Cloud Security and Privacy Assignment 2022

Running head: CLOUD SECURITY AND PRIVACY
Cloud Security and Privacy
Name of the Student
Name of the University
Author’s Note:

1
CLOUD SECURITY AND PRIVACY
Table of Contents
1. Introduction............................................................................................................................2
2. Discussion on Case Study......................................................................................................2
2.1 Security of the Employees’ Data......................................................................................3
2.2 Privacy of Employees’ Data.............................................................................................8
2.3 Digital Identity Issues....................................................................................................12
3. Conclusion............................................................................................................................13
References................................................................................................................................14

2
CLOUD SECURITY AND PRIVACY
1. Introduction
Cloud computing technology can be termed as the on demand accessibility of several
computer based system resource, majorly for the computing power as well as system
resource. This is being done even without any direct user management (Baron et al., 2019).
The large clouds comprise of the functionalities that are being distributed over numerous
locations from the centralized servers. When the respective connection to any specific user is
extremely closer, it might be subsequently designated over the edge servers. These typical
clouds might be restricted to any one organization, so that they are available to several
distinctive companies such as public cloud and even an amalgamation of both the clouds for
hybrid cloud (Almorsy, Grundy & Müller, 2016). The following report would be providing a
proper analysis of the case scenario of DAS about the recent movement of this company to
cloud services to enhance their overall productivity and performance management. The
various details related to security as well as privacy of employee’s confidential data and
information with subsequent identification of the various risks and vulnerabilities. The final
part of the report discusses about the major risks related to digital identifies from movement
to the applications of SaaS.
2. Discussion on Case Study
DAS is solely responsible for providing several products and services to every other
department f an Australian State Government. Each of the service mainly includes
procurement, management of contractors, management of contract tender, payroll,
management of human resources and personnel. All of these services are being provided from
the own data centres of the Department and as a result of the change within the policy of the
respective government policy, this particular organization of Department of Administrative
Services has decided to make a movement to the approach of Shared Services. The approach

3
CLOUD SECURITY AND PRIVACY
refers to the fact that DAS would eventually centralize a series of services for the entire
Government or WofG. It is being evaluated that as a result of this type of movement, there
would be a requirement of the migration of their confidential data so that the data could be
consolidated into any one of the central database of DAS. The organization would then
provide the consolidated services to any other agency or department for the same
government.
According to any other policy of the government, there would be a mandatory cloud
first approach that helps in up gradation as well as acquiring of the services and software.
There are few strategic policy changes from the government, which include purchasing
applications of personnel as well as HR management from the United States based
organization, which gives a software as a service solution and movement of the DAS payroll
to the application of COTS, which could be controlled within a specific public cloud. This
transferring to cloud approach and application is responsible for eradicating all types of
issues ad complexities to a high level and hence reducing the overall expenses in a better
manner.
2.1 Security of the Employees’ Data
2.1.1 Establishment of Existing Vulnerabilities and Threats to Security of Data as well
as Information contained in the Database of HR
The confidential datum or information of the staff within the DAS major and
significant issues and threats related to security (Krasnyanskaya & Tylets, 2015). This type of
sensitive datum is being stored in the respective databases of HR department. As a result,
there exists some of the major issues related to data loss threat. The data might be under stake
and could even be completely lost. The major reason for such distinctive threat would be the
lack of recognition of every existing threat or risk in the database of human resources. The

