Cloud Security & CASB Architecture Guide | Draftsbook

Lesson Focus & Objectives

Securing distributed cloud environments requires abandoning perimeter-based castle-and-moat security assumptions. In modern cloud architecture, the network boundary is dissolved—workloads run across multi-tenant servers, API calls traverse public Internet backbones, and remote engineers push code from diverse endpoints. In Part 7, we explore the core principles of Zero Trust Architecture in the cloud, evaluate IAM least privilege, unpack KMS envelope encryption with Hardware Security Modules (HSM), and dissect Cloud Access Security Brokers (CASB).

1. The Zero Trust Paradigm: "Never Trust, Always Verify"

Traditional enterprise security assumed that any entity inside the corporate LAN or VPN was benign. Cloud-native architecture replaces this flawed premise with NIST SP 800-207 Zero Trust tenets:

Verify Explicitly: Always authenticate and authorize based on all available data points—including user identity, location, device health, service classification, and anomaly indicators.
Use Least Privilege Access: Limit user access with Just-In-Time (JIT) and Just-Enough-Access (JEA), risk-based adaptive policies, and data protection mechanisms.
Assume Breach: Minimize blast radius by segmenting access by network, user, devices, and application awareness. Encrypt all sessions end-to-end and utilize automated threat detection.

2. Cloud Data Protection: KMS & Envelope Encryption

To protect petabytes of customer records without incurring massive cryptographic key transfer overhead, cloud providers employ Envelope Encryption managed by Key Management Services (AWS KMS, Google Cloud KMS, Azure Key Vault):

1. Customer Master Key (CMK) / Root Key

Stored securely inside certified FIPS 140-2 Level 3 Hardware Security Modules (HSM). Master keys never leave the secure silicon boundary under any circumstances.

2. Data Encryption Key (DEK) Generation

When an application needs to encrypt a file or database row, KMS generates a unique Data Encryption Key (DEK). It returns two versions: a plaintext DEK and an encrypted DEK (ciphertext) wrapped by the master key.

3. Local Encryption & Memory Purge

The application encrypts the data locally using high-speed AES-256-GCM with the plaintext DEK, immediately zeroes out the plaintext DEK from RAM, and stores the encrypted DEK alongside the ciphertext on disk.

3. Cloud Access Security Brokers (CASB)

A Cloud Access Security Broker (CASB) is an on-premises or cloud-hosted software enforcement point situated between cloud service consumers and cloud service providers. CASB fulfills four critical operational pillars:

1. Shadow IT Discovery

Analyzes network firewall and proxy logs to detect unauthorized SaaS applications used by corporate employees, scoring their risk profile and compliance posture.

2. Data Loss Prevention (DLP)

Inspects files uploaded to cloud storage (S3, Box, OneDrive) in real-time. Automatically blocks or redacts unencrypted Social Security numbers, credit card data, and proprietary intellectual property.

3. Threat Protection

Uses User and Entity Behavior Analytics (UEBA) to identify anomalous account takeovers (e.g., simultaneous logins from London and Tokyo within 5 minutes).

4. Compliance Auditing

Continuously audits AWS, Azure, and GCP account configurations against CIS Benchmarks, SOC 2, and PCI-DSS, alerting engineers to publicly exposed storage buckets.