Cloud Services and Security Report: Data Breach Prevention for Charity

This report addresses cloud services and security concerns for a community-based charity. The charity is considering migrating its data and applications to a community cloud, raising potential risks of data breaches and cyber theft, particularly concerning the sensitive information of the clients. The report recommends strategies to mitigate these risks, including the use of API-based Cloud Access Security Brokers (CASBs) to monitor network traffic and prevent unauthorized access, encryption of confidential data, and password protection for sensitive files. It also highlights the importance of installing anti-virus software and implementing cloud Identity and Access Management (IAM) to prevent malicious attacks and control data access. Furthermore, the report discusses the potential risks associated with accidental data exposure and suggests managing secure access and sharing on platforms like SharePoint. The conclusion emphasizes the need for data control strategies to protect the charity's data and the information of its employees and clients.

Running head: CLOUD SERVICES AND SECURITY
Cloud Services and Security
Name of the Student
Name of the University
Author note

1
CLOUD SERVICES AND SECURITY
Table of Contents
Introduction................................................................................................................................2
Recommended personal data protection strategy.......................................................................2
Strategy to prevent data breaches...........................................................................................2
Strategy to avoid cyber theft..................................................................................................3
Prevention from malicious attacks.........................................................................................3
Prevention from accidental exposure of personal data..........................................................4
Conclusion..................................................................................................................................4
References..................................................................................................................................6

2
CLOUD SERVICES AND SECURITY
Introduction:
The report highlights the data breach issue that may take place due to the
implementation of cloud services by the Charity. The Charity has decided to join a
community cloud that is provided by a Software as a service (SaaS) public cloud vendor to
provide various applications to the support staffs and administrative users. The Charity has
also decided to purchase a Human Resource (HR) and personnel management application
from a company that is based in the US and that provides a SaaS solution. The strategies to
protect the personal data of the Charity and of the clients that use the services of the Charity
are recommended in the report.
Recommended personal data protection strategy:
Strategy to prevent data breaches:
The Charity is planning to join a community cloud that is provided by a public cloud
vendor to provide several application to the staffs of the organisation. The community cloud
will be used to store 200 Terabyte data of the Charity that will be held in a SaaS database.
The SaaS will allow the Charity to store their data in the cloud and the public cloud vendor
would manage and update the software in which the data of the organisation will be saved.
Therefore, this can result in data breach as the confidential data of the clients of the Charity
would be accessed by the public cloud vendor and it will be stored in a public cloud (Rao &
Selvamani, 2015). The Charity is required to consider Application Program Interfaced (API)
based cloud access security brokers (CASBs) as it provides an efficient way to protect the
access to the public cloud data and prevents data breaches (Chou, 2013). The network traffic
is examined by the CASBs that can ensure the Charity that the confidential data of their
clients will remain protected. It prevents several security risks that include downloading of
files by any unauthorised network, sharing of files and other risk operations.

3
CLOUD SERVICES AND SECURITY
Strategy to avoid cyber theft:
The Charity collects the Personally Identifiable Information (PII data) of the clients of
the Charity in order to provide the facility to manage their several service requirements. The
PII data that is collected by the Charity contains several private data including some digital
identity information or data of some disadvantaged clients, particularly of the clients having
mental health issues. This confidential data of the clients will be stored in the SaaS database
that would be operated by the cloud service provider. There is a probability that hackers
might target the confidential data of the clients of the organisation and can access them. It can
harm the privacy and security of the data and can cause damage to the data of the
disadvantaged people of the community (Aljawarneh, 2013). Therefore, the Charity is
required to adopt proper technology in order to avoid the cyber theft and protect their data.
The confidential data of the clients of the Charity should be encrypted, it will protect the data
as the hackers would require a specific encryption key to read the data of the organisation that
would be stored in the cloud (Andress & Winterfeld, 2013). The organisation is required to
make the file containing the confidential data of the clients password protected in order to
protect the PII data of the disadvantaged clients.
Prevention from malicious attacks:
The Charity is planning to purchase a Human Resource (HR) management application
from a company based in the US that offers a SaaS solution. It will allow the employees to
access their performance and HR management information through a link provided by a
cloud service provider that will be placed on the charity intranet. There is a risk to the
personal data of the clients and employees of the Charity if any malicious code is injected
into the cloud server (Patel et al., 2013). The link that would operate the information of HR

