Cloud Implementation Security Challenges

Cloud Implementation Securi Challenges Mv Bmh fz Boh y Chp

Mhmm Nwz Boh

Universiti Teknologi Malaysia, Malaysia [email protected] nbsar[email protected],

Preston University Ajman, UAE

bs

Cloud computing offers signicant features such as resource pooling, scalability, on-demand self service, availability, and reliability to organizations to improve their quality of services. For example by using cloud computing services in healthcare it is possible to reach large population of people in isolated geographical areas which will assist in saving their lives in critical situations. It enables the use of latest technologies through its various service delivery and deployment models via the internet on pay-per-use billing pattern. However, cloud computing has dark side when it comes to security and privacy considerations. Critical industries such as healthcare and banking are reluctant to trust cloud computing due to the fear of losing their sensitive data, as it resides on the cloud with no knowledge of data location and lack of transparency of Cloud Service Providers (CSPs) mechanisms used to secure their data and applications which have created a barrier against adopting this agile computing paradigm. This paper addresses cloud computing security concerns that must be considered in order to adopt cloud services in information critical industries.

Ks Ks l  Hl  lls lls I.

NTRODUCTION

Cloud computng evolved as a new IT paradigm to provide an agile method to deliver real tme scalable services servic es to ndustries, organizations and ndividuals n cost eective way. It is a busess model that has herited the benet of other technologies such as distributed, pervasive, ubiquitous, utility computng and vrtualization [1-2]. In-spite of the unique features of cloud computng, still there are several challenges regardng to its dynamicity and multi-tenancy that requres signicant sign icant isolation between its computng co mputng resources, beside mplementng strong security and privacy techniques. These challenges are shown n Fig. which will be discussed n section-II.

II.

Several security challenges should be addressed n cloud computng before adoptng it n nformation critical ndustries. These challenges are described as follows: A.

-, "

Impllemen Imp ement tion

Figure. Cloud Computing Implementation Challenges

Insecure Applications Programming Interfaces Interfa ces (APIs)

Cloud services are accessed and managed by clients via sowe terface and APIs. These APIs have signicant roles n provisiong, monitorng, orchestration and management of the processes rug n a cloud computng co mputng envroent. The security and availability of cloud services depends on security of APIs so they must nclude features such as encrption, activity monitorng, and authentication as well as access control mechanisms [3]. Insecure cloud computng sowe services nterfaces and APIs may lead to major security concerns for both CSPs and clients. APIs should be designed to protect aganst both accidental accidental and malicious attacks. attacks. Some of the secity conces clude cyber attacks and illegitmate control over user accounts. Hackers and unauthorzed users always d new ways nto networks that may result n data breaches which can damage busesses that operates om the cloud. CSPs have to eance ther security by encrption, abstraction, and encapsulation mechanisms [3]. Attackers also are targetng the digital keys used to secure the teet nastructure. The unique codes (API keys) e used by cloud services to identi thrd-pary applications that are usng them. These keys can be b e attacked which may cause Denial-of-Service (DoS) or rack up fees on behalf of the vict. An improper implementation that allows sple access to an API via a secret key may facilitate the attackers to have absolute access if the secret key can be sniffed out or stolen om an authorzed user's electronic device, which will have vital impact on the clients data. There is a need to protect these cloud API keys with best practices n a secure maner. B

Cloud

LOUD ECURITY E CURITY LLENGES LLENGE S

Virtualization Vulnerabilities

On a cloud astructure vrtualization is achieved by usg a hypervisor or Vrtual Mache Monitor (VMM) that allows multiple Vrtual Machnes (VMs) to run on a sngle host OS or drectly on the underlyg hardware concurrently to facilitate sharg of cloud resoces. Associatng multiple servers with one host removes the physical separation between servers, ncreasg the teats of malicious attacks on VMs and root to access the hypervisor. By exploitg this vunerability, an attacker can gan access and target numerous areas of a vrtualized cloud nastructure e.g. hypervisor, hardware, guest OSs and the applications withn dividual VMs [4]. Some teats such as VM escape, system conguration dri,

Proceedings of 2021nteational of Cloud Computing, Technologies, Applications & Management 978--4673-446-6/2/$3.00 ©2021EEE

74

5773234: Cloud Implementation Security Challenges

sider teats and root kits might take place due to use of unerable access control mechanisms [5]. This requres deployng strong security isolation mechanisms to elimnate the teats by moding the hypervisor drectly access, or stallng a rootkit on vrtualization host, n addition to the probability of o f tagetng the vrtualization management system. C

