Cloud Implementation Securi Challenges Mv Bmh fz Boh y Chp
Mhmm Nwz Boh
Universiti Teknologi Malaysia, Malaysia
[email protected] nbsar
[email protected],
Preston University Ajman, UAE
bs
Cloud computing offers signicant features such as resource pooling, scalability, on-demand self service, availability, and reliability to organizations to improve their quality of services. For example by using cloud computing services in healthcare it is possible to reach large population of people in isolated geographical areas which will assist in saving their lives in critical situations. It enables the use of latest technologies through its various service delivery and deployment models via the internet on pay-per-use billing pattern. However, cloud computing has dark side when it comes to security and privacy considerations. Critical industries such as healthcare and banking are reluctant to trust cloud computing due to the fear of losing their sensitive data, as it resides on the cloud with no knowledge of data location and lack of transparency of Cloud Service Providers (CSPs) mechanisms used to secure their data and applications which have created a barrier against adopting this agile computing paradigm. This paper addresses cloud computing security concerns that must be considered in order to adopt cloud services in information critical industries.
Ks Ks l Hl lls lls I.
NTRODUCTION
Cloud computng evolved as a new IT paradigm to provide an agile method to deliver real tme scalable services servic es to ndustries, organizations and ndividuals n cost eective way. It is a busess model that has herited the benet of other technologies such as distributed, pervasive, ubiquitous, utility computng and vrtualization [1-2]. In-spite of the unique features of cloud computng, still there are several challenges regardng to its dynamicity and multi-tenancy that requres signicant sign icant isolation between its computng co mputng resources, beside mplementng strong security and privacy techniques. These challenges are shown n Fig. which will be discussed n section-II.
II.
Several security challenges should be addressed n cloud computng before adoptng it n nformation critical ndustries. These challenges are described as follows: A.
-, "
Impllemen Imp ement tion
Figure. Cloud Computing Implementation Challenges
Insecure Applications Programming Interfaces Interfa ces (APIs)
Cloud services are accessed and managed by clients via sowe terface and APIs. These APIs have signicant roles n provisiong, monitorng, orchestration and management of the processes rug n a cloud computng co mputng envroent. The security and availability of cloud services depends on security of APIs so they must nclude features such as encrption, activity monitorng, and authentication as well as access control mechanisms [3]. Insecure cloud computng sowe services nterfaces and APIs may lead to major security concerns for both CSPs and clients. APIs should be designed to protect aganst both accidental accidental and malicious attacks. attacks. Some of the secity conces clude cyber attacks and illegitmate control over user accounts. Hackers and unauthorzed users always d new ways nto networks that may result n data breaches which can damage busesses that operates om the cloud. CSPs have to eance ther security by encrption, abstraction, and encapsulation mechanisms [3]. Attackers also are targetng the digital keys used to secure the teet nastructure. The unique codes (API keys) e used by cloud services to identi thrd-pary applications that are usng them. These keys can be b e attacked which may cause Denial-of-Service (DoS) or rack up fees on behalf of the vict. An improper implementation that allows sple access to an API via a secret key may facilitate the attackers to have absolute access if the secret key can be sniffed out or stolen om an authorzed user's electronic device, which will have vital impact on the clients data. There is a need to protect these cloud API keys with best practices n a secure maner. B
Cloud
LOUD ECURITY E CURITY LLENGES LLENGE S
Virtualization Vulnerabilities
On a cloud astructure vrtualization is achieved by usg a hypervisor or Vrtual Mache Monitor (VMM) that allows multiple Vrtual Machnes (VMs) to run on a sngle host OS or drectly on the underlyg hardware concurrently to facilitate sharg of cloud resoces. Associatng multiple servers with one host removes the physical separation between servers, ncreasg the teats of malicious attacks on VMs and root to access the hypervisor. By exploitg this vunerability, an attacker can gan access and target numerous areas of a vrtualized cloud nastructure e.g. hypervisor, hardware, guest OSs and the applications withn dividual VMs [4]. Some teats such as VM escape, system conguration dri,
