2 cissp ® Official Study Guide Eighth Edition

Private
A 
private cloud
is a cloud service within a corporate network and isolated from 
the internet. The private cloud is for internal use only. A virtual private cloud is a service 
offered by a public cloud provider that provides an isolated subsection of a public or exter-
nal cloud for exclusive use by an organization internally. In other words, an organization 
outsources its private cloud to an external provider.
Public
A 
public cloud
is a cloud service that is accessible to the general public, typically 
over an internet connection. Public cloud services may require some form of subscription 
or pay-per-use or may be offered for free. Although an organization’s or individual’s data is 
usually kept separated and isolated from other customers’ data in a public cloud, the overall 
purpose or use of the cloud is the same for all customers.
Hybrid
A 
hybrid cloud
is a mixture of private and public cloud components. For example, 
an organization could host a private cloud for exclusive internal use but distribute some 
resources onto a public cloud for the public, business partners, customers, the external sales 
force, and so on.
Community
A 
community cloud
is a cloud environment maintained, used, and paid for 
by a group of users or organizations for their shared benefit, such as collaboration and data 
exchange. This may allow for some cost savings compared to accessing private or public 
clouds independently.
Cloud computing is a natural extension and evolution of virtualization, the internet, dis-
tributed architecture, and the need for ubiquitous access to data and resources. However, it 
does have some issues, including privacy concerns, regulation compliance difficulties, use of 
open/closed-source solutions, adoption of open standards, and whether or not cloud-based 
data is actually secured (or even securable).
Cloud solutions often have lower up-front costs, lower maintenance costs, vendor-
maintained security, and scalable resources, and they usually have high levels of uptime 
and availability from anywhere (over the internet). However, cloud solutions do not offer 
customer control over the OS and software, such as updates and configuration changes; 
provide minimal customization; and are often inaccessible without internet connectiv-
ity. In addition, the security policies of the cloud provider might not match those of the 
organization.
Cloud computing and virtualization, especially when you are virtualizing in the cloud, 
have serious risks associated with them. Once sensitive, confidential, or proprietary data 
leaves the confines of the organization, it also leaves the protections imposed by the orga-
nizational security policy and resultant infrastructure. Cloud services and their personnel 
might not adhere to the same security standards as your organization. Many cloud vendors 
may actually provide a more secure environment than most organizations can maintain 

---

356
Chapter 9 
■
Security Vulnerabilities, Threats, and Countermeasures
themselves. Cloud providers often have the resources to invest in security engineers, opera-
tions, and testers that many small to midsize (or even large) organizations simply can’t 
afford. It is important to investigate the security of a cloud service before adopting it.
With the increased burden of industry regulations, such as the Sarbanes–Oxley Act of 
2002 (SOX), Health Insurance Portability and Accountability Act (HIPAA), and Payment 
Card Industry Data Security Standards (PCI DSS), it is essential to ensure that a cloud 
service provides sufficient protections to maintain compliance. Additionally, cloud service 
providers may not maintain your data in close proximity to your primary physical location. 
In fact, they may distribute your data across numerous locations, some of which may reside 
outside your country of origin. It may be necessary to add to a cloud service contract a 
limitation to house your data only within specific logical and geographic boundaries.
It is important to investigate the encryption solutions employed by a cloud service. Do 
you send your data to them preencrypted, or is it encrypted only after reaching the cloud? 
Where are the encryption keys stored? Is there segregation between your data and that 
belonging to other cloud users? An encryption mistake can reveal your secrets to the world 
or render your information unrecoverable.
What is the method and speed of recovery or restoration from the cloud? If you have 
system failures locally, how do you get your environment back to normal? Also consider 
whether the cloud service has its own disaster-recovery solution. If it experiences a disaster, 
what is its plan to recover and restore services and access to your cloud resources?
Other issues include the difficulty with which investigations can be conducted, concerns 
over data destruction, and what happens if the current cloud-computing service goes out of 
business or is acquired by another organization.
Snapshots
are backups of virtual machines. They offer a quick means to recover from 
errors or poor updates. It’s often easier and faster to make backups of entire virtual systems 
rather than the equivalent native hardware-installed system.
Virtualization doesn’t lessen the security management requirements of an OS. Thus, 
patch management is still essential. Patching or updating virtualized OSs is the same pro-
cess as for a traditionally hardware-installed OS, with the added benefit that you may be 
able to patch systems (or swap out active systems) without taking the service down. Also, 
don’t forget that you need to keep the virtualization host updated as well.
When you’re using virtualized systems, it’s important to protect the stability of the host. 
This usually means avoiding using the host for any purpose other than hosting the virtual-
ized elements. If host availability is compromised, the availability and stability of the vir-
tual systems are also compromised.
Virtualized systems should be security tested. The virtualized OSs can be tested in the 
same manner as hardware-installed OSs, such as with vulnerability assessment and pen-
etration testing. However, the virtualization product may introduce additional and unique 
security concerns, so the testing process needs to be adapted to include those idiosyncrasies.
A 
cloud access security broker (CASB)
is a security policy enforcement solution that 
may be installed on-premises, or it may be cloud-based. The goal of a CASB is to enforce 
and ensure that proper security measures are implemented between a cloud solution and a 
customer organization.

---

Distributed Systems and Endpoint Security 
357
Security as a service (SECaaS)
is a cloud provider concept in which security is provided 
to an organization through or by an online entity. The purpose of SECaaS solutions are to 
reduce the cost and overhead of implementing and managing security locally. SECaaS often 
implements software-only security components that do not need dedicated on-premises 
hardware. SECaaS security components can include a wide range of security products, 
including authentication, authorization, auditing/accounting, anti-malware, intrusion 
detection, compliance and vulnerability scanning, penetration testing, and security event 
management.
The 
cloud shared responsibility model
is the concept that when an organization uses a 
cloud solution, there is a division of security and stability responsibility between the pro-
vider and the customer. The different forms of cloud service (such as SaaS, PaaS, and IaaS) 
may each have different levels or division points of shared responsibility. A SaaS solution 
places most of the management burden on the shoulders of the cloud provider, while IaaS 
management leans more toward the customer. When electing to use a cloud service, it is 
important to consider the specifics of the management, troubleshooting, and security man-
agement and how those responsibilities are assigned, divided, or shared between the cloud 
provider and the customer.