4
CLOUD SECURITY AND PRIVACY
major as well as the most vital vulnerabilities or risks that would be possible to the respective
security factor of employees’ data within the subsequent database of in house human resource
department are described in the following paragraphs:
i) DoS Attacks or Denial of Services Attacks: The first as well as the most significant
risk or threat related to this security of employees’ data would be DoS attack (Aljawarneh,
Alawneh & Jaradat, 2017). This is eventually taken into consideration as the most nefarious
attack, which can easily cause subsequent destruction to the respective in house database of
the human resource department within DAS. This is a kind of cyber threat, in which the
specific attacker eventually seeks within a machine and network for making it completely
unavailable or inaccessible to all authorized users. It is being executed after disruption of the
service of the respective host temporarily, which is being linked to a secured Internet
connection (Rittinghouse & Ransome, 2017). Another vital type of this denial of services
attack would be the DDoS or distributed denial of services, which is being referred to as the
specified incoming network traffic and flooding the victim’s system by originating from
various sources.
ii) Legitimate Privilege Abuses: The second important and significant risk and threat
to the respective database of human resources for DAS would be the legal privilege abuses.
All the clients, who comprises of the subsequent right for utilization of the data of the staffs,
could effortlessly and promptly exploit various distinctive privileges given to him, hence
could even use the confidential data from any kind of illegal or incorrect deed. This type of
threat or risk of legitimate privilege abuses could be eventually referred to as quite nefarious
for each and every database (Singh & Chatterjee, 2017). It is quite unlikely that these
personal copies of the employee record databases getting complied with the respective
policies of data protection. Hence, such abuses are termed as extremely dangerous for in
house HR database.

5
CLOUD SECURITY AND PRIVACY
iii) Database Injection Attack: Another distinctive and popular kind of vulnerability
or threat that would be existing in the HR databases of DAS would be database injection
attack. This particular attack can be referred to a major technique for injecting codes that is
being utilized for attacking all types of applications, which are being driven through data
(Zhao, Li & Liu, 2014). By considering thus type of attacks, the attack can easily insert SQL
statement into entry field for a better execution.
iv) Malware: This is the fourth subsequent and vital kind of vulnerability or threat
that is existing in the HR databases of DAS will be malware. This particular risk could be
easily defined as the kind of any specific malicious software, being designed to cause any
type of damage to the computerized network, systems and server. A subsequent damage to
the respective database could be done by considering help from malware (Kalaiprasath,
Elankavi & Udayakumar, 2017). It is generally found within the basic formation of few
executable codes, active contents and even executable script. A popular example of this type
of malware major involves Trojan horse, computerize virus, ransomware and adware. The
respective in house database of human resources for DAS can be easily attacked or hacked by
malware, thus making opportunity to steal the confidential data.
2.1.2 Other Vulnerability and Threats to Security of the Employees’ Data after
successful Migration to the SaaS
The organization has taken the core decision to move the services or workload to
cloud for bringing extra profit within the business. SaaS is licensing of software and
delivering model, in which the software could be licensed as per subscription. Each cloud
service model is being accessed by every user by the clients through web browsers (Singh &
Pandey, 2014). Microsoft Azure and CAD are termed as the most significant applications for
software as a service. Thus, as soon as the work load is being migrated to cloud service

6
CLOUD SECURITY AND PRIVACY
model, such distinctive services can be termed as vulnerable to various kinds of threats and
such distinctive risks are provided in the following paragraphs:
i) Deletion of Data: This is the first risk, which could easily take place as soon as the
migration of SaaS gets completed (Aljawarneh & Yassein, 2016). Each and every risk that is
being associated to the data deletion and exist when the client has reduction of visibility or
control, where the respective confidential data could be stored within the cloud as well as a
reduction in the capability of proper verification of security of data. Due to easier procedure
of data deletion, migration of SaaS is being considered easily.
ii) Negotiating the Internet Access Management of Application Programming
Interfaces: This is the second important and significant risk that occurs after successful
migration to SaaS in the organization of DAS. The negotiation of the Internet access
management of APIs or application programming interfaces is referred to as the most
distinctive issue that is being faced by the users (Ali, Khan & Vasilakos, 2015). These
interfaces are being utilized by the respective users for the purpose of controlling or even
interacting with several services of cloud and are then substantially exposed to public.
Various risks are eventually present within the interface, thus such threats could be turned
into attacks.
iii) Self Service Inducing Unauthenticated User: the on demand self service is
eventually responsible to induce each and every unauthenticated and unauthorized user, thus
enabling the respective organizational staff towards provisional extra service (Tari, 2014). A
simplified implementation of the SaaS as well as lower expenses are termed as responsible
for unauthenticated use.
iv) Reduction of Control: This is yet another distinctive risk or threat that takes place
after SaaS migration. As soon as the operations and assets are eventually transitioned to the

