. Circumvention 5. DNS tunneling
3. Port evasion

22
MODERN CYBERATTACK STRATEGY
7. Actions on the Objective.
Attackers often have multiple, different attack objectives, including data
theft; destruction or modification of critical systems, networks, and data;
and denial-of-service (DoS). This last stage of the Cyberattack Lifecycle
can also be used by an attacker to advance the early stages of the
Cyberattack Lifecycle against another target. The Verizon 2021 Data
Breach Investigations Report (DBIR) describes this strategy as a
secondary motive in which “the ultimate goal of an incident was to
leverage the victim’s access, infrastructure or any other asset to conduct
other incidents. For example, an attacker may compromise a company’s
extranet to breach a business partner that is the primary target.
According to the DBIR, in 2020 there were 24,913 incidents in which
“web apps were attacked with a secondary motive. The attacker pivots
the attack against the initial victim network to a different victim network,
thus making the initial victim an unwitting accomplice.
23
SECTION 2
1) There are seven stages in the cyber attack
KEY TAKEAWAYS lifecycle
2) Attackers have different attack objectives.
DOS (Denial of service) is one of common
objectives.
3) Attackers establish encrypted
communication channel to evade security
countermeasures.

24
SECTION 3: MITRE ATT&CK INFO-636

FRAMEWORK Module 2: Cloud Security

25
 MITRE ATT&CK FRAMEWORK
The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
framework is a comprehensive matrix of tactics and techniques designed for threat
hunters, defenders, and red teams to help
1. Classify Attacks
2. Identify attack attribution and objective
3. Assess organization's risk.
4. Identify security gaps
5. Prioritize mitigations based on risk

26
MITRE ATT&CK FRAMEWORK -
Objective
▪MITRE started ATT&CK in 2013 to document the Tactics, Techniques and Procedures
(TTPs) that advanced persistent threats (APTs) use against enterprise networks.
▪ It was created out of a need to describe adversary TTPs that would be used by a
MITRE research project called FMX.
▪ The objective of FMX was to investigate how endpoint telemetry data and analytics
could help improve post-intrusion detection of attackers operating within enterprise
networks.
▪ The ATT&CK framework was used as the basis for testing the efficacy of the sensors
and analytics under FMX
▪ It served as the common language both offense and defense could use to improve
over time.

27
MITRE ATT&CK FRAMEWORK -
Iteration
MITRE ATT&CK now has three iterations:
• ATT&CK for Enterprise: Focuses on adversarial behavior in Windows, Mac,
Linux, and cloud environments.
• ATT&CK for Mobile: Focuses on adversarial behavior on iOS and Android
operating systems.
• Pre-ATT&CK: Focuses on “pre-exploit” adversarial behavior. Pre-ATT&CK is
included as part of the ATT&CK for Enterprise matrix.

28
MITRE ATT&CK FRAMEWORK -
Tactics
Tactic The attacker is trying to
Reconnaissance Gather Information they can use to plan future operations
Resource Development Establish resource they can use to support operations
Initial access Get into your network
Execution Run malicious code
Persistence Maintain their foothold
Privilege Escalation Gain higher-level permission
Defense Evasion Avoid being detected

29
MITRE ATT&CK FRAMEWORK -
Tactics
Tactic The attacker is trying to
Credential Access Steal account names an password
Discovery Figure out your environment
Lateral movement Move through your environment
Collection Gather data of interest to their goal
Command and Control Communicate with compromised systems to control them
Exfiltration Steal data
Impact Manipulate, interrupt, or destroy your systems and data

30
KEY TERMS
Spear phishing is a highly targeted phishing attack that uses specific information
about the target to make the phishing attempt appear legitimate.
Whaling is a type of spear phishing attack that is specifically directed at senior
executives or other high-profile targets within an organization.
Watering hole attacks compromise websites that are likely to be visited by a targeted
victim to deliver malware via a drive-by download. A drive-by download is a software
download, typically malware, that happens without a user’s knowledge or permission.
Pharming is a type of attack that redirects a legitimate website’s traffic to a fake site.

