Cloud Security Best Practices: Essential Strategies for Protecting Your Digital Infrastructure in 2025

import hashlib
import json
import boto3
import logging
from datetime import datetime, timedelta
from typing import Dict, List, Optional, Any
from dataclasses import dataclass, field
from enum import Enum
import uuid
import base64
from cryptography.fernet import Fernet
import requests

class SecurityLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

class ThreatType(Enum):
    MALWARE = "malware"
    PHISHING = "phishing"
    INSIDER_THREAT = "insider_threat"
    DATA_BREACH = "data_breach"
    MISCONFIGURATION = "misconfiguration"
    UNAUTHORIZED_ACCESS = "unauthorized_access"

@dataclass
class SecurityEvent:
    """Represents a security event in the cloud environment"""
    event_id: str
    timestamp: datetime
    event_type: ThreatType
    severity: SecurityLevel
    source_ip: str
    affected_resource: str
    description: str
    user_id: Optional[str] = None
    remediation_status: str = "pending"
    
@dataclass
class CloudResource:
    """Represents a cloud resource with security attributes"""
    resource_id: str
    resource_type: str
    region: str
    encryption_status: bool
    public_access: bool
    compliance_status: Dict[str, bool] = field(default_factory=dict)
    last_scan: Optional[datetime] = None
    vulnerability_count: int = 0
    
@dataclass
class User:
    """Represents a user with access to cloud resources"""
    user_id: str
    email: str
    role: str
    mfa_enabled: bool
    last_login: Optional[datetime] = None
    failed_login_attempts: int = 0
    risk_score: float = 0.5
    
class CloudSecurityFramework:
    """Comprehensive cloud security framework with best practices implementation"""
    
    def __init__(self, organization_name: str):
        self.organization_name = organization_name
        self.security_events: List[SecurityEvent] = []
        self.cloud_resources: Dict[str, CloudResource] = {}
        self.users: Dict[str, User] = {}
        
        # Security configuration
        self.encryption_key = Fernet.generate_key()
        self.cipher_suite = Fernet(self.encryption_key)
        
        # Monitoring and alerting
        self.monitoring_enabled = True
        self.alert_thresholds = {
            SecurityLevel.CRITICAL: 0,  # Alert immediately
            SecurityLevel.HIGH: 1,      # Alert after 1 event
            SecurityLevel.MEDIUM: 5,    # Alert after 5 events
            SecurityLevel.LOW: 10       # Alert after 10 events
        }
        
        # Compliance frameworks
        self.compliance_frameworks = {
            "SOC2": {"enabled": True, "last_audit": None},
            "ISO27001": {"enabled": True, "last_audit": None},
            "GDPR": {"enabled": True, "last_audit": None},
            "HIPAA": {"enabled": False, "last_audit": None}
        }
        
        # Zero Trust configuration
        self.zero_trust_enabled = True
        self.mfa_required = True
        self.continuous_verification = True
        
        # Threat detection AI/ML models (simplified)
        self.threat_detection_models = {
            "anomaly_detection": {"enabled": True, "accuracy": 0.92},
            "behavioral_analysis": {"enabled": True, "accuracy": 0.88},
            "malware_detection": {"enabled": True, "accuracy": 0.96}
        }
        
        # Setup logging
        logging.basicConfig(level=logging.INFO)
        self.logger = logging.getLogger(__name__)
        
    def register_cloud_resource(self, resource: CloudResource) -> bool:
        """Register a new cloud resource for monitoring"""
        self.cloud_resources[resource.resource_id] = resource
        self.logger.info(f"Registered cloud resource: {resource.resource_id}")
        
        # Perform immediate security scan
        self._scan_resource_security(resource)
        
        return True
        
    def register_user(self, user: User) -> bool:
        """Register a new user with security validation"""
        # Validate MFA requirement
        if self.mfa_required and not user.mfa_enabled:
            self.logger.warning(f"User {user.user_id} registered without MFA - security risk")
            self._create_security_event(
                ThreatType.MISCONFIGURATION,
                SecurityLevel.MEDIUM,
                "127.0.0.1",
                f"user:{user.user_id}",
                "User registered without MFA enabled",
                user.user_id
            )
            
        self.users[user.user_id] = user
        self.logger.info(f"Registered user: {user.user_id}")
        return True
        
    def authenticate_user(self, user_id: str, password: str, 
                         mfa_token: Optional[str] = None, 
                         source_ip: str = "unknown") -> Dict[str, Any]:
        """Authenticate user with Zero Trust principles"""
        if user_id not in self.users:
            self._create_security_event(
                ThreatType.UNAUTHORIZED_ACCESS,
                SecurityLevel.MEDIUM,
                source_ip,
                f"user:{user_id}",
                "Authentication attempt for non-existent user"
            )
            return {"success": False, "reason": "Invalid user"}
            
        user = self.users[user_id]
        
