Cloud Computing Security Threats and Preventive Methods: An Analysis

Desklib provides solved assignments and past papers to help students succeed.

ITC 595
Information security
Assessment 5
Student name:
Student ID:

Contents
Introduction......................................................................................................................................3
Overview..........................................................................................................................................4
Related techniques and applications................................................................................................5
Grid computing............................................................................................................................5
Utility computing.........................................................................................................................5
Virtualization...............................................................................................................................5
Service-oriented architecture.......................................................................................................5
Challenges in cloud computing and preventive methods................................................................6
Threat 1: Breach of data..............................................................................................................6
Threat 2: Cloud service abuse......................................................................................................6
Threat 3: Insecure APIs...............................................................................................................6
Threat 4: Malware attack.............................................................................................................6
Threat 5: Loss of data..................................................................................................................7
Threat 6: shared technology issues..............................................................................................7
Threat 7: Account hijacking........................................................................................................7
Threat 8: DoS attack....................................................................................................................7
Gaps identification...........................................................................................................................8
Direction for future research..........................................................................................................10
Conclusion:....................................................................................................................................11
References......................................................................................................................................12

Introduction
The report is based on the abstract given in the assessment 3 which is on “security threats in
cloud computing and preventive methods”. The report includes a different section to develop a
depth understanding of the topic. The report will cover an overview of the involved technology,
related technologies, and their applications. It will also cover the challenges in the selected area
of research along with the preventive methods. To support the views, various articles and
journals have been used. The report also includes the issues that have been addressed and not
addressed in those kinds of literature. This will help to perform the gap analysis. At last, the
report will include a summary of directing future research according to the gaps that are
identified.

Overview
Cloud computing is based on the shared computing assets that can be used over the internet. This
removes the requirement of physical resources. Cloud computing basically works on the
virtualization technology along with the coordination of grid computing. Virtualization creates
an illusion o having a number of services that are actually working as per the shared technology.
This provides a simple way to access the databases, servers, application services and storage on
the internet. The main example of cloud computing service is AWS (Amazon web services). The
cloud computing has various benefits such as reduce cost by eliminating investment in hardware,
less maintenance, availability, scalability, platform independence, services on demand and many
more. Along with the benefits, there are different challenges are involved with it (Beal, 2019).

Related techniques and applications
The cloud computing concept is not a revolution. This is the result of the combination of
different technologies with related concepts. The similar technologies of cloud computing
include utility computing, grid computing, and virtualization technology.
Grid computing:
It is based on the distributed computing framework/model that allows multi-virtual organizations
to share the resources or assets to overcome a prevalent computing issue. Physically distributed
and heterogeneous resources are comprised of the grid. In comparison to cloud computing, the
grid shares a common goal for optimum use of resources. Example of this is Globus. In
comparison to grid computing, cloud computing is a homogenous platform.
Utility computing:
A model is introduced by the utility computing which enables the exchange of computer
infrastructure in which assets and resources from the shared pool are transferred to the customers
according to demand and the price of obtaining the facilities is paid on the basis of use. Utility
computing concept is understood by cloud computing by providing computing power that can be
obtained from a set or on-demand model of pricing on the internet.
Virtualization:
The concept is based on the illusion by creating multiple logical computing resources from a
single physical resource. Cloud computing uses the concept of virtualization to offer the resource
pooling capability by the allocation and de-allocation of the virtualized resources. The real-life
application of virtualization concept is to create a virtual machine with the help of VMware for
testing or backup purpose.
Service-oriented architecture
SOA (Service-oriented architecture) is an architectural pattern that is responsible to create the
loosely coupled and distributed system. This is helpful for the organization to achieve business
goals. In cloud computing, it provides the software architecture that addresses the reusability,
compatibility, and scalability (Phaphoom, Wang & Abrahamsson, 2012).

