Cloud
Computing Security Issues
It is clear that the security issue has played the
most important role in hindering Cloud computing. Without doubt, putting your
data, running your software at someone else's hard disk using someone else's
CPU appears daunting to many. Well-known security issues such as data loss,
phishing, botnet (running remotely on a collection of machines) pose serious threats
to organization's data and software. Moreover, the multi-tenancy model and the
pooled computing resources in cloud computing has introduced new security challenges
that require novel techniques to tackle with. For example, hackers are planning
to use Cloud to organize botnet as Cloud often provides more reliable
infrastructure services at a relatively cheaper price for them to start an
attack. The multi-tenancy model has at least created two new security issues.
First, shared resources (hard disk, data, VM) on the same physical machine
invites unexpected side channels between a malicious resource and a regular
resource. Second, the issue of "reputation fate-sharing" will
severely damage the reputation of many good Cloud "citizens" who
happen to, unfortunately, share the computing resources with their fellow tenant
- a notorious user with a criminal mind. Since they may share the same network
address, any bad conduct will be attributed to all the users without
differentiating real subverters from normal users. (Tharam
Dillon, 2010)
Start-up companies often lack the protection
measures to weather off an attack on their servers due to the scarcity of
resources - poor programming that explores software vulnerabilities (PHP,
JavaScript, etc) open ports to firewalls or inexistent load-balance algorithms
susceptible to denial of service attacks. For this reason, new companies are
encouraged to pursue cloud computing as the alternative to supporting their own
hardware backbone. However, cloud computing does not come without its pitfalls.
For starters, a cloud is a single point of failure for multiple resources. Even
though network carriers such as AT&T believe a distributed cloud structure
is the right implementation, it faces major challenges in finding the optimal approach
for low power transmission and high network availability some people believe
that major corporations will shy away from implementing cloud solutions in the
near future due to ineffective security policies. One problem comes from the
fact that different cloud providers have different ways to store data, so creating
a distributed cloud implies more challenges to be solved between vendors. (Andrei, 2009)
Data Security
Security refers to confidentiality, integrity and
availability, which pose major issues for cloud vendors. Confidentiality refers
to who stores the encryption keys - data from company A, stored in an encrypted
format at company B must be kept secure from employees of B; thus, the client
company should own the encryption keys. Integrity refers to the face that no
common policies exist for approved data exchanges; the industry has various
protocols used to push different software images or jobs. One way to maintain
data security on the client side is the use of thin clients that run with as
few resources as possible and do not store any user data, so passwords cannot
be stolen. The concept seems to be impervious to attacks based on capturing
this data. However, companies have implemented systems with unpublished APIs,
claiming that it improves security; unfortunately, this can be reversed
engineered; also, using DHCP and FTP to perform tasks such as firmware upgrades
has long been rendered as insecure. Nevertheless, products from Wyse are
marketed with their thin client as one of the safest, by using those exact
features. Lastly, the most problematic issue is availability, as several
companies using cloud computing have already experienced downtime (Amazon
servers subject to what appeared to be a denial of service attack). Other things
to keep in mind are contract policies between clients and vendors, so that data
belongs only to the client at all times, preventing third parties to be
involved at any point. Also, authentication should be backed by several methods
like password plus flash card, or password plus finger print, or some
combination of external hardware and password. One benefit of cloud computing
is that client software security does not need to be enforced as strictly as
before. This aspect concerns the view of cloud computing as software as a service,
as it becomes more important to ensure security of data transfer rather than a
traditional secure application life cycle.
1 Cloud Computing Security Issues
Identified seven issues that need to be addressed
before enterprises consider switching to the cloud computing model. They are as
follows:
.
privileged user access - information transmitted from the client through the
Internet poses a certain degree of risk, because of issues of data ownership;
enterprises should spend time getting to know their providers and their
regulations as much as possible before assigning some trivial applications
first to test the water.
. regulatory compliance - clients are accountable
for the security of their solution, as they can choose between providers that
allow to be audited by 3rd party organizations that check levels of security and
providers that don't
. data
location - depending on contracts, some clients might never know what country
or what jurisdiction their data is
located
. data segregation - encrypted information
from multiple companies may be stored on the same hard disk, so a mechanism to
separate data should be deployed by the provider.
. recovery
- every provider should have a disaster recovery protocol to protect user data
.
investigative support - if a client suspects faulty activity from the provider,
it may not have many legal ways pursue an investigation
.
long-term viability - refers to the ability to retract a contract and all data
if the current provider is bought out by another firm Given that not all of the
above need to be improved depending on the application at hand, it is still
paramount that consensus is reached on the issues regarding standardization.
Cloud
Computing Challenges
Challenges that cloud computing currently faces in
being deployed on a large enterprise scale:
.
Self-healing - in case of application/network/data storage failure, there will
always be a backup running without major delays, making the resource switch
appear seamless to the user.
.
SLA-driven - cloud is administrated by service level agreements that allow
several instances of one application to be replicated on multiple servers if
need arises; dependent on a priority scheme, the cloud may minimize or shut down a lower
level application.
.
Multi-tenancy - the cloud permits multiple clients to use the same hardware at
the same time, without them knowing it, possibly causing conflicts of interest
among customers.
.
Service-oriented - cloud allows one client to use multiple applications in
creating its own.
.
Virtualized - applications are not hardware specific; various programs may run
on one machine using virtualization or many machines may run one program.
Linearly scalable - cloud should handle an increase
in data processing linearly; if "n" times more users need a resource,
the time to complete the request with "n" more resources should be roughly the same.
. Data
management - distribution, partitioning, security and synchronization of data.
Refrences
Andrei, T. (2009, April 30). Cloud Computing
Challenges and Related Security Issues. Retrieved April 30, 2009, http://www.cs.wustl.edu
Tharam Dillon, C. W. (2010,
Dec 31). cloud computing challenges and issues. Retrieved Dec 31, 2010,
from cloud comouting challenges and issues website: http://www.techpdf.in