7
CLOUD SECURITY AND PRIVACY
cloud, every organization has the core capability of losing data visibility and control
(Samarati et al., 2016). A subsequent shifting within the respective model of cloud service is
required for security monitoring.
2.1.3 Proper Assessment of Resulting Severity of Threats and Risks to the Security of
Employees’ Data
An assessment of the severity of the vulnerability and threats for security of the
confidential data of employees within DAS can be done effectively. These threats are being
sub divided into four major categories, which are described in the following paragraphs:
i) Maximum: This is the most important and significant category of the risks and
threats to measure overall severity. The total vulnerability of the specific risk could be
extremely high as compared to any other risk, before checking the lost data to be easily and
promptly being recovered (Wei et al., 2014). Hence, the respective company eventually faces
some of the distinctive problems. The specific risk category of maximum is extremely
important for getting ceased within time to stop the kind of threats. From each and every
identified risk and threat regarding security of the employees’ data within the organization of
DAS, the most nefarious attacks would be database injection attack.
ii) Significant: This is the next category for risks in the respective planning for
assessing risks. This particular category of risk is extremely helpful to provide extreme
destructions within the databases as well as affecting overall integrity or confidentiality of the
data (Nanavati et al., 2014). Amongst the identified threats and risks, DoS attack can be
termed as the part of significant risk category. The user gets no idea regarding such threat
before being attacked.
iii) Limited: In this risk category, those risks are being categorized, which are less
vulnerable as compared to the rest of risks. However, there exists some of the major issues

8
CLOUD SECURITY AND PRIVACY
related to security, as soon as any proper action is being not undertaken within time
(Fernandes et al., 2014). After checking the identified risk related to employee data security
within DAS, malware could be categorized as limited.
iv) Negligible: This is the final risk category, in which those risks are categorized,
which do not provide vulnerability and could be considered as negligible. It eventually does
not impact on the confidentiality of data in the company and amongst every noted risk, the
most negligible risk would be legitimate privilege abuses.
2.2 Privacy of Employees’ Data
2.2.1 Establishment of Existing Vulnerability and Risks to Data Privacy contained in
the Database of HR
Overall privacy of these confidential as well as sensitive datum for the in house HR
database within the organization of DAS is not being observed perfectly (Jouini & Rabai,
2019). Due to the subsequent negligence for privacy of data, the respective organization
undergoes several vulnerabilities, which are quite dangerous for the company. Various
existing vulnerabilities and risks for privacy of data for the respective HR database are
provided in the following paragraphs:
i) Database Protocol Vulnerabilities: This is an important and subsequent risk, which
provides major vulnerability to the database. This specific issue allows any kind of
unauthenticated access of data, hence leading to corruption (Iqbal et al., 2016). Such
distinctive codes can be easily executed over the respective target database servers, before
checking whether attacks could be defeated after successful validation of SQL
communication. Each and every vulnerability is quite nefarious to the database.
ii) Exposure of Backing up of Data: This is yet another distinctive nefarious threat
towards privacy of data within DAS so that backing up of data could be easily exposed

9
CLOUD SECURITY AND PRIVACY
(Coppolino et al., 2017). Such backups must be perfectly encrypted, hence some of the
vendors explicitly provide a solution for utilization of futuristic DBMS. Data integrity is
being lost completely by this threat.
iii) Leakage of the Personal Data: This is the third vulnerability and risk to data
privacy that checks leakage of data (Tari et al., 2015). Since, the DAS payroll would be
moving to COTS, the confidential data often gets leaked within the cloud, hence losing
confidentiality completely.
iv) Lacking of Authentication: The most basic as well as the major threat towards the
privacy of data in the organization of DAS would be lacking of authentication. It is a vital
factor, which eventually helps in enabling all types of authorized users during prevention of
confidential data to get hacked (Taha et al., 2014). A successful implementation of 2 factor
authentication as well as password is needed for the purpose of authentication. Better
integration is also needed in this type of issue for enterprise directory and user infrastructure
management.
2.2.2 Other Vulnerabilities and Threats to the Privacy of Employees’ Data after
successful Migration to Cloud SaaS
As the organization of DAS has taken the core decision of shifting the services to
cloud or considering cloud approach, SaaS is one of the best choices amongst several other
choices (Kazim & Zhu, 2015). Cloud computing has the major goal of cutting down of costs,
before helping various users to emphasize over the major business and not only getting
impeded by the obstacles of information technology. Virtualization is considered as the main
enabling technology and this particular software can separate the physical computing device
to any virtual device. Every virtual device could be promptly being utilized as well as
controlled for performing the computing tasks or activities. By consideration of the operating