Challenges in cloud computing and preventive methods
There are various challenges associated with the use of cloud computing. The cloud environment
is made using various components and the security depends on each of the components. The
basic security threats of cloud computing include misuse of the cloud services, vendor-lock in,
insecure APIs, shared technology, malicious insiders and service hijacking. It is recommended to
understand all the issues and the preventive methods before the adoption of the cloud computing
solution. Data privacy is also a major issue while dealing with the cloud solution
Threat 1: Breach of data
The cloud environment is always connected with the internet and uses the shared technology.
Thus, this allows the attacker to perform a data breach. A virtual machine in the cloud
environment has access to the communication channel to gain access to the private cryptographic
keys which is used by other VMs on the same network. This multitenant feature of the cloud
environment allows the attacker to gain access to the data of the user. The data breach can occur
due to vulnerabilities of application, human error and weak practices for security.
Solution: Select a reliable provider for cloud services and use proper encryption mechanisms to
assure data security.
Threat 2: Cloud service abuse
In case anyone gets access to the credentials. Because of this any of the cloud network cabs be
attacked by the attacker. Also, the insider can misuse the services.
Solution: Use multifactor authentication and validation process, use network monitoring
systems.
Threat 3: Insecure APIs
Software, APIs, and other interfaces are shared among the clients of the specific cloud
architecture. In such type of system, the security is based on the security policies that are applied
to the software or APIs. This can cause serious security threats (Ma, 2015).
Solution: Inspect the security standards use by the service provider, use strict authentication
Threat 4: Malware attack
Because of the lack of data visibility and high exposure to the network make the environment
prone to malware attacks. There can be situation when the cloud service provider does not
provide proper directions to access the services and functionalities. This can enable the attacker
to inject the virus and another malicious program in the system. The malware attack includes a
virus, Trojan horses, worms, ransomware, spyware, etc.

Solution: Use network sniffers, authorized supply chain mechanisms and network security
along with data backup.
Threat 5: Loss of data
Migration to the cloud services and relaying on the third-party service provider can cause serious
issues. This can lead to the loss of reputation, sensitive data, customer trust, etc. The loss of data
can cause major loss operationally, financially and legally. This can also occur in the absence of
data backup.
Solution: Use strong API security along with the SSL encryption, use backup plans for tough
situations.
Threat 6: shared technology issues
Cloud computing environment enables high scalability by supporting the shared service access
by the user. A hypervisor is used for the same. This makes the cloud environment prone to the
attacks and this can also affect the other system on the network.
Solution: Implement best secure measures, scan the system, and use security policies.
Threat 7: Account hijacking
Attackers can hijack the cloud accounts by using malware, social engineering, spoofing, sniffing
and many other ways. By having access to the account, the attacker can insert malicious
programs, modify the data or delete the data. An attacker can also do
Solution: Apply the security controls and multifactor authentication system.
Threat 8: DoS attack
The denial of service attack prevents legitimate users and systems to access the services. These
attacks caused by flooding the server or system with multiple requests that are higher than the
system capability. The DDoS attack can also be performed on the network with the help of
botnet. This attack makes the services down for even authorized users (Utley, 2018).
Solution: Use load balancing and backup devices to ensure high availability of services.

Gaps identification
As per the (Khan & Yasiri, 2016), there are different threats related to cloud computing. In this
journal, there are ten threats listed which are service or account hijacking, data scavenging,
leakage of data, Denial of service, manipulation of the customer data, VM escape, VM hopping,
creation of VM creation, Insecure migration of VM, spoofing and sniffing attacks. The journal
also includes the potential challenges in cloud computing that are eavesdropping, hypervisor
viruses, legal interception points, the security of virtual machines, trusted transaction, insecure
APIs and vulnerabilities related to shared technology. This article does not include browser
vulnerabilities, protocol vulnerabilities, and malicious insider attacks.
As per the second journal (Ramachandra, Iftikhar & Aslam Khan, 2017) there multiple
vulnerabilities and open issues with the cloud computing solution that are shared technology
vulnerabilities, data breach, denial of service attack, account of service traffic hijacking, internet
protocol, malicious insider, API and browser vulnerabilities, changes in business model, abuse of
services, availability issues etc. This journal did not talk about the data deduplication; backup
issues and user access control related issues
Another journal also stats the security risks associated with the cloud environment. As per
(Kumar & Raj, 2018)the security risks in the cloud environment is associated with the
virtualization multitenancy, integrity, and privacy of data, denial of service attacks, data
deduplication, user access control, loss of data control, backup issues ad availability issues. The
journal does not include various vulnerabilities in cloud computing that can cause serious issues.
As per the (Hashizume, Rosado & Medina, 2013), along with the security issues, there are
multiple vulnerabilities in cloud environment that can cause serious issues. These vulnerabilities
are insecure APIs and vulnerabilities, vulnerabilities related to data, virtual machines based
vulnerabilities, vulnerabilities in images of virtual machines, hypervisor vulnerabilities, virtual
network-based vulnerabilities, etc. The article does not include threats like data deduplication,
service traffic hijacking, malicious insiders, etc.
According to the (Rao & Selvamani, 2015), there are various data security challenges in the
cloud environment that are incident response arrangements, personnel, and physical security,
data leak, availability of cloud services, the security of application, etc. This journal only
includes the security challenges but do not cover the major security risks such as vendor lock-in,
denial of service attack, shared technology issues, insecure API vulnerabilities, etc.
The gap analysis between the current literature and these journals stats that there are many
common issues that are also covered in the current literature such as data breach, cloud service
abuse, malware attacks, insecure APIs and data loss. But there are also much vulnerability,
challenges, and threats that are not addressed in the current literature. Just like data scavenging,
leakage of data, Denial of service, manipulation of the customer data, VM escape, VM hopping,