Key Management

There are several key management challenges withn the cloud envronment such as: Key stores that must be protected n storage,  transit, and n backup. Improper key storage may lead to the compromise of all encrypted data. Accesses to key stores have to be limited to the authorzed persoel who requre the ndividual keys. These keys ought to be under policies governng them. They should not be with the same person who is given the keys and who is storng them snce loss of keys means loss of data which keys are protectng [6]. Several possible teats can occur n 1) Communication channels between CSP and end users durg cloud migration and other busess comunications between CSP-to-CSP. 2) Storage areas of clients data. 3) Hpervisors and VMs. Vunerable area to teats should be securely protected and isolated by the use of appropriate up-to-date crptography crptography systems with efcient key management to secure clients data and ther applications on the cloud [4]. D. Data Governance and Regulato Compliance Clients are responsible for ther data and applications even if it resides on thrd paty storage such as cloud [7]. There should be shared data security terms and conditions cluded n Service Level Agreements (SLAs) nitiated between CSPs and clients based on ther data sensitivity. Cloud computng must be under well developed nformation security goveance processes, as par of the clients overall coorate governance obligations with due care n terms of scalability, availability, measurability, sustaability and cost effectiveness. Snce cloud physical storages are widely distributed across multiple jurisdictions that have different laws regardg to data security, privacy, usage and ntellectual propert. CSPs are responsible for ncorporatng the coespondg regulator compliance with govement and legal country specic policies when deployg clients data and applications [4]. CSPs ought to satis privacy rules by usng up-to-date security techniques such as encryptng clients data and documents on the y, and on the cloud with the use of strong teciques (e.g. 256 bit AES algorithms) as well as usng rewalls to restrict the trac to each cloud nstance by source IP address. In addition to allowg the access to clients data tough Secure Socket ayer (SS) encrpted endpots. Furthermore, providg a disaster recovery mechanism that stars quickly n case of a server failure and developng an authorzation model to provide discretionary, role-based and context-aware authorzations to prevent any unauthorzed access [8].

E. Service Level Leve l Agreements (SLAs)

SAs refer to a legal contract that describes the mnimum performance criteria CSPs promises promise s to meet while deliverng the requred service(s) to ther client(s). It denes the responsibilities of the related paries p aries and sets out the remedial action plus any consequences that will take effect if performance fall s below the promised standards [9]. [9] . ack  ack of trust by clients will create a barier aganst adoptng cloud computg paadigm. This lack of clients trust may occur as a result of SAs not oerng a commitment to allow cloud users to audit ther data. The loss of data goveance causes concerns when users sensitive data and mission-critical applications move to a cloud computg envronment where providers canot guarantee the effectiveness of ther security and privacy controls [10]. Clients must understand ther security requrements, what control and federation patterns are necessary to meet those requrements n order to protect ther rights and themselves aganst critical busness security teats, besides holdng CSP responsible for service failure and ther condential data loss. F

Multi-Tenan

In cloud envroment, multi-tenancy means clients can share nastructure and databases n order to tae advantage of cost and performance that comes with economies of scale. Sharng IT resoces may encounter teats of data loss, misuse, or privacy violation. Ensurng security by means of tegrity, availability, condentiality and non-repudiation is a must n cloud computng envronment where the clients data are under the control of CSP n multitenant shared envonment [11]. Security must be considered n all aspects of cloud nastructure as shown  Fig. 2 [12] below.

Adtng ad Ad  Ap an



Securi ..

D Im mgges ,

.

.

..

Figure 2. Cloud Computing Security Architecture [2]

Proceedings of 202 International of Cloud Computing, Technologies, Applications & Management

75

Mervat Bamiah, Saraz Brohi, Suriayati Chuprat, Muhammad Nawaz Brohi

Table 1 [13] illustrates the security requrements that should be considered to elimnate the teats and create clients trust n all cloud service layers as follows: TABLE. User's Specic Security Requirements [3 lv

Svc lv lv

U

Scy Rq Sc

Th

Application Sowareasa End users evel Sevice (SaaS)

'Privay in mul 'Pr multi· Tenant Tenant Enviironm Env ronmeent p otet otetiion frfrom  Data p exposurre exposu 'Acessontol Communiicat catiion protection Commun  Soware secur�y 'Sevice ava avaab ab��y