10
CLOUD SECURITY AND PRIVACY
system virtualization technology, it becomes quite easy to create any particular scalable
system of several independent computing device (Tirthani & Ganesan, 2014). It is also
required for allocating the idle computing resource and using them quite effectively.
This virtualization even provides an agility that is needed for speeding up of the
operations of information technology, before reduction of the expenses after increment of
infrastructure usages. The phenomenon of autonomic computing even provides an
automation of the procedure by which any user could provision the on demand resources.
After minimization of the use involvement, this automation could easily speed up the entire
procedure by reduction of the labour expenses as well as possibility of the human errors. This
particular technology utilizes several concepts from the utility computing for the core reason
for providing metrics for the various services utilized (Khalil, Khreishah & Azeem, 2014).
The several distinctive threats and risks, which are extremely vulnerable and can also cause
subsequent problems for the purpose and these threats are provided in the following
paragraphs:
i) Increment of Complexities for Organizational Personnel: Each and every
organizational personnel has equivalent value, hence they might not have same knowledge
about the cloud service development model of SaaS. It eventually increments numerous
issues for the organizational personnel since they have to suffer from distinct complexities.
ii) Insiders Attack: The second common kind of risk, which is extremely dangerous
for overall privacy of the employees’ data in the database of DAS would be insider attack
(Khan & Tuteja, 2015). As soon as the migration of SaaS gets executed, all the vendors of
cloud or organizational personnel could easily obtain access to confidential data, thus this
type of data can be exploited. This type of attack is known as insider attack.

11
CLOUD SECURITY AND PRIVACY
iii) Stolen Credential: Organizational credentials could be eventually be stolen as
soon as several services of the business gets migrated to cloud. Such credentials could be
quite vital since confidentiality gets hacked and can also not be prevented under any
circumstance. An attacker can hence easily access each and every service of authenticated
user for providing the resources.
iv) Insufficient Due Diligence: An insufficient due diligence is being performed only
after successful SaaS migration. This is quite common especially for SaaS cloud model and
every security measure may get affected due to this, thus enhancing such vulnerabilities.
2.2.3 Proper Assessment of Resulting Severity of the Threats and Risks to the Privacy of
Employee’s Data
Severity of these above mentioned vulnerability and threats regarding privacy of data
is being checked on the basis of four distinctive categories, which are provided in the
following paragraphs:
i) Maximum: This is the first and the most dangerous category of risk. Every
identified risk or threat identified for the case study of the DAS related to data privacy, the
threat of database protocol vulnerability could be categorized within the maximum category.
ii) Significant: This is the second important and significant category of risks (Huang
et al., 2015). As soon as any particular action is not undertaken perfectly, the respective risk
can be referred to as extremely dangerous as well as quite threatening for an organization.
Amongst the identified risks regarding data privacy, exposure of every backing up of data can
be referred to as significant in nature.
iii) Limited: This is the next important and nefarious category of risks. According to
the specified category, the risk might not be as vulnerable as compared to maximum and
significant categories. Leaking of employees’ personal data is one of the major examples of