creation of VM creation, Insecure migration of VM, spoofing and sniffing attacks. The loss of
data is also not properly addressed in the current literature.
It has been analyzed that the account hijacking is the most critical issue in the cloud
computing environment. There are various ways that can be used for account hijacking such as
fraud, social engineering, phishing, spoofing and sniffing. After taking access to the cloud
environment, the attacker may spread the malicious program that can affect the whole network as
all the devices connected with each other. The attacker can manipulate or delete the information,
install a key logger or direct the clients to sites that are non-credible. Attackers can use the
credentials to remotely access the data and services. There are other ways for account hijacking
that consists of scripting bugs that enable the attacker to steal the credentials even without
detection. This can also cause data breach and other attacks in the cloud environment.

Direction for future research
The gap analysis of the current literature and other literature stats that future research should be
done to cover the remaining topic that is not cover adequately or not covered at all in this
literature. The future research can also be based on the possible vulnerabilities and challenges
along with the possible solutions for the same. The future research can be based on analysis of
VM based vulnerabilities.

Conclusion:
The report was based on security threats in cloud computing and preventive methods. Cloud
computing is based on the shared computing assets that can be used over the internet. This
removes the requirement of physical resources. Concept of cloud computing is the result of the
combination of different technologies with related concepts. The similar technologies of cloud
computing include utility computing, grid computing, and virtualization technology. The gap
analysis stat that there are various security threats which can be addressed. The direction for
future research is based on the outcome of this gap analysis. The future research can be done on
more detail solution of the threats and cover the other threats as well.

References
Beal, V. (2019). What is Cloud Computing? Webopedia Definition. Retrieved 27 August 2019,
from https://www.webopedia.com/TERM/C/cloud_computing.html
Hashizume, K., Rosado, D., & Medina, E. (2013). An analysis of security issues for cloud
computing. Journal Of Internet Services And Applications, 5. Retrieved from
https://jisajournal.springeropen.com/articles/10.1186/1869-0238-4-5
Khan, N., & Yasiri, A. (2016). Identifying cloud security threats to strengthen cloud computing
adoption framework. The 2Nd International Workshop On Internet Of Thing: Networking
Applications And Technologies, 94, 485-490. doi:
https://doi.org/10.1016/j.procs.2016.08.075
Kumar, R., & Raj, H. (2018). Exploring Data Security Issues and Solutions in Cloud
Computing. 6Th International Conference On Smart Computing And Communications, 125,
691-697. doi: https://doi.org/10.1016/j.procs.2017.12.089
Ma, J. (2015). Top 10 security concerns for cloud-based services. Retrieved 27 August 2019,
from https://www.imperva.com/blog/top-10-cloud-security-concerns/
Phaphoom, N., Wang, X., & Abrahamsson, P. (2012). Foundations and Technological Landscape
of Cloud Computing. ISRN Software Engineering, 45, 31-62. Retrieved from
https://www.hindawi.com/journals/isrn/2013/782174/
Ramachandra, G., Iftikhar, M., & Aslam Khan, F. (2017). A comprehensive Survey on Security
in cloud computing. The 3Rd International Workshop On Cyber Security And Digital
Investigation, 110, 465-472. doi: https://doi.org/10.1016/j.procs.2017.06.124
Rao, R., & Selvamani, K. (2015). Data Security Challenges and Its Solutions in Cloud
Computing. International Conference On Intelligent Computing, Communication &
Convergence, 48, 204-209. doi: https://doi.org/10.1016/j.procs.2015.04.171
Utley, G. (2018). 6 Most Common Cloud Computing Security Issues - CWPS. Retrieved 27
August 2019, from https://www.cwps.com/blog/cloud-computing-security-issues