Webb's Stores: IaaS Cloud Security Report and Recommendations

This report provides a comprehensive analysis of cloud security for Webb's Stores, an Australian retailer planning to implement an IaaS cloud database. It begins with an introduction to cloud computing and its benefits, highlighting the need for robust security measures. The report then delves into the security aspects of the IaaS cloud model, identifying potential network-based attacks and recommending countermeasures like intrusion detection tools, data analytics, and strong access control mechanisms. It emphasizes the importance of protecting sensitive information such as client, product, and financial data. The report explores various challenges and issues associated with cloud database implementation, including integration problems, technical errors, and associated costs. It identifies specific database security risks, such as unauthorized access and denial-of-service attacks, and infrastructure-related vulnerabilities. The report also addresses communication and data operation risks, including data backup, storage, and retrieval issues, and recommends strategies for disaster recovery and access control. The report concludes with a summary of the key findings and recommendations, reinforcing the importance of proactive cloud security measures for Webb's Stores.

Webb’s Stores
Table of Contents
Introduction.................................................................................................................................................4
Security of IaaS Cloud Model and Database...............................................................................................4
Benefits for the Enhancement of Security...............................................................................................5
Types of Challenges & Issues..................................................................................................................5
Database Issues & Security Risks................................................................................................................6
IaaS Infrastructure Issues & Security Risks.................................................................................................6
Communication Issues & Security Risks.....................................................................................................6
Backup, Storage and Retrieval Issues & Security Risks..............................................................................6
Disaster Recovery – Changes in Strategy and Policy..................................................................................7
Access Control Mechanisms and Processes.................................................................................................7
Conclusion...................................................................................................................................................8
References.................................................................................................................................................10
2

Webb’s Stores
Executive Summary
The report covers the cloud security concepts and details for an Australian retailer called Webb’s
Stores. The store is soon going to implement IaaS cloud database and the report highlights the
various countermeasures that can be used for the avoidance of associated security risks. Benefits
of these measures along with an explanation of different forms of risks and challenges that will
be involved in association with the security have been listed in the report.
3

Webb’s Stores
Introduction
Cloud computing has flourished in the recent years and is being used by the organizations and
business units all across the globe. The cloud services in the present times have enabled the
business owners and executive to provide better quality services to the users and have also
strengthened the business integration, communication and continuity.
One of the organizations that have recently decided to step into the world of cloud is the Webb’s
Stores. It is a retailer of food items and specialty items and is located in Australia. For the
processing and management of the store information, there are two centres of the Webb’s Stores
that are located in Melbourne and Sydney. The store is spread across many different locations in
Australia and therefore, there are regional data centres as well in Wagga, Port Macquarie,
Auckland and many other regional locations. There are around 800 members of the staff that are
associated with the store comprising of the warehouse and sales staff members.
With the increase in the number of operations, sales activities, employee and customer count,
there are increased complexities that are observed in the management and processing of the data
and information. The decision to move the database to cloud has been taken to resolve all such
problems.
Security of IaaS Cloud Model and Database
There are many cloud models that can be implemented for the database migration to the cloud in
case of the Webb’s Stores. IaaS cloud has been preferred and recommended as per the
specifications and needs of the store. However, the cloud model is associated with certain forms
of security risks and attacks. It would be necessary to identify and analyze these attacks so that
the corresponding measures may be taken to avoid all the security occurrences. Some of the
recommended measures have been listed below.
 There may be many of the network based security attacks that may take place in IaaS
cloud database. The network based intrusion detection and prevention tools are available
in the market so that the malevolent activities can be highlighted as soon as the attacker
attempts to execute them. There shall also be application of data analytics tools used in
4

Webb’s Stores
security tools so that the behavior of the attackers and the attacking patterns that are used
by them can be identified.
 The basic security set up shall be made strong so that the overall security of the database
is improved. Access control is one of such measure that would prevent the access of all
the malicious entities.
 Other similar mechanism to enhance the basic security would be authentication system.
There shall be enhanced authentication with the use of multiple measures that shall be
enforced.
 Many automated and ready to use applications are also available which can be used, such
as anti-malware tools along with anti-denial tools (Ismail, 2017)
 Advanced encryption algorithm, digital certificates and hashing algorithms shall also be
used to protect the information.
 Disaster recovery can be implemented by making use of the automated back-up of the
entire data sets.
Benefits for the Enhancement of Security
Information is the key asset for the organizations. In case of Webb’s Stores, there is a lot of
information that the store manages processes and stores in the data centres. These include the
information about the clients, products, employees, transactions, sales, payments, inventory and
a lot more. In case of the security occurrence, the properties of the information may suffer poorly
which may in turn impact the profits and revenues earned by the store (Simou, 2016).
IaaS cloud security will make sure that none of such occurrences and events take place and the
information is protected at all times. It will provide numerous benefits in the form of enhanced
customer trust and transparency along with competitive advantage in the market along with
enhanced revenues and profits.
Types of Challenges & Issues
There are various forms of challenges and issues that may crop up with the implementation of
cloud database with Infrastructure as a Security (IaaS) cloud model. The store must already be
making use of a number of other technical tools and components. The database is required to be
integrated with all such tools and there may be issues in this process. There may also be
5