31
SECTION 3
1) Miter ATT&CK framework is tactics and
KEY TAKEAWAYS techniques designed for threat hunters,
defenders, and red teams.
2) Miter ATT&CK framework consists of three
iterations
3) Miter ATT&CK framework covers fourteen
different tactics

32
SECTION 4: CYBERATTACK INFO-636

TECHNIQUES AND TYPES Module 2: Cloud Security

33
CYBERATTACK TECHNIQUES AND
TYPES
1. Malware and ransomware
Malware is malicious software or code that typically takes control of, collects
information from, or damages an infected endpoint. Malware broadly includes

1. Viruses 6. Logic bombs

2. Worms 7. Backdoors
3. Trojan Horses 8. Rootkits
4. Ransomware 9. Bookkits
5. Anti-AV 10. Spyware and adware

34
CYBERATTACK TECHNIQUES AND
TYPES
2. Vulnerabilities and exploits
Vulnerabilities are routinely discovered in software at an alarming rate. Vulnerabilities
may exist in software when the software is initially developed and released, or
vulnerabilities may be inadvertently created, or even reintroduced, when subsequent
version updates or security patches are installed. According to research by Palo Alto
Networks, 78 percent of exploits take advantage of vulnerabilities that are less than
two years old.
An exploit is a type of malware that takes advantage of a vulnerability in installed
endpoint or server software such as a web browser, Adobe Flash, Java, or Microsoft
Office. An attacker crafts an exploit that targets a software vulnerability, causing the
software to perform functions or execute code on behalf of the attacker.

35
CYBERATTACK TECHNIQUES AND
TYPES

36
CYBERATTACK TECHNIQUES AND
TYPES
3. Business email compromise (BEC)
Business email compromise (BEC) is one of the most prevalent types of cyberattacks
that organizations face today. BEC attacks cost organizations three times more than
any other cybercrime and BEC incidents represented nearly a third of the incidents
investigated by the Palo Alto Networks Unit 42 Incident Response Team in 2021.
According to the Verizon 2021 Data Breach Investigations Report (DBIR), BEC is the
second most common form of social engineering today.

37
CYBERATTACK TECHNIQUES AND
TYPES
4. Bots and botnets
Bots and botnets are notoriously difficult for organizations to detect and defend
against using traditional anti-malware solutions.
Bots (or zombies) are individual endpoints that are infected with advanced malware
that enables an attacker to take control of the compromised endpoint.
A botnet is a network of bots (often tens of thousands or more) working together under
the control of attackers using numerous servers.
Botnets themselves are dubious sources of income for cybercriminals. Botnets are
created by cybercriminals to harvest computing resources (bots). Control of botnets
(through C2 servers) can then be sold or rented out to other cybercriminals.

38
CYBERATTACK TECHNIQUES AND
TYPES

39
CYBERATTACK TECHNIQUES AND
TYPES
5. Advance persistent threats
Advanced persistent threats (APTs) are a class of threats that are far more deliberate
and potentially devastating than other types of cyberattacks. As its name implies, an
APT has three defining characteristics. An APT is:

Advanced. Attackers use advanced malware and exploits and typically also have the
skills and resources necessary to develop additional cyberattack tools and techniques,
and may have access to sophisticated electronic surveillance equipment, satellite
imagery, and even human intelligence assets.

40
CYBERATTACK TECHNIQUES AND
TYPES
5. Advance persistent threats
Persistent. An APT may take place over a period of several years. The attackers
pursue specific objectives and use a “low-and-slow” approach to avoid detection. The
attackers are well organized and typically have access to substantial financial
backing, such as a nation-state or organized criminal organization, to fund their
activities.

Threat. An APT is deliberate and focused, rather than opportunistic. APTs are
designed to cause real damage, including significant financial loss, destruction of
systems and infrastructure, and physical harm and loss of life.

41
CYBERATTACK TECHNIQUES AND
TYPES
6. Wi-Fi attacks
Wi-Fi security begins – and ends – with authentication. If you can’t control who has
access to your wireless network, then you can’t protect your network.
With the explosive growth in the number of mobile devices over the past decade,
wireless (Wi-Fi) networks are now everywhere. Whether you’re in an office, hotel,
airport, school, or coffee shop, you’re likely in range of a Wi-Fi network somewhere.
Of course, as a security professional, your first concern when trying to get connected is
“how secure is this Wi-Fi network?” But for the average user, the unfortunate reality is
that Wi-Fi connectivity is more about convenience than security.