        # Check for account lockout due to failed attempts
        if user.failed_login_attempts >= 5:
            self._create_security_event(
                ThreatType.UNAUTHORIZED_ACCESS,
                SecurityLevel.HIGH,
                source_ip,
                f"user:{user_id}",
                "Authentication attempt on locked account",
                user_id
            )
            return {"success": False, "reason": "Account locked"}
            
        # Simplified password validation (in production, use proper hashing)
        password_valid = len(password) >= 8  # Simplified validation
        
        # MFA validation
        mfa_valid = True
        if self.mfa_required and user.mfa_enabled:
            mfa_valid = self._validate_mfa_token(user_id, mfa_token)
            
        # Risk-based authentication
        risk_factors = self._calculate_authentication_risk(user, source_ip)
        
        if password_valid and mfa_valid and risk_factors["total_risk"] < 0.7:
            # Successful authentication
            user.last_login = datetime.now()
            user.failed_login_attempts = 0
            
            # Generate secure session token
            session_token = self._generate_session_token(user_id)
            
            self.logger.info(f"Successful authentication for user: {user_id}")
            return {
                "success": True,
                "session_token": session_token,
                "risk_score": risk_factors["total_risk"],
                "requires_additional_verification": risk_factors["total_risk"] > 0.5
            }
        else:
            # Failed authentication
            user.failed_login_attempts += 1
            
            self._create_security_event(
                ThreatType.UNAUTHORIZED_ACCESS,
                SecurityLevel.MEDIUM if user.failed_login_attempts < 3 else SecurityLevel.HIGH,
                source_ip,
                f"user:{user_id}",
                f"Failed authentication attempt #{user.failed_login_attempts}",
                user_id
            )
            
            return {
                "success": False, 
                "reason": "Authentication failed",
                "attempts_remaining": max(0, 5 - user.failed_login_attempts)
            }
            
    def encrypt_data(self, data: str) -> str:
        """Encrypt sensitive data using AES-256 encryption"""
        encrypted_data = self.cipher_suite.encrypt(data.encode())
        return base64.b64encode(encrypted_data).decode()
        
    def decrypt_data(self, encrypted_data: str) -> str:
        """Decrypt encrypted data"""
        try:
            encrypted_bytes = base64.b64decode(encrypted_data.encode())
            decrypted_data = self.cipher_suite.decrypt(encrypted_bytes)
            return decrypted_data.decode()
        except Exception as e:
            self.logger.error(f"Decryption failed: {e}")
            return ""
            
    def scan_for_vulnerabilities(self) -> Dict[str, Any]:
        """Comprehensive vulnerability scanning across all cloud resources"""
        scan_results = {
            "scan_id": str(uuid.uuid4()),
            "timestamp": datetime.now(),
            "resources_scanned": len(self.cloud_resources),
            "vulnerabilities_found": [],
            "misconfigurations": [],
            "compliance_issues": [],
            "risk_summary": {level.value: 0 for level in SecurityLevel}
        }
        
        for resource_id, resource in self.cloud_resources.items():
            # Simulate vulnerability scanning
            vulnerabilities = self._scan_resource_vulnerabilities(resource)
            scan_results["vulnerabilities_found"].extend(vulnerabilities)
            
            # Check for misconfigurations
            misconfigs = self._check_resource_misconfigurations(resource)
            scan_results["misconfigurations"].extend(misconfigs)
            
            # Compliance validation
            compliance_issues = self._validate_resource_compliance(resource)
            scan_results["compliance_issues"].extend(compliance_issues)
            