Proceedings of 2021nteational of Cloud Computing, Technologies, Applications & Management 978--4673-446-6/2/$3.00 ©2021EEE
74
5773234: Cloud Implementation Security Challenges
sider teats and root kits might take place due to use of unerable access control mechanisms [5]. This requres deployng strong security isolation mechanisms to elimnate the teats by moding the hypervisor drectly access, or stallng a rootkit on vrtualization host, n addition to the probability of o f tagetng the vrtualization management system. C
Key Management
There are several key management challenges withn the cloud envronment such as: Key stores that must be protected n storage, transit, and n backup. Improper key storage may lead to the compromise of all encrypted data. Accesses to key stores have to be limited to the authorzed persoel who requre the ndividual keys. These keys ought to be under policies governng them. They should not be with the same person who is given the keys and who is storng them snce loss of keys means loss of data which keys are protectng [6]. Several possible teats can occur n 1) Communication channels between CSP and end users durg cloud migration and other busess comunications between CSP-to-CSP. 2) Storage areas of clients data. 3) Hpervisors and VMs. Vunerable area to teats should be securely protected and isolated by the use of appropriate up-to-date crptography crptography systems with efcient key management to secure clients data and ther applications on the cloud [4]. D. Data Governance and Regulato Compliance Clients are responsible for ther data and applications even if it resides on thrd paty storage such as cloud [7]. There should be shared data security terms and conditions cluded n Service Level Agreements (SLAs) nitiated between CSPs and clients based on ther data sensitivity. Cloud computng must be under well developed nformation security goveance processes, as par of the clients overall coorate governance obligations with due care n terms of scalability, availability, measurability, sustaability and cost effectiveness. Snce cloud physical storages are widely distributed across multiple jurisdictions that have different laws regardg to data security, privacy, usage and ntellectual propert. CSPs are responsible for ncorporatng the coespondg regulator compliance with govement and legal country specic policies when deployg clients data and applications [4]. CSPs ought to satis privacy rules by usng up-to-date security techniques such as encryptng clients data and documents on the y, and on the cloud with the use of strong teciques (e.g. 256 bit AES algorithms) as well as usng rewalls to restrict the trac to each cloud nstance by source IP address. In addition to allowg the access to clients data tough Secure Socket ayer (SS) encrpted endpots. Furthermore, providg a disaster recovery mechanism that stars quickly n case of a server failure and developng an authorzation model to provide discretionary, role-based and context-aware authorzations to prevent any unauthorzed access [8].
E. Service Level Leve l Agreements (SLAs)
SAs refer to a legal contract that describes the mnimum performance criteria CSPs promises promise s to meet while deliverng the requred service(s) to ther client(s). It denes the responsibilities of the related paries p aries and sets out the remedial action plus any consequences that will take effect if performance fall s below the promised standards [9]. [9] . ack ack of trust by clients will create a barier aganst adoptng cloud computg paadigm. This lack of clients trust may occur as a result of SAs not oerng a commitment to allow cloud users to audit ther data. The loss of data goveance causes concerns when users sensitive data and mission-critical applications move to a cloud computg envronment where providers canot guarantee the effectiveness of ther security and privacy controls [10]. Clients must understand ther security requrements, what control and federation patterns are necessary to meet those requrements n order to protect ther rights and themselves aganst critical busness security teats, besides holdng CSP responsible for service failure and ther condential data loss. F
Multi-Tenan
In cloud envroment, multi-tenancy means clients can share nastructure and databases n order to tae advantage of cost and performance that comes with economies of scale. Sharng IT resoces may encounter teats of data loss, misuse, or privacy violation. Ensurng security by means of tegrity, availability, condentiality and non-repudiation is a must n cloud computng envronment where the clients data are under the control of CSP n multitenant shared envonment [11]. Security must be considered n all aspects of cloud nastructure as shown Fig. 2 [12] below.
Adtng ad Ad Ap an
Securi ..
D Im mgges ,
.
.
..
