Encryption in the Cloud

00:01

Hey, guys, we'll have another episode of the S S C P Exam Prep Siri's I'm your host, Peter Sippel in This is going to be the fifth lesson in the seventh domain

00:12

So far in the seventh domain, we've taken a look at the C I A triad and how malware threatens the pillars of confidentiality, integrity and availability. We've taken a look at different vectors of infection how one might get viruses

00:31

or malware on their computer or network.

00:34

We've taken a look at malicious Web activity and how to successfully identify infections.

00:40

We've looked at how to analyze different kinds of malware and how to mitigate it successfully.

00:47

We've also taken a good will get cloud security, how privacy is handled in the cloud and the transmission and storage of data within the cloud.

00:56

Now, finally, in today's lesson, we're gonna take a look at encryption of the cloud and why it's important to encrypt data in the cloud. Just this is it is important to encrypt data within your network. Lets get started.

01:11

Encryption is an important technology for security practitioners to consider and use when implementing systems that will allow for secure data storage like normal networks. Encryption is very important to the cloud, and they that resides in the cloud needs to be encrypted.

01:29

There's really three aspects off different boys. You can implement data encryption at various faces within the cloud. They are data in motion, data at rest and data that's in use. So when David's in motion, that means getting passed back and forth throughout the cloud. You want to make sure

01:49

it is, ah, encrypted, usually when it goes into, like, an encryption tunnel. So,

01:53

for example, this is things like I p sec virtual private networks and then t l s and S S L. He's insured that once the data is in the tunnel, no one can see it. No one can touch it. No one knows where it's going.

02:08

Data at rest is where when Dean is not being used at all, it should be encrypted with its archived or stored somewhere. It needs to be encrypted to make sure that no one can get in, take a look at it and also dated and uses just dated that is being shared, processed

02:29

or viewed

02:30

now, like some war networks, the main components off cloud encryption or the data, which needs to be encrypted, of course, the encryption engine and the encryption keys

02:43

Safeguarding the keys is a crucial activity necessary for ensuring ongoing integrity.

02:50

So when when you're offering infrastructure as a service, it's very important that encryption is implemented here simply by the nature of infrastructure. As a service, you were supplying the infrastructure, the hardware four people to run their network. So

03:09

it is a security practitioners

03:12

job to be familiar with encryption and how encryption can

03:17

be implemented within that hardware. Now, as we said before in the previous lessons,

03:24

infrastructure as a service uses two different types of stories. A used volume, storage and object storage. Both of these and support support encryption. So with volume storage, there are two different ways you can encrypt the data.

03:39

There is instance, based.

03:42

This is where the encryption engine is located in the actual instance itself.

03:47

And there's also proxy based encryption, which focuses on a proxy machine that handles the keys and does all the encrypting for you and gives the encryption to the instance of the instance.

04:02

I love the network can run

04:04

because also object storage encryption. This is two different types is, well, there is a file level encryption. This is where files are encrypted inside a database, and there's also application level encryption. This is where the encryption engine of resides.

04:23

Within the application itself,

04:26

the proxy can be implemented on the customer gateway or as a service, residing on the external provider.

04:32

Now, if you didn't want to encrypt the data in the cloud for whatever reason, if you have a different kind of network that the data needs to be access faster than they have all it takes to decrypt, you can protect the cloud your data in the cloud. In other ways, there is

04:50

data masking and up to education.

04:54

So with this, you can substitute random values so you can change values off your data.

05:00

You can move different data out of order or switch the data values round.

05:05

You can mask the day. This is where you hide certain parts than data. For example, if you ex out the first couple of numbers of something and then just put the couple trailing numbers at the end, and there's simply deletion removing or making sure no one else can see the data,

05:23

there's data Anonymous station. This is where personal information is Rees removed. So this is things such as

05:29

names, addresses, Social Security numbers, that type of thing, and it's also organization. This is where you substitute a sensitive data element for a non sense of form

05:42

software defined network. This is one of the up and coming, more popular virtual environments. This software to find networking is an approach to computer networking that allows network admin is to manage. Network service is through the abstraction of local lower level functionality.

06:00

This is done by separating the control plane

06:02

and the data point. The entire network is defined with the controller, and there are two AP I. So the controller is considered to be the brains, the network, and they make all of the information on how traffic can flow throughout the cloud.

06:19

Then, once they make the decisions on how traffic flows throughout the cloud,

06:25

they send this information to the routers and switches through the South bound AP eyes.

06:30

From there, the routers and switches will know how to handle any traffic going through the clouds.

06:36

Once that's done, the controller can send information to applications through North bound AP eyes. These help network administrators to programmatically shape, traffic and deploy service is

06:48

in today's lecture. We discussed plowed encryption,

06:51

data protection and software to find networks

06:56

quiz time.

06:57

All of the following are components of clad encryption except

07:00

a the encryption engine.

07:02

Be encryption keys.

07:04

See encryption to find network or de encryption data.

07:12

If you said see encryption to find network, then you are correct. Remember, Cloud encryption is very similar to encryption on regular networks, where you need the engine, the keys and the data.