            # Update resource scan timestamp
            resource.last_scan = datetime.now()
            
        # Calculate risk summary
        all_issues = (scan_results["vulnerabilities_found"] + 
                     scan_results["misconfigurations"] + 
                     scan_results["compliance_issues"])
        
        for issue in all_issues:
            severity = SecurityLevel(issue["severity"])
            scan_results["risk_summary"][severity.value] += 1
            
        self.logger.info(f"Vulnerability scan completed. Found {len(all_issues)} issues.")
        return scan_results
        
    def implement_zero_trust_policies(self) -> Dict[str, Any]:
        """Implement and validate Zero Trust security policies"""
        policies = {
            "identity_verification": {
                "mfa_required": self.mfa_required,
                "continuous_verification": self.continuous_verification,
                "users_compliant": 0,
                "users_non_compliant": 0
            },
            "least_privilege": {
                "policy_enabled": True,
                "over_privileged_users": [],
                "unused_permissions": []
            },
            "network_segmentation": {
                "micro_segmentation_enabled": True,
                "isolated_environments": len([r for r in self.cloud_resources.values() if not r.public_access]),
                "public_resources": len([r for r in self.cloud_resources.values() if r.public_access])
            },
            "device_trust": {
                "device_compliance_required": True,
                "managed_devices": 0,
                "unmanaged_devices": 0
            }
        }
        
        # Validate user compliance with Zero Trust principles
        for user in self.users.values():
            if user.mfa_enabled and user.risk_score < 0.5:
                policies["identity_verification"]["users_compliant"] += 1
            else:
                policies["identity_verification"]["users_non_compliant"] += 1
                
                # Create compliance issue for non-compliant users
                self._create_security_event(
                    ThreatType.MISCONFIGURATION,
                    SecurityLevel.MEDIUM,
                    "internal",
                    f"user:{user.user_id}",
                    "User not compliant with Zero Trust policies",
                    user.user_id
                )
                
        return policies
        
    def generate_security_report(self, period_days: int = 30) -> Dict[str, Any]:
        """Generate comprehensive security report"""
        end_date = datetime.now()
        start_date = end_date - timedelta(days=period_days)
        
        # Filter events for the reporting period
        period_events = [
            event for event in self.security_events 
            if start_date <= event.timestamp <= end_date
        ]
        
        # Calculate metrics
        threat_distribution = {threat_type.value: 0 for threat_type in ThreatType}
        severity_distribution = {level.value: 0 for level in SecurityLevel}
        
        for event in period_events:
            threat_distribution[event.event_type.value] += 1
            severity_distribution[event.severity.value] += 1
            
        # Resource security posture
        encrypted_resources = len([r for r in self.cloud_resources.values() if r.encryption_status])
        public_resources = len([r for r in self.cloud_resources.values() if r.public_access])
        
        # User security metrics
        mfa_enabled_users = len([u for u in self.users.values() if u.mfa_enabled])
        high_risk_users = len([u for u in self.users.values() if u.risk_score > 0.7])
        
        report = {
            "report_period": {
                "start_date": start_date.isoformat(),
                "end_date": end_date.isoformat(),
                "days": period_days
            },
            "security_events": {
                "total_events": len(period_events),
                "by_threat_type": threat_distribution,
                "by_severity": severity_distribution,
                "critical_events": len([e for e in period_events if e.severity == SecurityLevel.CRITICAL])
            },
            "resource_security": {
                "total_resources": len(self.cloud_resources),
                "encrypted_resources": encrypted_resources,
                "encryption_percentage": (encrypted_resources / len(self.cloud_resources) * 100) if self.cloud_resources else 0,
                "public_resources": public_resources,
                "public_exposure_percentage": (public_resources / len(self.cloud_resources) * 100) if self.cloud_resources else 0
            },
            "user_security": {
                "total_users": len(self.users),
                "mfa_enabled": mfa_enabled_users,
                "mfa_compliance_percentage": (mfa_enabled_users / len(self.users) * 100) if self.users else 0,
                "high_risk_users": high_risk_users
            },
            "compliance_status": self._get_compliance_summary(),
            "recommendations": self._generate_security_recommendations()
        }
        
        return report
        
    def _scan_resource_security(self, resource: CloudResource):
        """Perform security scan on a cloud resource"""
        # Check encryption status
        if not resource.encryption_status:
            self._create_security_event(
                ThreatType.MISCONFIGURATION,
                SecurityLevel.HIGH,
                "internal",
                resource.resource_id,
                "Resource not encrypted at rest"
            )
            
