There are numerous ways one can gain unauthorized access to data maintained in the cloud’s data centers. The methods vary from physical theft to trickery and electronic attack. Common methods of attack include cracking weak passwords, privilege escalation, exploiting unused database functionality, targeting known unfixed software vulnerabilities, SQL injection, and stealing unencrypted back-up tapes (Higgins, 2008).
The Cloud Security Allience (CSA), which promotes best practices for cloud computing security, cites seven main threats to the cloud: “1) Abuse and nefarious use of cloud computing; 2) Insecure application programming interfaces; 3) Malicious insiders; 4) Shared technology vulnerabilities; 5) Data loss or leakages;
…show more content…
Accountability refers to determining when a security breach occurs, who was responsible for the breach, and where to place liability for any losses. Audibility is keeping tracking of who accessed or changed data and ensuring that employees maintain the minimal access level required for job success (Yang and Borg, 2012). However, it should be noted that these measures do not physically prevent subversive actions and rely on the threat of future punishment as a deterrent.
Number four on the CSA list is shared technologies vulnerability. Shared technology vulnerabilities are possible due to virtualization and multitenancy. Two independent virtual machines could be operating on the same physical machine, potentially allowing one virtual machine to peek at the other’s data through the physical link (Wiley, 2012). A Denial of Service (DoS) attack can also be instrumented through multitenancy by misappropriating resources from the shared platform (Fernandes, 2013). One step that organizations can take to prevent a multitenancy leak is to ensure the organization’s web server is not on the same platform as its database. If someone were able gain access to a web server that also had a database on it, they would have access to that database. While this requires more resources to separate the two servers, the additional layer of security is worth the expense to the organization (“Database Security,” n.d.).
Number seven on the CSA
Organizations use the Cloud in a variety of different service models (SaaS, PaaS, IaaS) and deployment models (Private, Public, Hybrid). There are a number of security issues/concerns associated with cloud computing but these issues fall into two broad categories: Security issues faced by cloud providers (organizations providing software-, platform-, or infrastructure-as-a-service via the cloud) and security issues faced by their customers.In most cases, the provider must ensure that their infrastructure is secure and that their clients’ data and applications are protected while the customer must ensure that the provider has taken the proper security measures to protect their information.
As I mentioned above, cloud computing is relatively new, and like any other new technology, it brings with it exposure and risks. As more and more data is migrated online, concerns are beginning to grow about just how safe it is. Indeed, because every component in Cloud computing is potentially accessible from the Internet, security in the Cloud
Cloud computing is a shared resource that holds valuable data from masses of people and organisations and is therefore an easy target for hackers. Security within cloud computing involves a set of control-based technologies, polices, processes and standards to protect information, data applications and infrastructures related to cloud computing usage. Security within this area addresses the physical and logical security issues across the different service models as well as how these services are delivered ie.via the public, private or hybrid model. There are many points of entry for an attacker in the cloud environment and people are more exposed to data breaches than they think e.g. using an insecure website on your mobile phone or if a database administrator shares a password, personal details can be accessed.
Over the past several years the term cloud computing has become common in homes and organizations alike. Cloud computing can be defined as a pooled set of computing resources that are furnished via the internet. There are three types of cloud services typically available, these services are Platform as a Service (PaaS), Infrastructure as a Service (IaaS), and Software as a Service (SaaS). Organizations can benefit greatly from cloud services because they eliminate the need to buy and manage physical resources. Although such an action cuts cost it leaves organization victim to the vulnerabilities and threats that exist in cloud computing. Throughout this paper I will discuss the vulnerabilities and threats that come
Despite its growing importance and necessities, cloud computing has several drawbacks and disadvantages. People need to think twice when it comes to cloud computing. They need to ask themselves questions like whether it is convenient or not, whether it is right or not, whether it is safe or not. No doubt that everyone is getting into it, but still there are several factors that have to be considered like:
Cloud computing security is a set of control based technologies and policies that must follow certain rules in order to protect applications, data and any information associated with cloud computing. It is known to provide excellent services but is still not supported by organizations due to privacy issues that includes security and privacy protection. As they obstruct the managers as well as the
Normally a third party, who creates and owns the infrastructure, provides cloud computing services to the clients. Cost effectiveness, flexibility, resource pooling and broad network access are salient features of the cloud computing. The risks to cloud computing are data security, authentication, data breaching, access control and virtual exploits.