12
CLOUD SECURITY AND PRIVACY
limited category of risk. This personal datum must not be breached under any circumstance,
hence plan for mitigation is needed for organization database regarding privacy of the data.
iv) Negligible: This is the fourth important and significant category of risks. Such
negligible threats could be referred to as quite vulnerable for DAS’s database. The users
could easily and promptly avoid the risks after implementation of mitigation techniques
(Khansa & Zobel, 2014). Lacking of authentication is termed as the most significant example
of negligible risk category.
2.3 Digital Identity Issues
It is being noted that the hybrid and public clouds enable the organizations in
avoidance or minimization of up front IT infrastructure related overheads. After significant
analysis, it is being observed that this particular technology is allowing the enterprises in
getting the applications up or even running faster with an improvised management as well as
lesser maintenance (Nepal & Pathan, 2014). It helps in enabling the teams of information
technology for extreme adjustment of the resources and then meeting the unpredictable or
fluctuating demands.
The providers of cloud generally utilize a model of pay as per utilization that could
lead to the unexpected operating costs when any administrator is not familiarized with a
cloud pricing model. The availability of each and every high capacity network, storage device
as well as low costs systems or even wide spread adoption of the hardware virtualizations,
utility based computing as well as service oriented architectural model are responsible for
successful development and growth in the cloud computing. Digital identities could be
referred to as the major types of information or any entity, which is being utilized with the
help of computerized system for effective representation of every specified external agent
(Tari et al., 2015). Such distinctive agents can either be an individual, an application, a device

13
CLOUD SECURITY AND PRIVACY
or even an organization. Digital identities have the major capability of allowing better access
of services and making them automated. DAS decided to move their data to cloud, hence
digital identities should be used. The major threats should be present regarding digital
identities for DAS’s employees and such threats are described in the following paragraphs:
i) Lack of Proper Verification and Validation: The lack of proper verification and
validations is extremely important for digital identity maintenance. Such distinctive threat is
also responsible to bring out the most significant issues related digital identity.
ii) Poor Authorization and Authentication: One of the major risks related to digital
identity would be poor authorization and authentication. When a digital identity is not getting
perfect authentication, there should be a major chance of losing integrity and confidentiality
of data (Fernandes et al., 2014). The respective attackers could easily hack confidential data,
thus unauthorized access cannot be promptly stopped. These authentication issues are
required to be analysed under every circumstance.
3. Conclusion
Hence, it could be concluded that the major objectives of this technology of cloud
computing is allowing the users to obtain advantages from each and every technology
without even the requirement of deep knowledge regarding expertise of any one of them. The
technology even attempts in addressing the quality of service or QoS as well as overall
reliability issues of every grid computing model. There are some of the major and the most
significant features of cloud computing, which include client server model, grid computing’s,
main frame computer, fog computing and even green computing. This above provided report
has properly demonstrated about a proper description of the popular scenario of DAS with
various details. Moreover, the various vulnerability and risks related to the digital identity of
government employees are also demonstrated in this report.

14
CLOUD SECURITY AND PRIVACY
References
Ali, M., Khan, S. U., & Vasilakos, A. V. (2015). Security in cloud computing: Opportunities
and challenges. Information sciences, 305, 357-383.
Aljawarneh, S. A., & Yassein, M. O. B. (2016). A conceptual security framework for cloud
computing issues. International Journal of Intelligent Information Technologies
(IJIIT), 12(2), 12-24.
Aljawarneh, S. A., Alawneh, A., & Jaradat, R. (2017). Cloud security engineering: Early
stages of SDLC. Future Generation Computer Systems, 74, 385-392.
Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security
problem. arXiv preprint arXiv:1609.01107.
Baron, H., Heide, S., Mahmud, S., & Yeoh, J. (2019). Cloud Security Complexity:
Challenges in Managing Security in Hybrid and Multi-Cloud Environments.
Coppolino, L., D’Antonio, S., Mazzeo, G., & Romano, L. (2017). Cloud security: Emerging
threats and current solutions. Computers & Electrical Engineering, 59, 126-140.
Fernandes, D. A., Soares, L. F., Gomes, J. V., Freire, M. M., & Inácio, P. R. (2014). Security
issues in cloud environments: a survey. International Journal of Information
Security, 13(2), 113-170.
Huang, W., Ganjali, A., Kim, B. H., Oh, S., & Lie, D. (2015). The state of public
infrastructure-as-a-service cloud security. ACM Computing Surveys (CSUR), 47(4),
68.
Iqbal, S., Kiah, M. L. M., Dhaghighi, B., Hussain, M., Khan, S., Khan, M. K., & Choo, K. K.
R. (2016). On cloud security attacks: A taxonomy and intrusion detection and
prevention as a service. Journal of Network and Computer Applications, 74, 98-120.