4
CLOUD SERVICES AND SECURITY
and performance might get infected due to the malicious attack and make the employees
unable to access their information and the entire data of the organisation might be destroyed.
Therefore, the Charity is required to install anti-virus software in the systems of the
organisation to avoid the data loss of the systems if any malware is injected into the server of
the Charity. The Charity is required to use the service of the cloud service provider that offers
cloud Identity and Access Management (IAM) (Xiong et al., 2014). It will allow the Charity
to restrict the access to the data or information to only the employees.
Prevention from accidental exposure of personal data:
The Charity has decided to move the intranet to the Microsoft SharePoint that would
allow the organisation to provide intranet services to all the agencies in the WofG. This can
held the confidential and private data of the organisation at risk. The internal data can be
leaked if any employees accidentally share the internal data of the Charity on the SharePoint
with someone who does not have the access to that data (Copeland et al., 2015). Therefore,
the Charity is required to manage the secure access and sharing to ensure that the sensitive
and personal data of the Charity does not leak and remains safe. The Charity should manage
and control that who will be allowed to access the data that will be stored on SharePoint to
avoid unauthorised access to the personal data of the clients and employees of the
organisation (Jawad, Serrano-Alvarado & Valduriez, 2013). The Charity is required to view
the audit report of the SharePoint in order to keep track of the actions that take place on their
sites.
Conclusion:
It can be concluded from the above discussion that there is a concern for the confidential and
private data of the Charity if it adopts the cloud service that will be provided by a Software as
a service (SaaS) cloud service provider. The Charity can protect the data of the clients and

5
CLOUD SERVICES AND SECURITY
information of the employees by implementing several data control strategies. It is required
by the Charity to adopt some strategies to prevent the data breach. The data of the Charity
might also be a target of cyber theft, therefore efficient strategies are required to avoid cyber
theft.

6
CLOUD SERVICES AND SECURITY
References:
Aljawarneh, S. (2013). Cloud security engineering: Avoiding security threats the right way.
In Cloud Computing Advancements in Design, Implementation, and Technologies(pp.
147-153). IGI Global.
Andress, J., & Winterfeld, S. (2013). Cyber warfare: techniques, tactics and tools for
security practitioners. Elsevier.
Chou, T. S. (2013). Security threats on cloud computing vulnerabilities. International
Journal of Computer Science & Information Technology, 5(3), 79.
Copeland, M., Soh, J., Puca, A., Manning, M., & Gollob, D. (2015). Microsoft azure and
cloud computing. In Microsoft Azure (pp. 3-26). Apress, Berkeley, CA.
Jawad, M., Serrano-Alvarado, P., & Valduriez, P. (2013). Supporting data privacy in p2p
systems. In Security and Privacy Preserving in Social Networks (pp. 195-244).
Springer, Vienna.
Patel, A., Taghavi, M., Bakhtiyari, K., & JúNior, J. C. (2013). An intrusion detection and
prevention system in cloud computing: A systematic review. Journal of network and
computer applications, 36(1), 25-41.
Rao, R. V., & Selvamani, K. (2015). Data security challenges and its solutions in cloud
computing. Procedia Computer Science, 48, 204-209.
Xiong, J., Yao, Z., Ma, J., Liu, X., Li, Q., & Ma, J. (2014). PRIAM: Privacy Preserving
Identity and Access Management Scheme in Cloud. KSII Transactions on Internet &
Information Systems, 8(1).