42
SECTION 3 1) There are six cyber attack techniques

KEY TAKEAWAYS 2) Vulnerabilities can be exploited from the time

software is deployed until it is patched
3) Zero-day vulnerability is a vulnerability that
has been disclosed but is not yet patched
4) An APT may take place over a period of
several years. Attackers use “low-and-slow”
approach to avoid detection.
5) Business email compromise (BEC) is one of the
most prevalent types of cyberattacks that
organizations face today

43
SECTION 5: NETWORK INFO-636

SECURITY MODEL Module 2: Cloud Security

44
NETWORK SECURITY MODEL
This section describes two Network Security Models
1. Perimeter-based
2. Zero Trust

45
NETWORK SECURITY MODEL
Perimeter-based
Perimeter-based (“castle and moat”) network security models date back to the
early mainframe era (circa late 1950s), when large mainframe computers were
located in physically secure “machine rooms” that could be accessed by only a
relatively limited number of remote job entry (RJE) “dumb” terminals that were
directly connected to the mainframe and also located in physically secure areas.
Today’s data centers – including on-premises, private cloud, and public cloud
data centers – are the modern equivalent of machine rooms.

46
NETWORK SECURITY MODEL
Zero Trust
Introduced by Forrester Research, the Zero Trust security model addresses some
of the limitations of perimeter-based network security strategies by removing
the assumption of trust from the equation. With Zero Trust, essential security
capabilities are deployed in a way that provides policy enforcement and
protection for all users, devices, applications, and data resources, as well as the
communications traffic between them, regardless of location.
In particular, with Zero Trust there is no default trust for any entity – including
users, devices, applications, and packets – regardless of what it is and its
location on or relative to the enterprise network. Verification that authorized
entities are always doing only what they’re allowed to do also is no longer
optional in a Zero Trust model: verification is now mandatory

47
NETWORK SECURITY MODEL
Zero Trust
Benefits
▪ Clearly improved effectiveness in mitigating data loss with visibility and safe
enablement of applications, and detection and prevention of cyberthreats
▪ Greater efficiency for achieving and maintaining compliance with security and
privacy mandates, using trust boundaries to segment sensitive applications, systems,
and data
▪ Improved ability to securely enable transformative IT initiatives, such as user
mobility, bring your own device (BYOD) and bring your own access (BYOA),
infrastructure virtualization, and cloud computing
▪ Lower total cost of ownership (TCO) with a consolidated and fully integrated
security operating platform, rather than a disparate array of siloed, purpose-built
security point products

48
NETWORK SECURITY MODEL
Zero Trust
Zero Trust Design Principles

▪ Ensure that all resources are accessed securely, regardless of location.

▪ Adopt a least privilege strategy and strictly enforce access control.

▪ Inspect and log all traffic.

49
NETWORK SECURITY MODEL
Zero Trust
Zero Trust conceptual architecture
Traditional Security Model
Traditional security models identify areas where breaches and exploits may occur, the attack
surface, and you attempt to secure the entire surface.
Zero Trust Security Model:
In Zero Trust, you identify a protect surface. The protect surface is made up of the network’s
most critical and valuable data, assets, applications, and services (DAAS). The protect surface is
much smaller than the attack surface and should therefore be knowable.

50
 NETWORK SECURITY MODEL
Zero Trust
Zero Trust conceptual architecture
Zero Trust Security Model:
▪ In the Zero Trust model, only known and permitted traffic is granted access to the protect
surface.
▪ A segmentation gateway, typically a next-generation firewall, controls this access.
▪ The segmentation gateway provides visibility into the traffic and users attempting to access
the protect surface, enforces access control, and provides additional layers of inspection.

51
52
NETWORK SECURITY MODEL
Zero Trust
Zero Trust least privilege access

Zero Trust policies provide granular control of the protect surface, making
sure that users have access to the data and applications they need to perform
their tasks but nothing more.

This is known as least privilege access.

53
 NETWORK SECURITY MODEL
Zero Trust
Zero Trust least privilege access
to implement least privilege access the firewall must:
1. Have visibility of and control over the applications and their functionality in the traffic
2. Be able to allow specific applications and block everything else.
3. Dynamically define access to sensitive applications and data based on a user’s group
membership
4. Dynamically define access from devices or device groups to sensitive applications and
data and from users and user groups to specific devices

54
 NETWORK SECURITY MODEL
Zero Trust
Zero Trust least privilege access
5. Be able to validate user’s identity through authentication
6. Dynamically define the resources that are associated with the sensitive data or
application
7. Control data by file type and content

The result is granular control that safely allows access to the right applications for the right
sets of users while automatically eliminating unwanted, unauthorized, and potentially harmful
interactions.

