Issues and challenges of cloud computing

Cloud Computing Security Issues

It is clear that the security issue has played the most important role in hindering Cloud computing. Without doubt, putting your data, running your software at someone else's hard disk using someone else's CPU appears daunting to many. Well-known security issues such as data loss, phishing, botnet (running remotely on a collection of machines) pose serious threats to organization's data and software. Moreover, the multi-tenancy model and the pooled computing resources in cloud computing has introduced new security challenges that require novel techniques to tackle with. For example, hackers are planning to use Cloud to organize botnet as Cloud often provides more reliable infrastructure services at a relatively cheaper price for them to start an attack. The multi-tenancy model has at least created two new security issues. First, shared resources (hard disk, data, VM) on the same physical machine invites unexpected side channels between a malicious resource and a regular resource. Second, the issue of "reputation fate-sharing" will severely damage the reputation of many good Cloud "citizens" who happen to, unfortunately, share the computing resources with their fellow tenant - a notorious user with a criminal mind. Since they may share the same network address, any bad conduct will be attributed to all the users without differentiating real subverters from normal users. (Tharam Dillon, 2010) 

Start-up companies often lack the protection measures to weather off an attack on their servers due to the scarcity of resources - poor programming that explores software vulnerabilities (PHP, JavaScript, etc) open ports to firewalls or inexistent load-balance algorithms susceptible to denial of service attacks. For this reason, new companies are encouraged to pursue cloud computing as the alternative to supporting their own hardware backbone. However, cloud computing does not come without its pitfalls. For starters, a cloud is a single point of failure for multiple resources. Even though network carriers such as AT&T believe a distributed cloud structure is the right implementation, it faces major challenges in finding the optimal approach for low power transmission and high network availability some people believe that major corporations will shy away from implementing cloud solutions in the near future due to ineffective security policies. One problem comes from the fact that different cloud providers have different ways to store data, so creating a distributed cloud implies more challenges to be solved between vendors. (Andrei, 2009)

 Data Security

Security refers to confidentiality, integrity and availability, which pose major issues for cloud vendors. Confidentiality refers to who stores the encryption keys - data from company A, stored in an encrypted format at company B must be kept secure from employees of B; thus, the client company should own the encryption keys. Integrity refers to the face that no common policies exist for approved data exchanges; the industry has various protocols used to push different software images or jobs. One way to maintain data security on the client side is the use of thin clients that run with as few resources as possible and do not store any user data, so passwords cannot be stolen. The concept seems to be impervious to attacks based on capturing this data. However, companies have implemented systems with unpublished APIs, claiming that it improves security; unfortunately, this can be reversed engineered; also, using DHCP and FTP to perform tasks such as firmware upgrades has long been rendered as insecure. Nevertheless, products from Wyse are marketed with their thin client as one of the safest, by using those exact features. Lastly, the most problematic issue is availability, as several companies using cloud computing have already experienced downtime (Amazon servers subject to what appeared to be a denial of service attack). Other things to keep in mind are contract policies between clients and vendors, so that data belongs only to the client at all times, preventing third parties to be involved at any point. Also, authentication should be backed by several methods like password plus flash card, or password plus finger print, or some combination of external hardware and password. One benefit of cloud computing is that client software security does not need to be enforced as strictly as before. This aspect concerns the view of cloud computing as software as a service, as it becomes more important to ensure security of data transfer rather than a traditional secure application life cycle.

1 Cloud Computing Security Issues

Identified seven issues that need to be addressed before enterprises consider switching to the cloud computing model. They are as follows:

        . privileged user access - information transmitted from the client through the Internet poses a certain degree of risk, because of issues of data ownership; enterprises should spend time getting to know their providers and their regulations as much as possible before assigning some trivial applications first to test the water.

. regulatory compliance - clients are accountable for the security of their solution, as they can choose between providers that allow to be audited by 3rd party organizations that check levels of security and providers that don't

  . data location - depending on contracts, some clients might never know what country or what  jurisdiction their data is located

    . data segregation - encrypted information from multiple companies may be stored on the same hard disk, so a mechanism to separate data should be deployed by the provider.

    . recovery - every provider should have a disaster recovery protocol to protect user data

        . investigative support - if a client suspects faulty activity from the provider, it may not have many legal ways pursue an investigation

        . long-term viability - refers to the ability to retract a contract and all data if the current provider is bought out by another firm Given that not all of the above need to be improved depending on the application at hand, it is still paramount that consensus is reached on the issues regarding standardization.

Cloud Computing Challenges

Challenges that cloud computing currently faces in being deployed on a large enterprise scale:

        . Self-healing - in case of application/network/data storage failure, there will always be a backup running without major delays, making the resource switch appear seamless to the user.

        . SLA-driven - cloud is administrated by service level agreements that allow several instances of one application to be replicated on multiple servers if need arises; dependent on a priority scheme,  the cloud may minimize or shut down a lower level application. 

        . Multi-tenancy - the cloud permits multiple clients to use the same hardware at the same time, without them knowing it, possibly causing conflicts of interest among customers.

        . Service-oriented - cloud allows one client to use multiple applications in creating its own.

        . Virtualized - applications are not hardware specific; various programs may run on one machine using virtualization or many machines may run one program.    

Linearly scalable - cloud should handle an increase in data processing linearly; if "n" times more users need a resource, the time to complete the request with "n" more resources should  be roughly the same.

        . Data management - distribution, partitioning, security and synchronization of data.

Refrences

Andrei, T. (2009, April 30). Cloud Computing Challenges and Related Security Issues. Retrieved April 30, 2009, http://www.cs.wustl.edu

Tharam Dillon, C. W. (2010, Dec 31). cloud computing challenges and issues. Retrieved Dec 31, 2010, from cloud comouting challenges and issues website: http://www.techpdf.in