'Int Inteerce ception ption 'Modiifcat 'Mod caton of data at rest and in transit 'Data int nteerupton (de (deletion) 'Prrivacy breah 'P 'Impe mperrsonat sonatiion 'Session hijacking 'Exposue in netwo 'Exposu networrk

Vu uaal evel

Platfo atforrm as a Deve evellope operrs Sevice (PaaS) Infratuue asaSevice aa aaS) S)

Aeontol 'Appliliat 'App atiion secu secuty 'Dataseurrity 'Dataseu Cloud management ontol seurrity seu 'Secureiimages 'Secure Sessiion hij hijac ackkng  Sess  Vua uall oud pr protet otetiion  Commu Communncat catiion secui secuity ty

'Programmngflaws 'Sowaremofaton 'Sowareiint 'Soware nteerrupt rupton dellet de etiion) 'Impe mperrsonat sonatiion ' rai flow anal analys ysiis  xposure in networ  Defacement  Connetion fooding 'DDOS mpesonat sonatiion  mpe Disupt uptiing communications  Dis

hysica hys call evel

DataCente

Ownes of 'egal use of lou omputng  Netwok atta the  Hadware securty  Connection fooding infrastuture  Hadware Hadwarerreliliab abili iliy y 'DDOS  etwork protetion  Hardware inte nterupt ruptiion  etwork resou esourrces p pote oteiion  Hardware the odificat catiion  Hardware odi infrastrrutue  Misuse of infrast  atura aturall disaster

Privacy, on the other hand varies om country to countr in terms of cultures and jurisdictions. It is about compliance with applicable data protection laws and regulations relatng to data transfer or location, as well as the purpose of processg and subject rights of data access and contro The challenge is how to protect the privacy while sharg the personal data [12]. When adessng privacy n the cloud, two aspects must be distguished: 1) applications runng n the cloud should protect the privacy of the data they process; 2) CSPs should protect clients data that is stored or processed on ther nastructure [14]. In cloud computg envroment usually clients can access, use, store and deliver ther data across the globe via Inteet. However, they do not control ther data snce it resides on the cloud, there is a strong possibility that clients and ther competitors data can reside on the same physical storage device with logical segregation segregation which can result n one o ne clients clie nts private data can be viewed by other users. This can create an issue of data the. In addition, the data beng on a multi-tenant model raise the conces of the security an auditng mechanisms applied by the CSP that should ensure proper data isolation for protectng data om teats or external penetrations, penetrations, also preventng unwanted changes by the CSP or any unauthorzed access or attacks.

This isolation of data, and mantang proper compliance and SAs is a must n cloud computng envronment [4]. Strong security and privacy mechanisms should be applied to ga clients condence of cloud paradigm. G.

Insider's Attack

Accordg to The CERT Insider Teat Center [15], a malicious nsider refers to "current or former employee, contractor or other busness partner who has or had authorzed access to an organzations network, system or data and ntentionally exceeded or misused that access  a maner that negatively aected condentiality, ntegrity, and availability of the organzations formation or nformation systems. Accordng Accord ng to Inteational Inteationa l Data Corporation Corporatio n (IDC) survey which posed 440 organzations to specically adess the nsider teat, stated that organzations are creasngly aware that stronger application identity controls are necessary to meet data security challenges by strong authentication, data monitorg, and advanced access control tecnologies aganst nsider attacks []. There are several tpes of malicious nsiders identied by [16] such as rogue cloud provider admnistrator, or an unauthorzed access by an employee n a specic organization who exploits cloud weaknesses, and the nsider who uses cloud resources to carr out attacks aganst the organzations local IT nastructure. The risk of a malicious nsider is high snce CSPs control the clients data, and there is lack of transparency n the way processes and procedures are done (how CSPs grant ther employees access to physical and vrtual assets, and how they monitors these employees, or how they analyzes and repors on policy compliance)[10 Fig3 [16] describes the teats by various malicious siders.

t o the ho hosng C

- in -

-

t o m moonit o r intel aa accks.