55
NETWORK SECURITY MODEL
Zero Trust

Zero Trust Main Component

1. Zero Trust Segmentation Platform
2. Trust Zones
3. Management infrastructure

56
 NETWORK SECURITY MODEL
Zero Trust
Zero Trust Segmentation Platform:

The Zero Trust Segmentation Platform is referred to as a network segmentation gateway by Forrester Research. It is
the component used to define internal trust boundaries, meaning that the platform provides the majority of the security
functionality needed to deliver on the Zero Trust operational objectives, including the ability to:

● Enable secure network access

● Granularly control traffic flow to and from resources
● Continuously monitor allowed sessions for any threat activity

57
 NETWORK SECURITY MODEL
Zero Trust
Trust zones:
Forrester Research refers to a trust zone as a micro core and perimeter (MCAP). A trust zone is
a distinct pocket of infrastructure where the member resources not only operate at the same
trust level but also share similar functionality. Functionality such as protocols and types of
transactions must be shared in order to minimize the number of allowed pathways into and out
of a given zone and, in turn, to minimize the potential for malicious insiders and other types of
threats to gain unauthorized access to sensitive resources.
Examples of trust zones include the user (or campus) zone, a wireless zone for guest access, a
cardholder data zone, database and application zones for multitier services, and a zone for
public-facing web applications.

58
NETWORK SECURITY MODEL
Zero Trust
Management infrastructure:
Centralized management capabilities are crucial to enabling efficient administration and
ongoing monitoring, particularly for implementations involving multiple distributed Zero Trust
Segmentation Platforms. A data acquisition network also provides a convenient way to
supplement the native monitoring and analysis capabilities for a Zero Trust Segmentation
Platform. Session that have been forwarded to a data acquisition network can then be
processed by any number of out-of-band analysis tools and technologies intended, for
example, to further enhance network visibility, detect unknown threats, or support compliance
reporting.

59
NETWORK SECURITY MODEL
Zero Trust

60
NETWORK SECURITY MODEL
Zero Trust
Criteria and Capabilities
The core of any Zero Trust network security architecture is the Zero Trust Segmentation
Platform, so you must choose the correct solution. Key criteria and capabilities to consider
when selecting a Zero Trust Segmentation Platform include:

1. Secure access
2. Inspection of all traffic
3. Least privilege access control
4. Cyber threat protection
5. Coverage for all security domains

61
NETWORK SECURITY MODEL
Zero Trust
Zero Trust Implementation
Implementation of a Zero Trust network security model doesn’t require a major overhaul of
an organization’s network and security infrastructure.
A Zero Trust design architecture can be implemented in a way that requires only
incremental modifications to the existing network and is completely transparent to its users.
Advantages of such a flexible, non-disruptive deployment approach include minimizing the
potential impact on operations and being able to spread the required investment and work
effort over time.

62
NETWORK SECURITY MODEL
Zero Trust
STEP
Zero Trust Implementation is a
Three step process STEP 03
02
STEP

01
Establish
Understand

Listen
KEY TERMS

An attack surface is any area where breaches and exploits may occur and is
comprised of an organization’s entire digital footprint.
A protect surface consists of the most critical and valuable data, assets, applications,
and services (DAAS) on a network.

64
KEY TERMS

Identity and access management (IAM) is a framework of business processes, policies, and
technologies that facilitates the management of electronic or digital identities.

The principle of least privilege in network security requires that only the permission or access
rights necessary to perform an authorized task are granted.

65
SECTION 5 1) Perimeter based and zero trust are the
two network security models
KEY TAKEAWAYS 2) Zero trust is a three step process
3) Least privilege is one of the key Zero trust
principles
4) In the Zero Trust model, only known and
permitted traffic is granted access to the
protect surface
5) The core of any Zero Trust network
security architecture is the Zero Trust
Segmentation Platform

66
 SECTION 6: SECURITY INFO-636

OPERATING PLATFORM Module 2: Cloud Security

67
 SECURITY OPERATING PLATFORM

Key Components

68
SECURITY OPERATING PLATFORM

Security Operating Platform is a tightly integrated system of components and

services, including a partner ecosystem, that delivers consistent security across
the network, endpoints, and cloud.

69
 SECURITY OPERATING PLATFORM
To enable the prevention of successful cyberattacks, the Security Operating Platform
delivers four key capabilities:

1. Provide full visibility: To understand the full context of an attack, visibility of all users and devices is
provided across the organization’s network, endpoint, cloud, and SaaS applications.