Webb’s Stores
occurrence of technical faults and operational errors due to the involvement of so many different
elements and components (Shahid, 2015).
The process of migration will bring many of the costs along with it in terms of tools cost,
resource costs and cost of the project tasks.
Database Issues & Security Risks
The risks and issues in associated with the IaaS cloud database for the Webb’s Stores may be in
the form of the database risks in itself. The security of the database may be compromised due to
the involvement of increased number of access points. The attackers may be able to succeed in
identifying the access points and may make use of the same for breaching of the information.
There may also be denial attacks executed by the attackers to make the database services
unavilable for the users (Alashoor, 2014).
IaaS Infrastructure Issues & Security Risks
The overall infrastructure that will be offered by the IaaS cloud model may also be put at risk.
The staff members of the Webb’s Stores will be making use of such an infrastructure for the first
time which may lead to the execution of multiple errors and mistakes by them. This may enhance
the security vulnerabilities that may go unnoticed and may be used by the attackers to execute
the eavesdropping and impersonation attacks (Singh, 2001).
Communication Issues & Security Risks
The information will not remain at rest in case of the cloud model. It will keep on traversing
from one medium to the other and the information may be shared among many resources and
access points. During this sharing and communication of the information, the attackers may
execute the attacks like man in the middle or eavesdropping attacks to breach the information
and capture its contents and properties.
Backup, Storage and Retrieval Issues & Security Risks
The other category of risks that may emerge which may lead to compromise on the security of
the data and information may be related with the specific data operations that will be carried out.
6

Webb’s Stores
 Data Backups: Backup is an essential activity that is carried out in case of databases and
system information so that a copy of the entire data sets is saved and updated. It is done
with the aim of disaster recovery and control in case of a security attack. However, the
attackers may trigger a malware during backup process and the same may lead to
deterioration of the information properties. This may lead to problems of integrity
violation.
 Storage: The primary purpose of a database is to store the information in the data
repositories so that it can be managed and processed correctly. These storage containers
and repositories may be misused by the attackers and there may be many attacks that may
be executed in terms of information breach, malware attack, information loss etc.
(Fowler, 2010).
 Data Retrieval: There are queries that are processed to retrieve the data from the
database. These queries may be injected with malicious code by using SQL injection
attacks. There may also be unauthorized users that may gain access to the database and
retrieve the information that may not be permitted to be viewed by them.
Disaster Recovery – Changes in Strategy and Policy
The disaster recovery strategy is essential to be updated on the basis of the disasters and types of
attacks. It cannot remain static to handle all forms of security risks and occurrences.
An improved risk identification and analysis will be necessary to be carried out which shall make
use of automated analytics tools and applications. This process will provide an updated picture of
the possible attacks that may take place (Tari, Yi, Premarathne, Bertok & Khalil, 2015). In the
next set of steps, each risk and occurrence that is identified must be mapped with a disaster
recovery strategy. The strategy will vary on the basis of the risk type and the other contributing
factors.
There shall also be an updated backup and damage control process implemented which must also
focus upon the encryption of the information.
7