V� C that the the y C co co p y VMs

that do no n ot

t o

but

disks

 C an



 divver s t o di

 on the hos hosng

Tr oj s, insst in tcces

that tgets

drvver s t o g an dr an

C co p p y y  appli applicca aoon

Figure 3. Cloud Administrators and Potential Threats [6


76

5773234: Cloud Implementation Security Challenges H Identi Management

Identity management is the buildng block of achievng condentiality, ntegrity and availability. Due to heterogeneity n cloud systems and models, a federated identity management system which allows users sgle sign on (SSO) is requred across mltiple tpe of cloud systems that satises legal and policy requements [18]. Cloud computg has vaious service delivery and deployment models that raised the need for an appropriate identity management (IDM),  terms of security, privacy, and provisionng of services to ensure the authorised access as well as to manage access control ponts, Vrtual Machnes (VMs) or service identities, etc. Meanwhile access to its its relevant stored data has to be monitored and granted by the deed access level for that mode as mentioned n the SA [19-20]. The security challenges for adoptg these models and the relative advantages and disadvantages are listed n Table 2 [21].

accountability or carelessness of nteal personnel, however, system attack and formation leakage are caused by unprofessional operation operation of nteal personnel. personnel. These teats are illustrated  Fig.4 [17] as follows.

Har dwae Fail ilu ues

TABLE.2 IDM Security Challenges [2] Aanages mpllee Id deee enn 1 • Easy to imp stak tega egatio tio wit  No saate it he o oga gaza zaiioio

Dis sttg  T uer uer es t t e e t c cde ett' . .

Securiri Secu  Chllee Sho  b highy co cofig figb be o faci faciiittat atee ompl ompla wit t oga gaiz ti tio o   s ol olii   

etitio o ih the  Tee e o nt e to e e e e   Reqe i t e Teea e o ens  Ue oga gaiz tio tio    iito. S  hoi iza zatitioo  t   aswod scui  se enia enia Has high i isk v v     i  i  g ad toage to  anmiis siion  uer pv n d t th tranm nll    .. n i  oe te i  i t tee  

Fe 10

Ue o t ed to eee ee  Mo o ox t i ee ett  Te a  hae nee t  e aswo  twee the co n a t tg g  wit ee o ee tha  o o  No sepaae t he o ogaza gazaiio deo eo. .  sst e e tio tio hi hi a aato ae et etah h fo ee  Lo w   y y  a as ea e a o  se se i nn�i. o o a ae to  ee eett 

syhozatio.



Abuse and Nefarious Use of Cloud C loud

Sce cloud computg offers vaious computg services on demand n low cost and sometmes  ee trial versions, people may misuse these services regardg to ther benets. Accordng to Cloud Security Alliance (CSA) [3] the teat of misusng cloud computng services is a challenge that should be faced snce this teat can result om vaious situations such as tamperng of formation by nternal personnel (malicious nsiders), the destruction of network and system resources by exteal personnel or hackers (malicious outsiders) who ntrude tough the unerability of cloud nformation system. In addition to teat of system failures and formation damage which caused by lack of

Figure 4. Cloud Information System Threat Factors [7]

Strong authentication and access control mechanisms should be applied n addition to security and privacy tools and teciques to provide isolation of clients om each others VMs, as well as applyng disaster recovery methods to provide data availability and to secure the data om envronmental ncidents that causes data loss. III.

ONCLUSION

Several dustries are movng towards adoptng cloud computng regardng to it signicant features and low cost. However, the ndustr data beng under the control of CSP created a risk of data leakage that posed a barrier aganst trustng this agile paradigm. Clients must make sure that the CSP is willng to undergo exteal audits an/or security cerications. In this paper we tried to view cloud challenges to be considered and solved n order for clients to be condent to mplement the cloud paradigm n critical dustries. CKNOWLEDGMENT

Our gratitude goes to God Aighty who gave us the knowledge to complete this work. EFERENCES [] [2]

[3] [4]

IBM, "IBM Data Center Networking: Planning for virtualization and cloud computing, Inteational Technical Support Organization, 20. Appistry,"Unlocking Appistry,"Unlocking the Promise of Cloud Computing for the ntepse Achevng scalablty aglty and elablty wth cloud application platforms, [Online] Available at: http://charltonb. typepad. http://charltonb. typepad.com/papers/Unlocking_ the_Promise com/papers/Unlocking_ the_Promise _ _oCloud_ oCloud_ Computing_for _the_Enterprise. Computing_for _the_Enterprise.pdf pdf . P. Praveen , et a,"Challenging a,"Challenging Threats and Flaws in Cloud Computing Environment, International Conference on Computing and Control Engineering (CCCE 202), 2 & 3 April, 202, pp.-5. M. Srinivasan, et al., al.,"State-of-the-art "State-of-the-art Cloud Computing Security Taxonomies A classication of security challenges in the present cloud computing environment, In: International Conference on Advances in Computing, Communications and Informatics (CACCI-202), ICACCI 2, ACM, 202, CHENAI, India.