2. Reduce the attack surface: Best-of-breed technologies that are natively integrated provide a prevention
architecture that inherently reduces the attack surface. This type of architecture allows organizations to
exert positive control based on applications, users, and content, with support for open communication,
orchestration, and visibility.

70
 SECURITY OPERATING PLATFORM
To enable the prevention of successful cyberattacks, the Security Operating Platform
delivers four key capabilities:

3. Prevent all known threats, fast: A coordinated security platform accounts for the full scope of an attack,
across the various security controls that compose the security posture, enabling organizations to quickly
identify and block known threats.

4. Detect and prevent new, unknown threats with automation: Building security that simply detects threats
and requires a manual response is too little, too late. Automated creation and delivery of near-real-time
protections against new threats to the various security solutions in the organization’s environments enable
dynamic policy updates. These updates are designed to allow enterprises to scale defenses with technology,
rather than people.

71
KEY TERMS

An endpoint is a computing device such as a desktop or laptop computer, handheld

scanner, internet of things (IoT) device or sensor (such as an autonomous vehicle, smart
appliance, smart meter, smart TV, or wearable device), point-of-sale (POS) terminal,
printer, satellite radio, security or videoconferencing camera, self-service kiosk,
smartphone, tablet, or Voice over Internet Protocol (VoIP) phone. Although endpoints
can include servers and network equipment, the term is generally used to describe
end-user devices.

72
SECTION 6
KEY TAKEAWAYS
1) There are four key capabilities of security
operating platform (SOP).
2) SOP covers network security, endpoint
protection and could security.

73
MODULE-1REFRESHER INFO-636
Module 2: Cloud Security

74
Cloud
Service
Model

75
Cloud Computing Deployment Model

Cloud On-premises Hybrid

(private cloud)

76
 CLOUD SECURITY CHALLENGES
1. Cloud computing does not mitigate existing network security risks
2. Security requires isolation and segmentation; the cloud relies on
shared resources
3. Security deployments are process-oriented; cloud computing
environments are dynamic
4. Multitenancy is a key characteristic of the public cloud – and a
key risk

77
 CLOUD SECURITY CHALLENGES
5. Traditional network and host security models don’t work in the
cloud for serverless applications
6. Consistent security in physical and virtualized form factors
7. Your business applications segmented using Zero trust principles
8. Centrally managed business applications; streamlined policy
updates.

78
 SECTION 7: CLOUD INFO-636

NATIVE TECHNOLOGIES Module 2: Cloud Security

79
CLOUD NATIVE TECHNOLOGIES
As defined by the Cloud Native Computing Foundation’s (CNCF) charter, cloud-native
systems have the following properties:

Container packaged: Running applications and processes in software containers as

isolated units of application deployment, and as mechanisms to achieve high levels of
resource isolation. Improves overall developer experience, fosters code and
component reuse, and simplifies operations for cloud-native applications.

80
CLOUD NATIVE TECHNOLOGIES
Dynamically managed: Actively scheduled and actively managed by a central
orchestrating process. Radically improves machine efficiency and resource utilization
while reducing the cost associated with maintenance and operations.

Microservices oriented: Loosely coupled with dependencies explicitly described (for

example, through service endpoints). Significantly increases the overall agility and
maintainability of applications. The foundation will shape the evolution of the
technology to advance the state of the art for application management, and to make
the technology ubiquitous and easily available through reliable interfaces.

81
CLOUD NATIVE TECHNOLOGIES

82
CLOUD NATIVE TECHNOLGIES
We will focus on three popular technologies in this area

1. Virtualization
2. Containers & orchestration
3. Serverless Computing

83
CLOUD NATIVE
TECHNOLOGIES-VIRTUALIZATION
VIRTUALIZATION:
Virtualization technology emulates real – or physical – computing resources, such as
servers (compute), storage, networking, and applications. Virtualization allows
multiple applications or server workloads to run independently on one or more
physical resources.
A hypervisor allows multiple, virtual (“guest”) operating systems to run concurrently on
a single physical host computer. The hypervisor functions between the computer
operating system and the hardware kernel. There are two types of hypervisors:
• Type 1 (native or bare-metal). Runs directly on the host computer’s hardware
• Type 2 (hosted). Runs within an operating-system environment

84
CLOUD NATIVE
TECHNOLOGIES-VIRTUALIZATION
Virtualization is a key technology used in data centers and cloud computing to
optimize resources. Important security considerations associated with virtualization
include:
Dormant virtual machines (VMs): In many data-center and cloud environments,
inactive VMs are routinely (often automatically) shut down when they are not in use.
VMs that are shut down for extended periods of time (weeks or months) may be
inadvertently missed when anti-malware updates and security patches are applied.
• Hypervisor vulnerabilities: In addition to vulnerabilities within the hosted
applications, VMs, and other resources in a virtual environment, the hypervisor itself
may be vulnerable, which can expose hosted resources to attack.

