论文标题
保护云数据平面的体系结构
Architectures for Protecting Cloud Data Planes
论文作者
论文摘要
本文探讨了保护云应用程序数据平面的三种方法，以防止未经授权访问该应用程序及其数据并防止不必要的数据剥落。通过探索各种具体的安全体系结构，我们关注（1）云安全周围，以在云中提供围绕数据和基础架构的边界，以提供一条防御线，以不当访问敏感信息，以及对该信息的逐渐渗透，（2）云着陆点以在云上的安全性以及在您的云中进行安全的零件（2）云降落点，以实现您的范围，以实现您的范围，以实现范围，并在您的范围内进行安全的范围（3），并在范围内进行启用（3）。深入的国防原则和最小特权的访问原则。共同使用这些方法为服务和应用程序从传统的本地网络安全过渡到云安全体系结构，然后再到潜在的零信任安全体系结构，为服务和应用程序提供了关键的保护。
This paper explores three approaches for protecting cloud application data planes to prevent unauthorized access to the application and its data and to prevent unwanted data exfiltration. Through an exploration of various concrete security architectures, we focus on (1) Cloud Security Perimeters to provide a boundary around data and infrastructure in the cloud that provides a line of defense both to improper access to sensitive information and the exfiltration of that information, (2) Cloud Landing Points to provide a safe integration point between parts of your cloud applications and on-premises applications to communicate through, and (3) Zero Trust security architectures that are built on the principles of defense in depth and least-privilege access. Using these approaches together provides critical protection for services and applications as they transition from traditional on-premises network security to the Cloud security architectures, and then to potentially Zero Trust security architectures.