15
CLOUD SECURITY AND PRIVACY
Jouini, M., & Rabai, L. B. A. (2019). A security framework for secure cloud computing
environments. In Cloud security: Concepts, methodologies, tools, and
applications (pp. 249-263). IGI Global.
Kalaiprasath, R., Elankavi, R., & Udayakumar, D. R. (2017). Cloud. Security and
Compliance-A Semantic Approach in End to End Security. International Journal Of
Mechanical Engineering And Technology (Ijmet), 8(5), 987-994.
Kazim, M., & Zhu, S. Y. (2015). A survey on top security threats in cloud computing.
Khalil, I., Khreishah, A., & Azeem, M. (2014). Cloud computing security: A
survey. Computers, 3(1), 1-35.
Khan, S. S., & Tuteja, R. R. (2015). Security in cloud computing using cryptographic
algorithms. International Journal of Innovative Research in Computer and
Communication Engineering, 3(1), 148-155.
Khansa, L., & Zobel, C. W. (2014). Assessing innovations in cloud security. Journal of
Computer Information Systems, 54(3), 45-56.
Krasnyanskaya, T. M., & Tylets, V. G. (2015). Designing the cloud technologies of
psychological security of the person. Вопросы философии и психологии, (3), 192-
199.
Nanavati, M., Colp, P., Aiello, B., & Warfield, A. (2014). Cloud security: A gathering
storm. Communications of the ACM, 57(5), 70-79.
Nepal, S., & Pathan, M. (Eds.). (2014). Security, privacy and trust in cloud systems. Springer
Berlin Heidelberg.
Rittinghouse, J. W., & Ransome, J. F. (2017). Cloud computing: implementation,
management, and security. CRC press.

16
CLOUD SECURITY AND PRIVACY
Samarati, P., di Vimercati, S. D. C., Murugesan, S., & Bojanova, I. (2016). Cloud security:
Issues and concerns. Encyclopedia on cloud computing, 1-14.
Singh, A., & Chatterjee, K. (2017). Cloud security issues and challenges: A survey. Journal
of Network and Computer Applications, 79, 88-115.
Singh, V., & Pandey, S. K. (2014, October). A comparative study of cloud security
ontologies. In Proceedings of 3rd International Conference on Reliability, Infocom
Technologies and Optimization (pp. 1-6). IEEE.
Taha, A., Trapero, R., Luna, J., & Suri, N. (2014, September). AHP-based quantitative
approach for assessing and comparing cloud security. In 2014 IEEE 13th
international conference on trust, security and privacy in computing and
communications (pp. 284-291). IEEE.
Tari, Z. (2014). Security and Privacy in Cloud Computing. IEEE Cloud Computing, 1(1), 54-
57.
Tari, Z., Yi, X., Premarathne, U. S., Bertok, P., & Khalil, I. (2015). Security and privacy in
cloud computing: vision, trends, and challenges. IEEE Cloud Computing, 2(2), 30-38.
Tirthani, N., & Ganesan, R. (2014). Data Security in Cloud Architecture Based on Diffie
Hellman and Elliptical Curve Cryptography. IACR Cryptology ePrint Archive, 2014,
49.
Wei, L., Zhu, H., Cao, Z., Dong, X., Jia, W., Chen, Y., & Vasilakos, A. V. (2014). Security
and privacy for storage and computation in cloud computing. Information
Sciences, 258, 371-386.

17
CLOUD SECURITY AND PRIVACY
Zhao, F., Li, C., & Liu, C. F. (2014, February). A cloud computing security solution based on
fully homomorphic encryption. In 16th International Conference on Advanced
Communication Technology (pp. 485-488). IEEE.