Webb’s Stores
Access Control Mechanisms and Processes
The basic security set up shall be made strong so that the overall security of the database is
improved. Access control is one of such measure that would prevent the access of all the
malicious entities. Access control in the present times is not restricted to physical security
processes for the verification and validation of the entities. There are improved and new methods
that may be used for the purpose of control on the access which shall be used in the case of the
cloud database for the Webb’s Stores.
 IaaS infrastructure: There shall be use and application of role-based access control
measures for the avoidance and prevention of any of the intruder or unauthorized access.
 Cloud instance of MS SQL Server 2012 R2: There shall be use and application of role-
based access control measures for the avoidance and prevention of any of the intruder or
unauthorized access.
 Cloud network infrastructure: There shall be use and application of attribute-based access
control measures for the avoidance and prevention of any of the intruder or unauthorized
access.
 Backup, storage and retrieval: There shall be use and application of attribute-based access
control measures for the avoidance and prevention of any of the intruder or unauthorized
access.
Access refers to the property in which the user is provided with specific permissions to perform a
certain task or an activity. In terms of the databases, the access may refer to the permission to
view the data, write the data or modify the data. There is also access required to perform other
data operations as well (Khan, 2012). It is therefore necessary to provide the access only to the
users who are authorized to perform certain and specific tasks.
Role based access control is also abbreviated as RBAC and as the name suggests, the
permissions are provided on the basis of the user roles. These may include different permissions
for database administrator, data analyst, data associate, data scientist and likewise. The attribute
based access control is another form of control that may be applied which considers the user
attributes instead of the roles.
8

Webb’s Stores
Conclusion
Webb’s Stores is a retailer from Australia that is expanding at a rapid pace. With the increase in
the number of operations, sales activities, employee and customer count, there are increased
complexities that are observed in the management and processing of the data and information.
The decision to move the database to cloud has been taken to resolve all such problems
(Nadeem, 2016). There are security issues that come up with the use and implementation of
cloud computing in the organization. The cloud model selected for Webb’s Stores is
Infrastructure as a Service (IaaS). IaaS cloud security will make sure that none of such
occurrences and events take place and the information is protected at all times. It will provide
numerous benefits in the form of enhanced customer trust and transparency along with
competitive advantage in the market along with enhanced revenues and profits (Hashemi &
Hesarlo, 2014). The store must also look out for and explore the security parameters and
mechanisms that they may enhance with the involvement of other technologies. For instance,
there shall also be application of data analytics tools used in security tools so that the behavior of
the attackers and the attacking patterns that are used by them can be identified. Many automated
and ready to use applications are also available which can be used, such as anti-malware tools
along with anti-denial tools. Advanced encryption algorithm, digital certificates and hashing
algorithms shall also be used to protect the information. It must be understood that the security of
the information is of utmost importance and the measures shall be taken for smooth migration to
the cloud. There shall also be careful and extensive planning that must be involved.
9

Webb’s Stores
References
Alashoor, T. (2014). Cloud computing: a review of security issues and solutions. International
Journal Of Cloud Computing, 3(3), 228. http://dx.doi.org/10.1504/ijcc.2014.064760
Fowler, S. (2010). Impact of denial of service solutions on network quality of service. Security
And Communication Networks, 4(10), 1089-1103. http://dx.doi.org/10.1002/sec.219
Hashemi, S., & Hesarlo, P. (2014). Security, Privacy and Trust Challenges in Cloud Computing
and Solutions. International Journal Of Computer Network And Information Security, 6(8),
34-40. http://dx.doi.org/10.5815/ijcnis.2014.08.05
Ismail, N. (2017). The winding road to GDPR compliance - Information Age. Information Age.
Retrieved 20 September 2017, from http://www.information-age.com/winding-road-gdpr-
compliance-123468132/
Khan, A. (2012). Access Control in Cloud Computing Environment. Retrieved 22 September
2017, from
https://pdfs.semanticscholar.org/ef20/bc1239539f9a8502715153c5af67fc9e9034.pdf
Nadeem, M. (2016). Cloud Computing: Security Issues and Challenges. Journal Of Wireless
Communications, 1(1). http://dx.doi.org/10.21174/jowc.v1i1.73
Shahid, M. (2015). Cloud Computing Security Models, Architectures, Issues and Challenges: A
Survey. The Smart Computing Review, 602-616.
http://dx.doi.org/10.6029/smartcr.2015.06.010
Simou, S. (2016). A survey on cloud forensics challenges and solutions. Security And
Communication Networks, 9(18), 6285-6314. http://dx.doi.org/10.1002/sec.1688
Singh, K. (2001). IT Infrastructure Security-Step by Step. Sans.org. Retrieved 20 September
2017, from https://www.sans.org/reading-room/whitepapers/basics/infrastructure-security-
step-step-430
Tari, Z., Yi, X., Premarathne, U., Bertok, P., & Khalil, I. (2015). Security and Privacy in Cloud
Computing: Vision, Trends, and Challenges. IEEE Cloud Computing, 2(2), 30-38.
http://dx.doi.org/10.1109/mcc.2015.45
10