Cloud Data Storage Architectures
Introduction to Cloud Data Storage Architectures
In the context of the CCSP (Certified Cloud Security Professional) certification, understanding Cloud Data Storage Architectures is fundamental to applying the correct security controls. It refers to the underlying logical and physical methods cloud providers use to store data, and how that storage is presented to the cloud customer. The architecture dictates how data is accessed, secured, and managed.
Why is it Important?
Security professionals must understand storage architectures because security controls follow the data. The method you use to encrypt, back up, or destroy data depends entirely on the storage architecture. For example, data destruction techniques used for physical hard drives (degaussing) generally apply to the provider's physical layer, but the customer must rely on crypto-shredding for virtualized storage. Furthermore, knowing the difference between Object and Volume storage helps in selecting the right encryption level (file-level vs. disk-level).
How It Works: The Three Main Architectures
Cloud storage is generally categorized based on the cloud service model (IaaS, PaaS, SaaS) and the data type.
1. IaaS Storage (Infrastructure as a Service)
In IaaS, the customer manages the OS and applications, so they need raw storage.
Volume (Block) Storage: This acts like a virtual hard drive attached to a specific Virtual Machine (VM). The OS sees it as a physical disk (e.g., C: drive or /dev/sda). It is sector-based and high-performance.
Security Focus: You must encrypt the entire volume (Full Disk Encryption) or the file system.
Object Storage: This is data stored in a flat address space (not a directory tree) where files are referenced by a unique ID and accessed via APIs (REST/SOAP) over the web. It includes the Data (blob), a Unique ID, and Extended Metadata.
Security Focus: Access control via API keys and bucket policies; encryption at the object level.
2. PaaS Storage (Platform as a Service)
Here, the provider manages the OS, and the customer manages the application and data.
Structured (Database) Storage: Data is stored in databases (SQL, NoSQL) maintained by the provider.
Security Focus: Transparent Data Encryption (TDE), column-level encryption, and database activity monitoring (DAM).
3. SaaS Storage (Software as a Service)
Information Storage: The data is entered into the application (e.g., Salesforce, Gmail, Dropbox). The user has no visibility into the infrastructure or platform.
Security Focus: Data Loss Prevention (DLP), proxy encryption, and strict Access Management (IAM).
Deep Dive: Ephemeral vs. Persistent
Ephemeral Storage: Temporary storage associated with a compute instance. If the instance is stopped or crashes, the data is lost. Used for swap files and temporary caches.
Persistent Storage: Data survives the reboot or termination of an instance (e.g., detached Block storage volumes or Object storage).
Exam Tips: Answering Questions on Cloud Data Storage Architectures
When facing CCSP exam questions regarding storage architectures, follow this logic:
1. Identify the Service Model: Determine if the scenario is IaaS, PaaS, or SaaS. This immediately narrows down the storage type (e.g., if they mention managing the OS kernel, it is IaaS/Block).
2. Look for Key Characteristics:
If the question mentions 'Metadata', 'APIs', or 'Web Access', the answer is usually Object Storage.
If the question mentions 'Booting an OS', 'Sector-based', or 'High Input/Output (IOPS)', the answer is usually Volume/Block Storage.
If the question mentions 'Tables', 'Indexing', or 'Queries', the answer is Structured/Database Storage.
If the question mentions 'Content Delivery Network (CDN)', remember that CDNs primarily store cached content at edge locations to reduce latency.
3. Data Dispersion/Fragmentation: Remember that in cloud storage, data is rarely on a single physical disk. It is fragmented and dispersed (striped) across multiple nodes for redundancy. This makes physical theft of a drive useless but makes forensic recovery of 'deleted' data difficult for the customer.
4. Storage Threats:
Insecure API usage is the top threat for Object Storage.
Improper permissions (Public Buckets) is a frequent configuration error tested on the exam.
Summary Table for Exam Recall:
Block: IaaS, OS Install, Encrypt at OS/Volume level.
Object: IaaS/PaaS, API access, Metadata heavy, Encrypt via Client or Provider keys.
Database: PaaS, Structured data, Encrypt via Database Engine (TDE).