The goal of this post is to present a common case study for building a research environment in AWS. Building an environment in the cloud involves several topics we need to take under consideration (such as how do I access resources in the cloud, where and how do I store data in the cloud, how do I protect the infrastructure, etc.) Let’s consider the following architecture: Researchers will connect to the cloud environment remotely over the internet and connect to a Linux machine with data analytics tools Original data sets will be stored using object storage Output data will be processed in a MySQL database Due to data sensitivity, data must be protected at all times In the following sections we will break-down the research team...

Working with public cloud providers raises many security challenges for customers, due to the fact that they do not control physical access to the cloud vendor’s data centers, the Cloud architecture or agreements between the cloud vendors and their suppliers. When conducting a risk assessment for supply chain in the cloud, we should ask cloud vendor questions such as: Who has access to my data stored in the cloud? What 3rd party suppliers (of the cloud vendor) have access to my data and is a data processing agreement in place? Does the cloud vendor store backups (in any form, from tape to physical hard drives) at 3rd party suppliers’ location? Do 3rd party suppliers have remote access to my data or to the systems storing or processing my...

This document addresses another important aspect of cloud security – Identity Management. As the concepts and terms might be different between cloud providers, this document concentrates on Google Cloud Platform (GCP) and provides an overview of some of the key security services and resources it provides to cloud architects. Cloud Identity and Access Management (IAM) is a web service that helps you securely control access to GCP resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. The following topics outline some of the key concepts for implementing IAM in Google Cloud Platform. Google Cloud IAM Identities in GCP are managed using a service called Cloud IAM (Identity...

This document addresses another important aspect of cloud security – Identity Management. While the concepts are common, the implementation approach varies for each cloud provider. This document concentrates on Microsoft Azure and provides an overview of Microsoft’s approach to identity Management and some of the key security services and resources it provides to cloud architects. The foundation of Microsoft’s approach is Azure Active Directory (Azure AD), Microsoft’s cloud-based identity and access management service, which helps employees sign in and securely access resources in Azure. The following are some of the key elements related to implementing Identity Management using Azure AD. Azure tenant A dedicated and trusted instance...