        # Check public access
        if resource.public_access and resource.resource_type in ["database", "storage"]:
            self._create_security_event(
                ThreatType.MISCONFIGURATION,
                SecurityLevel.CRITICAL,
                "internal",
                resource.resource_id,
                "Sensitive resource exposed to public internet"
            )
            
    def _create_security_event(self, event_type: ThreatType, severity: SecurityLevel,
                             source_ip: str, affected_resource: str, 
                             description: str, user_id: Optional[str] = None):
        """Create and log a security event"""
        event = SecurityEvent(
            event_id=str(uuid.uuid4()),
            timestamp=datetime.now(),
            event_type=event_type,
            severity=severity,
            source_ip=source_ip,
            affected_resource=affected_resource,
            description=description,
            user_id=user_id
        )
        
        self.security_events.append(event)
        
        # Check if alert should be triggered
        if self._should_trigger_alert(event):
            self._send_security_alert(event)
            
    def _should_trigger_alert(self, event: SecurityEvent) -> bool:
        """Determine if an event should trigger an alert"""
        threshold = self.alert_thresholds.get(event.severity, 1)
        
        if threshold == 0:  # Immediate alert
            return True
            
        # Count recent events of same severity
        recent_events = [
            e for e in self.security_events 
            if e.severity == event.severity and 
            e.timestamp >= datetime.now() - timedelta(hours=1)
        ]
        
        return len(recent_events) >= threshold
        
    def _send_security_alert(self, event: SecurityEvent):
        """Send security alert (simplified implementation)"""
        alert_message = {
            "alert_id": str(uuid.uuid4()),
            "timestamp": event.timestamp.isoformat(),
            "severity": event.severity.value,
            "event_type": event.event_type.value,
            "description": event.description,
            "affected_resource": event.affected_resource,
            "recommended_action": self._get_recommended_action(event)
        }
        
        self.logger.warning(f"SECURITY ALERT: {alert_message}")
        
        # In production, this would send to SIEM, email, Slack, etc.
        
    def _validate_mfa_token(self, user_id: str, token: Optional[str]) -> bool:
        """Validate MFA token (simplified implementation)"""
        if not token:
            return False
            
        # Simplified validation - in production, integrate with TOTP/SMS/hardware keys
        return len(token) == 6 and token.isdigit()
        
    def _calculate_authentication_risk(self, user: User, source_ip: str) -> Dict[str, float]:
        """Calculate risk factors for authentication attempt"""
        risk_factors = {
            "user_risk_score": user.risk_score,
            "failed_attempts": min(user.failed_login_attempts / 5, 1.0),
            "ip_reputation": self._check_ip_reputation(source_ip),
            "time_based": self._calculate_time_risk(),
            "location_anomaly": 0.2  # Simplified - would check against user's normal locations
        }
        
        # Weighted risk calculation
        weights = {"user_risk_score": 0.3, "failed_attempts": 0.25, "ip_reputation": 0.2, 
                  "time_based": 0.15, "location_anomaly": 0.1}
        
        total_risk = sum(risk_factors[factor] * weights[factor] for factor in risk_factors)
        risk_factors["total_risk"] = min(total_risk, 1.0)
        
        return risk_factors
        
    def _generate_session_token(self, user_id: str) -> str:
        """Generate secure session token"""
        token_data = {
            "user_id": user_id,
            "timestamp": datetime.now().isoformat(),
            "session_id": str(uuid.uuid4())
        }
        
        token_string = json.dumps(token_data)
        encrypted_token = self.cipher_suite.encrypt(token_string.encode())
        return base64.b64encode(encrypted_token).decode()
        
    def _scan_resource_vulnerabilities(self, resource: CloudResource) -> List[Dict[str, Any]]:
        """Scan resource for vulnerabilities (simplified)"""
        vulnerabilities = []
        