Figure 2. Cloud Computing Security Architecture [2]
Proceedings of 202 International of Cloud Computing, Technologies, Applications & Management
75
Mervat Bamiah, Saraz Brohi, Suriayati Chuprat, Muhammad Nawaz Brohi
Table 1 [13] illustrates the security requrements that should be considered to elimnate the teats and create clients trust n all cloud service layers as follows: TABLE. User's Specic Security Requirements [3 lv
Svc lv lv
U
Scy Rq Sc
Th
Application Sowareasa End users evel Sevice (SaaS)
'Privay in mul 'Pr multi· Tenant Tenant Enviironm Env ronmeent p otet otetiion frfrom Data p exposurre exposu 'Acessontol Communiicat catiion protection Commun Soware secur�y 'Sevice ava avaab ab��y
'Int Inteerce ception ption 'Modiifcat 'Mod caton of data at rest and in transit 'Data int nteerupton (de (deletion) 'Prrivacy breah 'P 'Impe mperrsonat sonatiion 'Session hijacking 'Exposue in netwo 'Exposu networrk
Vu uaal evel
Platfo atforrm as a Deve evellope operrs Sevice (PaaS) Infratuue asaSevice aa aaS) S)
Aeontol 'Appliliat 'App atiion secu secuty 'Dataseurrity 'Dataseu Cloud management ontol seurrity seu 'Secureiimages 'Secure Sessiion hij hijac ackkng Sess Vua uall oud pr protet otetiion Commu Communncat catiion secui secuity ty
'Programmngflaws 'Sowaremofaton 'Sowareiint 'Soware nteerrupt rupton dellet de etiion) 'Impe mperrsonat sonatiion ' rai flow anal analys ysiis xposure in networ Defacement Connetion fooding 'DDOS mpesonat sonatiion mpe Disupt uptiing communications Dis
hysica hys call evel
DataCente
Ownes of 'egal use of lou omputng Netwok atta the Hadware securty Connection fooding infrastuture Hadware Hadwarerreliliab abili iliy y 'DDOS etwork protetion Hardware inte nterupt ruptiion etwork resou esourrces p pote oteiion Hardware the odificat catiion Hardware odi infrastrrutue Misuse of infrast atura aturall disaster
Privacy, on the other hand varies om country to countr in terms of cultures and jurisdictions. It is about compliance with applicable data protection laws and regulations relatng to data transfer or location, as well as the purpose of processg and subject rights of data access and contro The challenge is how to protect the privacy while sharg the personal data [12]. When adessng privacy n the cloud, two aspects must be distguished: 1) applications runng n the cloud should protect the privacy of the data they process; 2) CSPs should protect clients data that is stored or processed on ther nastructure [14]. In cloud computg envroment usually clients can access, use, store and deliver ther data across the globe via Inteet. However, they do not control ther data snce it resides on the cloud, there is a strong possibility that clients and ther competitors data can reside on the same physical storage device with logical segregation segregation which can result n one o ne clients clie nts private data can be viewed by other users. This can create an issue of data the. In addition, the data beng on a multi-tenant model raise the conces of the security an auditng mechanisms applied by the CSP that should ensure proper data isolation for protectng data om teats or external penetrations, penetrations, also preventng unwanted changes by the CSP or any unauthorzed access or attacks.
This isolation of data, and mantang proper compliance and SAs is a must n cloud computng envronment [4]. Strong security and privacy mechanisms should be applied to ga clients condence of cloud paradigm. G.
Insider's Attack
Accordg to The CERT Insider Teat Center [15], a malicious nsider refers to "current or former employee, contractor or other busness partner who has or had authorzed access to an organzations network, system or data and ntentionally exceeded or misused that access a maner that negatively aected condentiality, ntegrity, and availability of the organzations formation or nformation systems. Accordng Accord ng to Inteational Inteationa l Data Corporation Corporatio n (IDC) survey which posed 440 organzations to specically adess the nsider teat, stated that organzations are creasngly aware that stronger application identity controls are necessary to meet data security challenges by strong authentication, data monitorg, and advanced access control tecnologies aganst nsider attacks []. There are several tpes of malicious nsiders identied by [16] such as rogue cloud provider admnistrator, or an unauthorzed access by an employee n a specic organization who exploits cloud weaknesses, and the nsider who uses cloud resources to carr out attacks aganst the organzations local IT nastructure. The risk of a malicious nsider is high snce CSPs control the clients data, and there is lack of transparency n the way processes and procedures are done (how CSPs grant ther employees access to physical and vrtual assets, and how they monitors these employees, or how they analyzes and repors on policy compliance)[10 Fig3 [16] describes the teats by various malicious siders.
t o the ho hosng C
- in -
-
t o m moonit o r intel aa accks.
