1 of 15

CLOUD SECURITY ISSUES & CHALLENGES – PUBLIC CLOUD

By: Dr. Mohammad Shoab

2 of 15

WHAT IS PUBLIC CLOUD?

3 of 15

CLOUD ARCHITECTURE

4 of 15

WHO OFFERS CLOUD SERVICES?

5 of 15

HYPOTHESIS

  • public cloud could pose a huge potential security risk for the general public.

6 of 15

IMPORTANCE – PUBLIC CLOUD

  • Provides huge benefit for the general public.
  • Reduced excessive high cost of running, purchasing and maintenance by companies.
  • Pay-per-use model at a very low cost.
  • IaaS, PaaS and SaaS are provisioned from a pooled of shared resources that are accessible over the internet.

7 of 15

POTENTIAL REVIEW OF SECURITY THREATS & CHALLENGES

  • A thematic review on the security issues and privacy in the public cloud.

8 of 15

ISSUES HIGHLIGHTED

  • Security & Privacy
  • Infrastructure & Data Management
  • Interoperability across different service providers.

Ghanam, Y., Ferreira, J., & Maurer, F. (2012)

9 of 15

PRIVACY CONCERNS

  • Security standards in SLA
  • Access controls – accounts/services in cloud
  • Extensive use of virtualization – brings security concerns to tenants

Ouahman, A. A. (2014)

10 of 15

CHALLENGES

  • Outsourcing – tenants no longer retain physical control on hardware, software and data.
  • Multi-tenancy – A shared physical machine that holds different tenants data. Therefore exploitation can occur.
  • Massive data & intensive computation – traditional security mechanism may not suffice the new security requirements. That is due unbearable computation/communications overhead.

Mosca, P., Zhang, Y., Xiao, Z., & Wang, Y. (2014)

11 of 15

SECURITY CONCERNS

  • Cloud availability – under investigated
  • CIA (Confidentiality, Integrity & Accessibility) – the CIA triad has not yet been formally adapted to the cloud

Khansa, L., & Zobel, C. W. (2014)

12 of 15

LEGAL ISSUES

  • Lack of uniformity – in the terms and the provider contracts and SLA (Service level Agreement)
  • Information Policies (Private Industries) – governments have not provided a uniform & homogenous information policy regime where private industries are given clear guidance as to multi-jurisdictional risk, cyber terrorism risk, outage risk.

Teng, K. (2012)

13 of 15

SECURITY MEASURES

  • Malware detection & prevention
  • Secure virtual machine managers
  • Cloud resilience – the ability for the system to recover & continue to provide services after a loss of software and hardware occurs.

Denz and Taylor. (2013)

14 of 15

TAKE - AWAY

  • As presented by the different reviews, there exist multiple challenges and issues regarding cloud. However, it is up to the cloud service provider to pick from a grab back of techniques to secure their infrastructure. It can also be deduced that some issues and challenges that practitioners consider important need further studies and research.
  • In future, as a cloud service consumer it is advisable to conduct a thorough & diligent risk assessment of the potential threats of low to high risk inherent in the cloud.

15 of 15

Thank You