        # Simulate vulnerability detection
        if resource.resource_type == "vm" and not resource.encryption_status:
            vulnerabilities.append({
                "resource_id": resource.resource_id,
                "vulnerability_type": "unencrypted_storage",
                "severity": "high",
                "description": "Virtual machine storage not encrypted",
                "remediation": "Enable disk encryption"
            })
            
        if resource.public_access:
            vulnerabilities.append({
                "resource_id": resource.resource_id,
                "vulnerability_type": "public_exposure",
                "severity": "medium" if resource.resource_type == "web_app" else "critical",
                "description": "Resource exposed to public internet",
                "remediation": "Restrict access using security groups and VPNs"
            })
            
        resource.vulnerability_count = len(vulnerabilities)
        return vulnerabilities
        
    def _check_resource_misconfigurations(self, resource: CloudResource) -> List[Dict[str, Any]]:
        """Check for common misconfigurations"""
        misconfigs = []
        
        if not resource.encryption_status:
            misconfigs.append({
                "resource_id": resource.resource_id,
                "misconfiguration": "encryption_disabled",
                "severity": "high",
                "description": "Encryption at rest not enabled"
            })
            
        return misconfigs
        
    def _validate_resource_compliance(self, resource: CloudResource) -> List[Dict[str, Any]]:
        """Validate resource compliance with frameworks"""
        compliance_issues = []
        
        for framework, config in self.compliance_frameworks.items():
            if config["enabled"] and not resource.compliance_status.get(framework, False):
                compliance_issues.append({
                    "resource_id": resource.resource_id,
                    "framework": framework,
                    "severity": "medium",
                    "description": f"Resource not compliant with {framework} requirements"
                })
                
        return compliance_issues
        
    def _get_compliance_summary(self) -> Dict[str, Any]:
        """Get summary of compliance status across all frameworks"""
        summary = {}
        
        for framework, config in self.compliance_frameworks.items():
            if config["enabled"]:
                compliant_resources = len([
                    r for r in self.cloud_resources.values() 
                    if r.compliance_status.get(framework, False)
                ])
                
                summary[framework] = {
                    "enabled": True,
                    "compliant_resources": compliant_resources,
                    "total_resources": len(self.cloud_resources),
                    "compliance_percentage": (compliant_resources / len(self.cloud_resources) * 100) if self.cloud_resources else 0
                }
                
        return summary
        
    def _generate_security_recommendations(self) -> List[str]:
        """Generate security recommendations based on current state"""
        recommendations = []
        
        # Encryption recommendations
        unencrypted_resources = len([r for r in self.cloud_resources.values() if not r.encryption_status])
        if unencrypted_resources > 0:
            recommendations.append(f"Enable encryption for {unencrypted_resources} unencrypted resources")
            
        # MFA recommendations
        non_mfa_users = len([u for u in self.users.values() if not u.mfa_enabled])
        if non_mfa_users > 0:
            recommendations.append(f"Enable MFA for {non_mfa_users} users without multi-factor authentication")
            
        # Public access recommendations
        public_resources = len([r for r in self.cloud_resources.values() if r.public_access])
        if public_resources > 0:
            recommendations.append(f"Review and restrict public access for {public_resources} publicly accessible resources")
            
        # High-risk user recommendations
        high_risk_users = len([u for u in self.users.values() if u.risk_score > 0.7])
        if high_risk_users > 0:
            recommendations.append(f"Review and remediate {high_risk_users} high-risk user accounts")
            
        return recommendations
        
    # Simplified helper methods
    def _check_ip_reputation(self, ip: str) -> float:
        """Check IP reputation (simplified)"""
        # In production, integrate with threat intelligence feeds
        private_ips = ['192.168.', '10.', '172.16.', '127.0.0.1']
        if any(ip.startswith(private) for private in private_ips):
            return 0.1  # Low risk for private IPs
        return 0.3  # Medium risk for unknown public IPs
        
    def _calculate_time_risk(self) -> float:
        """Calculate time-based risk factors"""
        current_hour = datetime.now().hour
        # Higher risk during off-hours
        if current_hour < 6 or current_hour > 22:
            return 0.4
        return 0.1
        
    def _get_recommended_action(self, event: SecurityEvent) -> str:
        """Get recommended action for security event"""
        actions = {
            ThreatType.UNAUTHORIZED_ACCESS: "Review access logs and verify user identity",
            ThreatType.MISCONFIGURATION: "Correct configuration and apply security policies",
            ThreatType.MALWARE: "Isolate affected system and run malware scan",
            ThreatType.DATA_BREACH: "Activate incident response plan and notify stakeholders",
            ThreatType.PHISHING: "Block sender and provide security awareness training",
            ThreatType.INSIDER_THREAT: "Conduct investigation and review user privileges"
        }
        return actions.get(event.event_type, "Investigate and remediate as appropriate")