V� C that the the y C co co p y VMs
that do no n ot
t o
but
disks
C an
divver s t o di
on the hos hosng
Tr oj s, insst in tcces
that tgets
drvver s t o g an dr an
C co p p y y appli applicca aoon
Figure 3. Cloud Administrators and Potential Threats [6
Proceedings of 202 International of Cloud Computing, Technologies, Applications & Management
76
5773234: Cloud Implementation Security Challenges H Identi Management
Identity management is the buildng block of achievng condentiality, ntegrity and availability. Due to heterogeneity n cloud systems and models, a federated identity management system which allows users sgle sign on (SSO) is requred across mltiple tpe of cloud systems that satises legal and policy requements [18]. Cloud computg has vaious service delivery and deployment models that raised the need for an appropriate identity management (IDM), terms of security, privacy, and provisionng of services to ensure the authorised access as well as to manage access control ponts, Vrtual Machnes (VMs) or service identities, etc. Meanwhile access to its its relevant stored data has to be monitored and granted by the deed access level for that mode as mentioned n the SA [19-20]. The security challenges for adoptg these models and the relative advantages and disadvantages are listed n Table 2 [21].
accountability or carelessness of nteal personnel, however, system attack and formation leakage are caused by unprofessional operation operation of nteal personnel. personnel. These teats are illustrated Fig.4 [17] as follows.
Har dwae Fail ilu ues
TABLE.2 IDM Security Challenges [2] Aanages mpllee Id deee enn 1 • Easy to imp stak tega egatio tio wit No saate it he o oga gaza zaiioio
Dis sttg T uer uer es t t e e t c cde ett' . .
Securiri Secu Chllee Sho b highy co cofig figb be o faci faciiittat atee ompl ompla wit t oga gaiz ti tio o s ol olii
etitio o ih the Tee e o nt e to e e e e Reqe i t e Teea e o ens Ue oga gaiz tio tio iito. S hoi iza zatitioo t aswod scui se enia enia Has high i isk v v i i g ad toage to anmiis siion uer pv n d t th tranm nll .. n i oe te i i t tee
Fe 10
Ue o t ed to eee ee Mo o ox t i ee ett Te a hae nee t e aswo twee the co n a t tg g wit ee o ee tha o o No sepaae t he o ogaza gazaiio deo eo. . sst e e tio tio hi hi a aato ae et etah h fo ee Lo w y y a as ea e a o se se i nn�i. o o a ae to ee eett
syhozatio.
Abuse and Nefarious Use of Cloud C loud
Sce cloud computg offers vaious computg services on demand n low cost and sometmes ee trial versions, people may misuse these services regardg to ther benets. Accordng to Cloud Security Alliance (CSA) [3] the teat of misusng cloud computng services is a challenge that should be faced snce this teat can result om vaious situations such as tamperng of formation by nternal personnel (malicious nsiders), the destruction of network and system resources by exteal personnel or hackers (malicious outsiders) who ntrude tough the unerability of cloud nformation system. In addition to teat of system failures and formation damage which caused by lack of
Figure 4. Cloud Information System Threat Factors [7]
Strong authentication and access control mechanisms should be applied n addition to security and privacy tools and teciques to provide isolation of clients om each others VMs, as well as applyng disaster recovery methods to provide data availability and to secure the data om envronmental ncidents that causes data loss. III.
ONCLUSION
Several dustries are movng towards adoptng cloud computng regardng to it signicant features and low cost. However, the ndustr data beng under the control of CSP created a risk of data leakage that posed a barrier aganst trustng this agile paradigm. Clients must make sure that the CSP is willng to undergo exteal audits an/or security cerications. In this paper we tried to view cloud challenges to be considered and solved n order for clients to be condent to mplement the cloud paradigm n critical dustries. CKNOWLEDGMENT
Our gratitude goes to God Aighty who gave us the knowledge to complete this work. EFERENCES [] [2]
[3] [4]
IBM, "IBM Data Center Networking: Planning for virtualization and cloud computing, Inteational Technical Support Organization, 20. Appistry,"Unlocking Appistry,"Unlocking the Promise of Cloud Computing for the ntepse Achevng scalablty aglty and elablty wth cloud application platforms, [Online] Available at: http://charltonb. typepad. http://charltonb. typepad.com/papers/Unlocking_ the_Promise com/papers/Unlocking_ the_Promise _ _oCloud_ oCloud_ Computing_for _the_Enterprise. Computing_for _the_Enterprise.pdf pdf . P. Praveen , et a,"Challenging a,"Challenging Threats and Flaws in Cloud Computing Environment, International Conference on Computing and Control Engineering (CCCE 202), 2 & 3 April, 202, pp.-5. M. Srinivasan, et al., al.,"State-of-the-art "State-of-the-art Cloud Computing Security Taxonomies A classication of security challenges in the present cloud computing environment, In: International Conference on Advances in Computing, Communications and Informatics (CACCI-202), ICACCI 2, ACM, 202, CHENAI, India.