77

Mervat Bamiah, Saraz Brohi, Suriayati Chuprat, Muhammad Nawaz Brohi [5] [6]

[7] [8]

[9] [0] [] [2]

[3]

A. Tolnai and S. von Solms, "The Cloud's Core Virtual Infrastructure Security, Global Security, Safety, and Sustainability Communications in Computer and Information Science, 200, Volume 92, pp. 9-27. S. Lei, D. Zishan, and G. Jindi, "Research on Key Management Inastructure in Cloud Computing Environment, Grid and Cooperative Computing (GCC), 200 9th Inteational Conference on, pp. 404407, Nov. 200. F. Sabahi, "Cloud computing security threats and responses, Communication Soware and Networks (ICCSN), 20 IEEE 3rd Inteational Conference on, pp. 245249, May 20. M. Poulymenopoulou, F. Malaateniou, and G. Vassilacopoulos, "E EPR: a cloud-based architecture of an electronic emergency patient record, In Proceedings of the 4th Inteational Conference on Pervasive Technologies Related to Assistive Environments (PETRA ). ACM, 20 , Article 35 , 7 pages R. Padhy, Padhy, M. Patra, and S. Satapathy, SLAs in Cloud Systems The Business Perspective, Perspective, International Journal of Computer Science and Technology , March 202, Vol. 3, Issue . Page no. 48 488. K. Mu-Hsing, "A Healthcare Cloud Computing Strategic Planning Model, Computer Science and Convergence, Lecture Notes in Electrical Engineering, 202, Volume 4, Part 6, pp. 769-775. CPB UK Ltd, Ltd, Security Security Survey Results Results - Threats Threats Anticipate Anticipatedd by Organisations, Business Technology Group (BTG), 20 [Online] Available at: hp://www.btg-uk.com/security-research.html D. Chen, H. Zhao, Data Security and Privacy Protection Protection Issues in in Cloud Computing, Computer Science and Electronics Engineering (ICCSEE), 202 Inteational Inteational Conference on , vol., no., pp.647-65, 23-25 Mch 202. D. Zissis and D. Lekkas,"Addressing Lekkas,"Addressing cloud computing security issues, Future Generation Computer Systems, Elsivier, Volume 28, Issue 3, March 202, pp. 583592.

[4] C. Probst, Privacy Penetration Testing: How to Establish Trust in Your Cloud Provider, European Data Protection: In Good Health?, Springer Jan , 202, Part 3, pp. 25-265. 25-265. [5] D. Cappelli, A. Moore, and R. Trzeciak, "The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Infoation Technology Crimes (The, Sabotage, Fraud), ser. SEI Series in Soare Engineering. Addison-Wesley Professional, 202. [6] W. Claycomb and A. Nicoll, "Insider Threats to Cloud Comput ing: Directions for New Research Challenges, in COMPSAC 202: Trustorthy Soare Systems for the Digital Society, COMPSAC 202, The 36th Annual International Computer Soware and Applications Conference 202 . [7] Q. Li and Z. Xie,"A Xie,"A Correlation Analysis Method for Threat Factors in Information System Based on Cloud Model, Machine Vision and Human-Machine Interface (MV), 200 Inteational Conference on, pp. 54544, Apr. 200. [8] V. Winkler, "Designing Cloud Security,  chapter7 in Securing the Cloud: Cloud Computer Security Techniques and Tactics, Elsevier,202, pp. 307-327. [9] M. Srinivasan and P. Rodrigues, " A roadmap for the comparison of identity management solutions based on state-of-the-art IdM taxonomies, Springer Communications in Computer and Information Science, Science, 200 , pp. 349-358. [20] M. Srinivasan and P. Rodrigues, "Analysis on identity management systems with extended state-of-the-art IdM taxonomy factors, International Journal of Ad hoc, Sensor & Ubiquitous Computing , December December 200, Vol., Vol., No.4, pp. 62- 70. [2] S. Subash ini and V.Kavitha "A surey on security issues in serice delivery models of cloud computing, Journal of Netork and Computer Applications, Elsivier, Volume 34, Issue , January 20, Pages 


78

Cloud Implementation Security Challenges

Recommend Documents