Cloud computing infrastructure is based on the client server architecture and is thus subjected to threats that standard service infrastructure is, such as XSS, SQL Injection, machine code injection etc. But some attacks are specific just to the cloud based infrastructure,
“The cloud” is a phrase which is heard often, but also frequently misunderstood. Nowadays, when you hear it, it is probably not referring to the puffy white things floating in the sky, but it is more likely referring to a new computer technology. Most people do realize it is a technical expression, but cannot actually define it. Essentially, it is huge data centers housing hundreds of servers which hold considerable amounts of data. There are a number of corporations delivering cloud services, and the major players include Amazon, Google, Microsoft and Apple, to name a few. They provide individuals, small businesses and major corporations the opportunity to save costs on technology by storing data on their servers, which must then be accessed through the internet. So, with the rapid growth of cloud computing, more and more information is being stored on the internet. While the cloud does have many benefits such as low technology costs, more accessibility and highly trained IT professionals monitoring security, the data stored in the cloud is still at risk due to imminent privacy and security breaches such as government snooping as well as hacker theft and manipulation.
Cloud computing security is combination of control-based technologies like network security, pc security, info security and policies designed to bind the restrictive compliance rules. It 's primarily wont to shield info, knowledge applications and infrastructure related to cloud computing use. The zoom in field of “cloud computing” has multiplied severe security issues like securing knowledge, and examining the use of cloud by the cloud computing vendors. the most plan is to spot the foremost dangerous security threats in cloud computing, which is able to alter each finish users and vendors to grasp concerning the key security threats related to cloud computing and to resolve the safety problems victimization totally different security models.
security threats we describe, i) how it can be used to exploit cloud components and its effect on
What is often missed is the reality that the increased use of cloud services is driving further breaches of unauthorized access of sensitive information in the cloud,
According to [3], there are so many security risks of the user of the cloud computing services, for handling these hazards the possible types of attacks must be categorized so that the solution of that can be found [4]. The author has proposed the idea of attacks possible in the cloud computing. The organizations are providing cloud services according to the cloud computing categorization. The cloud computing is still not matured in terms of security, and most of the researchers in published literature focused on security and new categorization of the attack surface. The paper focused on the initial attacks and hacking efforts linked to cloud computing organizations and their systems. In the cloud computing, there are three different contributor classes as a user, the cloud, and service. In cloud computing, two contributors must involve in the communication. The attacks can be launched on any of these three contributors during communication. The contributor classes must be secured with a security interface or a channel between the communicating parties, which depends on the service model that the cloud have like IaaS, PaaS, and SaaS.
For example, Facebook and Google docs are system that store data in the cloud (Demir 2012, 31), and users do not have total control or knowledge of where or how long time the data is stored. The second category of risk, tradition security threats, is the one that most of systems are subjected and in cloud system have their consequence in a larger amount of users (Marinescu 2013, p. 274). Generally, tradition security threats are related to disorder in the system integrity that can occur through intentional attacks, such as phishing, SQL insertion, and cross-site scripting (NIST 2012; Marinescu 2013, p. 274). One example of this type of attack is the one that occurred in Akamai on 2004 that affected google, yahoo and other major companies (Marinescu 2013, p. 15). The last classification of risk, system availability, can be caused by unexpected events as system failures and power outages; for instance, the interruption of Amazon servers in 2009 that was caused by a lightning (Marinescu 2013, p. 15). Cloud systems are vulnerable to a series of different risks and a trustable system should be capable to avoid and rapidly recover from this failures.
Security Issues : There are many challenges in the area of cloud computing and security is one of them. Increasing the level of security is required for improving the quality of cloud based services. Location of data is a important factor in the security of cloud based computing. Transparency of the data location provides the flexibility for cloud based computing, but this is also a threat related to security. For cloud users, to maintain their personal data is a major issue related to cloud computing security. Technical security and policies for cloud users plays a vital role in the cloud security. To build trust and establish it for customers who want to use cloud services, is another issue related to the cloud based computing. Security attacks is another issue related