保护云数据平面的架构
Architectures for Protecting Cloud Data Planes
摘要：
本文探讨了三种保护云应用程序数据平面的方法，以防止对应用程序及其数据的未经授权的访问，并防止不必要的数据泄露。通过对各种具体安全架构的探索，我们重点关注（1）云安全边界，以提供云中数据和基础设施的边界，为不正确访问敏感信息和泄露该信息提供防线，（2）云着陆点，在云应用程序的各个部分和本地应用程序之间提供一个安全的集成点，以便通过它进行通信，基于深度防御和最小权限访问原则的零信任安全体系结构。当服务和应用程序从传统的本地网络安全过渡到云安全架构，然后过渡到潜在的零信任安全架构时，将这些方法结合使用可以为它们提供关键的保护。
英文摘要：
This paper explores three approaches for protecting cloud application data planes to prevent unauthorized access to the application and its data and to prevent unwanted data exfiltration. Through an exploration of various concrete security architectures, we focus on (1) Cloud Security Perimeters to provide a boundary around data and infrastructure in the cloud that provides a line of defense both to improper access to sensitive information and the exfiltration of that information, (2) Cloud Landing Points to provide a safe integration point between parts of your cloud applications and on-premises applications to communicate through, and (3) Zero Trust security architectures that are built on the principles of defense in depth and least-privilege access. Using these approaches together provides critical protection for services and applications as they transition from traditional on-premises network security to the Cloud security architectures, and then to potentially Zero Trust security architectures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