85
CLOUD NATIVE
TECHNOLOGIES-VIRTUALIZATION
Intra-VM communications: Network traffic between virtual hosts, particularly on a
single physical server, may not traverse a physical switch. This lack of visibility
increases troubleshooting complexity and can increase security risks because of
inadequate monitoring and logging capabilities.

VM sprawl: Virtual environments can grow quickly, leading to a breakdown in

change-management processes and exacerbating security issues such as dormant
VMs, hypervisor vulnerabilities, and intra-VM communications.

86
CLOUD NATIVE
TECHNOLOGIES-VIRTUALIZATION
Virtual machines:
VMs provide the greatest levels of isolation, compatibility, and control in the
continuum and are suitable for running nearly any type of workload.
Examples of VM technologies include VMware vSphere, Microsoft Hyper-V, and the
instances provided by almost every IaaS cloud provider, such as Amazon EC2. VMs
are differentiated from “thin VMs” because they’re often operated in a stateful
manner with little separation between OS, app, and data.

87
CLOUD NATIVE
TECHNOLOGIES-VIRTUALIZATION
Thin virtual machines:
▪ “thin” VMs are typically the same underlying technology as VMs but deployed and run in a much
less stateful manner.
▪ “thin” VMs are typically deployed through automation with no human involvement, are operated as
fleets rather than individual entities.
▪ “thin” VMs prioritize separation of OS, app, and data whereas a VM may store app data on the
OS volume, a thin VM would store all data on a separate volume that could easily be reattached to
another instance.
▪ “thin” VMs also lack the container attribute of a cloud-native system, they typically have a stronger
emphasis on dynamic management than traditional VMs.
▪ VM may be set up and configured by a human operator, a thin VM would typically be deployed
from a standard image, using automation tools like Puppet, Chef, or Ansible, with no human
involvement.
88
A Stateful architecture or application describes a structure that allows users to store, record,
and return to already established information and processes over the internet. It entails
transactions that are performed using past transactions as a reference point. In stateful
applications, the current transaction can be affected by the previous ones.

A stateless architecture or application is a type of Internet protocol where the state of the
previous transactions is neither stored nor referenced in subsequent transactions. Each request
sent between the sender and receiver can be interpreted and does not need earlier requests
for its execution. This is a protocol where a client and server request and response are made in
a current state. In addition, the status of the current session is not retained or carried over to
the next transaction.

89
CLOUD NATIVE
TECHNOLOGIES-CONTAINERS
A container is a standardized, executable, and lightweight software code package that
contains all the necessary components to run a given application (or applications) – including
code, runtime, system tools and libraries, and configuration settings – in an isolated and
virtualized environment to enable agility and portability of the application workloads.
There are two types of containers: application containers and system containers. System
containers are much less common now, but were popular before Docker made containers
commonplace in 2015. When discussing containers, people most often mean application
containers.

90
CLOUD NATIVE
TECHNOLOGIES-CONTAINERS
▪Containers make building and deploying cloud-native applications simpler than ever.
▪Containers eliminate much of the friction typically associated with moving application code
from testing through to production
▪All the dependencies associated with any application are included within the containerized
application.
▪Containerized applications are highly portable across virtual machines or bare-metal servers
running in a local data center or in a public cloud.