# Example usage and demonstration
def run_cloud_security_demo():
    print("=== Cloud Security Framework Demo ===")
    
    # Initialize security framework
    security_framework = CloudSecurityFramework("TechCorp Inc.")
    
    # Register users
    users = [
        User("user001", "john.doe@techcorp.com", "developer", mfa_enabled=True),
        User("user002", "jane.smith@techcorp.com", "admin", mfa_enabled=True),
        User("user003", "bob.wilson@techcorp.com", "analyst", mfa_enabled=False)  # Non-compliant
    ]
    
    for user in users:
        security_framework.register_user(user)
        
    # Register cloud resources
    resources = [
        CloudResource("vm-001", "vm", "us-east-1", encryption_status=True, public_access=False),
        CloudResource("db-001", "database", "us-west-2", encryption_status=False, public_access=True),  # Risky
        CloudResource("storage-001", "storage", "eu-west-1", encryption_status=True, public_access=False),
        CloudResource("web-001", "web_app", "us-east-1", encryption_status=True, public_access=True)
    ]
    
    for resource in resources:
        security_framework.register_cloud_resource(resource)
        
    print(f"Registered {len(users)} users and {len(resources)} cloud resources")
    
    # Demonstrate authentication
    print("\n=== Authentication Tests ===")
    auth_tests = [
        {"user_id": "user001", "password": "SecurePass123", "mfa_token": "123456", "ip": "192.168.1.100"},
        {"user_id": "user002", "password": "weak", "mfa_token": "654321", "ip": "203.0.113.1"},
        {"user_id": "unknown", "password": "password123", "mfa_token": None, "ip": "198.51.100.1"}
    ]
    
    for test in auth_tests:
        result = security_framework.authenticate_user(
            test["user_id"], test["password"], test["mfa_token"], test["ip"]
        )
        print(f"Auth {test['user_id']}: {'SUCCESS' if result['success'] else 'FAILED'} - {result.get('reason', 'OK')}")
        
    # Perform vulnerability scan
    print("\n=== Vulnerability Scanning ===")
    scan_results = security_framework.scan_for_vulnerabilities()
    print(f"Scan completed: {scan_results['resources_scanned']} resources scanned")
    print(f"Found {len(scan_results['vulnerabilities_found'])} vulnerabilities")
    print(f"Found {len(scan_results['misconfigurations'])} misconfigurations")
    
    # Implement Zero Trust policies
    print("\n=== Zero Trust Implementation ===")
    zt_policies = security_framework.implement_zero_trust_policies()
    print(f"MFA Compliant Users: {zt_policies['identity_verification']['users_compliant']}")
    print(f"Non-Compliant Users: {zt_policies['identity_verification']['users_non_compliant']}")
    print(f"Public Resources: {zt_policies['network_segmentation']['public_resources']}")
    
    # Generate security report
    print("\n=== Security Report ===")
    report = security_framework.generate_security_report()
    
    print(f"Security Events (30 days): {report['security_events']['total_events']}")
    print(f"Critical Events: {report['security_events']['critical_events']}")
    print(f"Encryption Compliance: {report['resource_security']['encryption_percentage']:.1f}%")
    print(f"MFA Compliance: {report['user_security']['mfa_compliance_percentage']:.1f}%")
    print(f"High Risk Users: {report['user_security']['high_risk_users']}")
    
    print("\nSecurity Recommendations:")
    for i, rec in enumerate(report['recommendations'], 1):
        print(f"{i}. {rec}")
        
    # Demonstrate data encryption
    print("\n=== Data Encryption Demo ===")
    sensitive_data = "Credit Card: 4111-1111-1111-1111, SSN: 123-45-6789"
    encrypted = security_framework.encrypt_data(sensitive_data)
    decrypted = security_framework.decrypt_data(encrypted)
    
    print(f"Original: {sensitive_data}")
    print(f"Encrypted: {encrypted[:50]}...")
    print(f"Decrypted: {decrypted}")
    print(f"Encryption successful: {sensitive_data == decrypted}")
    
    return security_framework

# Run demonstration
if __name__ == "__main__":
    demo_framework = run_cloud_security_demo()