Proceedings of 202 International of Cloud Computing, Technologies, Applications & Management
77
Mervat Bamiah, Saraz Brohi, Suriayati Chuprat, Muhammad Nawaz Brohi [5] [6]
[7] [8]
[9] [0] [] [2]
[3]
A. Tolnai and S. von Solms, "The Cloud's Core Virtual Infrastructure Security, Global Security, Safety, and Sustainability Communications in Computer and Information Science, 200, Volume 92, pp. 9-27. S. Lei, D. Zishan, and G. Jindi, "Research on Key Management Inastructure in Cloud Computing Environment, Grid and Cooperative Computing (GCC), 200 9th Inteational Conference on, pp. 404407, Nov. 200. F. Sabahi, "Cloud computing security threats and responses, Communication Soware and Networks (ICCSN), 20 IEEE 3rd Inteational Conference on, pp. 245249, May 20. M. Poulymenopoulou, F. Malaateniou, and G. Vassilacopoulos, "E EPR: a cloud-based architecture of an electronic emergency patient record, In Proceedings of the 4th Inteational Conference on Pervasive Technologies Related to Assistive Environments (PETRA ). ACM, 20 , Article 35 , 7 pages R. Padhy, Padhy, M. Patra, and S. Satapathy, SLAs in Cloud Systems The Business Perspective, Perspective, International Journal of Computer Science and Technology , March 202, Vol. 3, Issue . Page no. 48 488. K. Mu-Hsing, "A Healthcare Cloud Computing Strategic Planning Model, Computer Science and Convergence, Lecture Notes in Electrical Engineering, 202, Volume 4, Part 6, pp. 769-775. CPB UK Ltd, Ltd, Security Security Survey Results Results - Threats Threats Anticipate Anticipatedd by Organisations, Business Technology Group (BTG), 20 [Online] Available at: hp://www.btg-uk.com/security-research.html D. Chen, H. Zhao, Data Security and Privacy Protection Protection Issues in in Cloud Computing, Computer Science and Electronics Engineering (ICCSEE), 202 Inteational Inteational Conference on , vol., no., pp.647-65, 23-25 Mch 202. D. Zissis and D. Lekkas,"Addressing Lekkas,"Addressing cloud computing security issues, Future Generation Computer Systems, Elsivier, Volume 28, Issue 3, March 202, pp. 583592.
[4] C. Probst, Privacy Penetration Testing: How to Establish Trust in Your Cloud Provider, European Data Protection: In Good Health?, Springer Jan , 202, Part 3, pp. 25-265. 25-265. [5] D. Cappelli, A. Moore, and R. Trzeciak, "The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Infoation Technology Crimes (The, Sabotage, Fraud), ser. SEI Series in Soare Engineering. Addison-Wesley Professional, 202. [6] W. Claycomb and A. Nicoll, "Insider Threats to Cloud Comput ing: Directions for New Research Challenges, in COMPSAC 202: Trustorthy Soare Systems for the Digital Society, COMPSAC 202, The 36th Annual International Computer Soware and Applications Conference 202 . [7] Q. Li and Z. Xie,"A Xie,"A Correlation Analysis Method for Threat Factors in Information System Based on Cloud Model, Machine Vision and Human-Machine Interface (MV), 200 Inteational Conference on, pp. 54544, Apr. 200. [8] V. Winkler, "Designing Cloud Security, chapter7 in Securing the Cloud: Cloud Computer Security Techniques and Tactics, Elsevier,202, pp. 307-327. [9] M. Srinivasan and P. Rodrigues, " A roadmap for the comparison of identity management solutions based on state-of-the-art IdM taxonomies, Springer Communications in Computer and Information Science, Science, 200 , pp. 349-358. [20] M. Srinivasan and P. Rodrigues, "Analysis on identity management systems with extended state-of-the-art IdM taxonomy factors, International Journal of Ad hoc, Sensor & Ubiquitous Computing , December December 200, Vol., Vol., No.4, pp. 62- 70. [2] S. Subash ini and V.Kavitha "A surey on security issues in serice delivery models of cloud computing, Journal of Netork and Computer Applications, Elsivier, Volume 34, Issue , January 20, Pages
Proceedings of 202 International of Cloud Computing, Technologies, Applications & Management
78