91
ACTIVITY - Containers

Read section 3.1.2 (pages 217 – 221) Containers and Orchestration to gain
understanding of the various containers in the provided reading material

• VM-integrated containers
• Containers
• Containers as a Service
• On-demand containers

92
CLOUD NATIVE
TECHNOLOGIES-SERVERLESS
Serverless architectures also referred to as function as a service, or FaaS
enable organizations to build and deploy software and services without
maintaining or provisioning any physical or virtual servers. Applications made
using serverless architectures are suitable for a wide range of services and
can scale elastically as cloud workloads grow.
In serverless architectures, the serverless provider is responsible for securing the data
center, network, servers, operating systems, and their configurations. However,
application logic, code, data, and application-layer configurations still need to be
robust and resilient to attacks. These are the responsibility of application owners

93
CLOUD NATIVE
TECHNOLOGIES-SERVERLESS
Adopting a serverless model can impact application development in several ways:
Reduced operational overhead: With no servers to manage, developers and DevOps don’t
need to worry about scaling infrastructure, installing and maintaining agents, or other
infrastructure-related operations.
Increased agility: Because serverless applications rely heavily on managed services for
things like databases and authentication, developers are free to focus on the business logic of
the application, which will typically runs on an FaaS, such as AWS Lambda or Google Cloud
Functions.
Reduced costs: With most services used in serverless applications, the customer pays only for
usage. For example, with AWS Lambda, customers pay for the executions of their functions.
This pricing model typically has a significant impact on cost because customers don’t have to
pay for unused capacity as they would with virtual machines.

94
95
KEY TERMS
A hypervisor allows multiple, virtual (or guest) operating systems to run concurrently on
a single physical host computer.
A native (also known as a Type 1 or bare-metal) hypervisor runs directly on the host
computer’s hardware.
A hosted (also known as a Type 2) hypervisor runs within an operating-system
environment.

96
ACTIVITY - SERVERLESS

Read section 3.1.3 (pages 224 – 226) on serverless architecture to gain understanding
on how serverless architecture can impact application development.

97
 1) Container packaged, dynamically
SECTION 7 managed and microservices oriented are
the three properties of cloud native
KEY TAKEAWAYS technologies
2) Virtualization, containerization and
serverless computing are the three
popular cloud native technologies
3) The continuum of cloud native technologies
include seven technologies
4) Serverless architecture is referred as
FaaS.

98
SECTION 8: CLOUD INFO-636

NATIVE SECURITY Module 2: Cloud Security

99
CLOUD-NATIVE SECURITY - 4C’S
The 4C’s of cloud native security
The Cloud Native Computing Foundation (CNCF) Kubernetes project defines a
container security model for Kubernetes in the context of cloud-native security. This
model is referred to as “the 4 C’s of cloud-native security.” Each layer provides a
security foundation for the next layer. The 4 C’s of cloud-native security are:
• Cloud – The cloud (as well as data centers) provides the trusted computing base for
a Kubernetes cluster. If the cluster is built on a foundation that is inherently vulnerable
or configured with poor security controls, then the other layers cannot be properly
secured.
• Clusters – Securing Kubernetes clusters requires securing both the configurable
cluster components and the applications that run in the cluster.
100
CLOUD-NATIVE SECURITY - 4C’S
• Containers – Securing the container layer includes container vulnerability scanning
and OS dependency scanning, container image signing and enforcement, and
implementing least-privilege access.
• Code – Finally, the application code itself must be secured. Security best practices
for securing code include requiring TLS for access, limiting communication port ranges,
scanning third-party libraries for known security vulnerabilities, and performing static
and dynamic code analysis.

101
CLOUD-NATIVE SECURITY - DevOps &
DevSecOps
DevOps is a cycle of continuous integration and continuous delivery (or continuous
deployment), otherwise known as the CI/CD pipeline. The CI/CD pipeline integrates
Development and Operations teams to improve productivity by automating
infrastructure and workflows as well as continuously measuring application
performance.
DevSecOps takes the concept behind DevOps – the idea that developers and IT
teams should work together closely, instead of separately, throughout software
delivery – and extends it to include security
Why: One problem in DevOps is that security often ends up falling through the cracks.
Developers move quickly, and their workflows are automated. Security is a separate
team, and developers don’t want to slow down for security checks and requests.

102
CLOUD-NATIVE SECURITY - DevOps &
DevSecOps
To better understand what DevOps is, let’s first understand what DevOps is not.
DevOps is not:
• A combination of the Dev and Ops teams. There are still two teams; they just
operate in a communicative, collaborative way.
• Its own separate team. There is no such thing as a “DevOps engineer.” Although
some companies may appoint a “DevOps team” as a pilot when trying to transition to
a DevOps culture, DevOps refers to a culture where developers, testers, and
operations personnel cooperate throughout the entire software-delivery lifecycle.
• A tool or set of tools. Although there are tools that work well with a DevOps model
or help promote DevOps culture, DevOps is ultimately a strategy, not a tool.
• Automation. While very important for a DevOps culture, automation alone does not
define DevOps.
103
CLOUD-NATIVE SECURITY –
Visibility Governance & Compliance
Meeting security standards and maintaining compliant environments at scale, and
across SaaS applications, is a requirement for security teams.
Ensuring that your cloud resources and SaaS applications are correctly configured
and adhere to your organization’s security standards from day one is essential to
prevent successful attacks. Additionally, making sure these applications, as well as the
data they collect and store, are properly protected and compliant is critical to avoid
costly fines, brand reputation damage, and loss of customer trust.

104
CLOUD-NATIVE SECURITY –
Visibility Governance & Compliance
Ensuring governance and compliance across multicloud environments and SaaS applications
requires:
▪ Real-time discovery and classification of resources and data across dynamic SaaS as well as
PaaS and IaaS environments
▪ Configuration governance, ensuring that application and resource configurations match your
security best practices as soon as they are deployed and preventing configuration drift
▪ Access governance using granular policy definitions to govern access to SaaS applications
and resources in the public cloud as well as to apply network segmentation
▪ Compliance auditing, leveraging automation and built-in compliance frameworks, to ensure
compliance at any time and generate audit-ready reports on demand
▪ Seamless user experience that doesn’t force additional steps or introduce significant latency in
the use of applications as you add new security tools
105
 1) Cloud, Clusters, Containers, Code are the
SECTION 8 4C’s of could native security
KEY TAKEAWAYS 2) DevOps is a cycle of continuous
integration and continuous delivery
3) DevSecOps is the concept behind DevOps
focusing on security
4) Meeting security standards and
maintaining compliant environments at
scale, and across SaaS applications, is a
requirement for security teams
5) Visibility, Governance and Compliance is
a key component of cloud native security

106
SECTION 9: Threat vs INFO-636

Vulnerability vs Risk Module 2: Cloud Security

107
108
 ASSET
Asset: What you are protecting

In almost any context, an asset is a positive thing, and it often has worth. Money is an
asset, for example. When you list assets and liabilities, assets are all things that have
value.
In broad terms, an asset can be people, property, or information.
For web security purposes, any sensitive information that needs to be protected is an
asset.

109
 THREAT
Threat: Something that can damage or destroy an asset
If an asset is what you’re trying to protect, then a threat is what you’re trying to protect against.

Online, let’s look at your website as the asset. A security threat to your website would be a hacker, and
potentially the tools that a hacker would use, for example a piece of malicious code, like malware, that
can be installed on a site. That code can infiltrate your site and install viruses or bring down your website
in an attack.

110
 TYPES OF THREAT
Threats can be natural, unintentional, or intentional:

● A natural threat is one that is outside of your control and unpredictable; they’re often natural
disasters and hazards such as tornadoes, floods, hurricanes, forest fires, and more.

● An unintentional threat is an act that puts your information security at risk, but it was not done
maliciously. These types of threats can often be attributed to human error.

● An intentional threat is one that compromises your information system and is done purposefully by
threat actors.

111
VULNERABILITY
Vulnerability: A weakness or gap in your protection

The only way a threat can do damage to your asset is if you have an unchecked
vulnerability that the threat can take advantage of.

Your website could have vulnerabilities that hackers could take advantage of. Old
code or plugins that aren’t updated or maintained can be as dangerous as leaving a
door unlocked in a house. If you aren’t updating your site regularly, you could be
leaving vulnerabilities wide open for hackers to walk right through.

112
 RISK
Risk: Where assets, threats, and vulnerabilities intersect
Risk itself is a function of threats taking advantage of vulnerabilities to steal or damage assets. In other words,

Asset + Threat + Vulnerability = Risk.

Understanding these separate concepts help you understand how safe your website really is.

Threats, like hackers, may exist. But if you have no vulnerabilities, then your risk is very low.

You may have vulnerabilities on your site, but if threats don’t exist, then you still have little risk (this is not really an option, however, as
hackers are very prevalent online).

113
SECTION 9
KEY TAKEAWAYS 1) Threat is something that can damage or
destroy an asset
2) Vulnerability is a weakness or gap in your
protection
3) Risk is a threat taking advantage of the
vulnerability to damage an asset.

Asset + Threat +Vulnerability = RISK

114
THREAT, VULNERABILITY & RISK

Discuss
What are the risks of a bald tire on a snowy, icy day.

115
THANK YOU

© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.