Cloud Computing Security:

 Cloud computing security refers to the set of procedures, processes and

standards designed to provide information security assurance in a cloud
computing environment.
 Cloud computing security addresses both physical and logical security issues
across all the different service models of software, platform and
infrastructure. It also addresses how these services are delivered (public,
private or hybrid delivery model).
 Cloud security encompasses a broad range of security constraints from an
end-user and cloud provider's perspective, where the end-user will primarily
will be concerned with the provider's security policy, how and where their
data is stored and who has access to that data. For a cloud provider, on the
other hand, cloud computer security issues can range from the physical
security of the infrastructure and the access control mechanism of cloud
assets, to the execution and maintenance of security policy. Cloud security is
important because it is probably the biggest reason why organizations fear
the cloud.
 The Cloud Security Alliance (CSA), a nonprofit organization of industry
specialists, has developed a pool of guidelines and frameworks for
implementing and enforcing security within a cloud operating environment.
 Security in cloud computing is a major concern. Data in cloud should be
stored in encrypted form.
 Cloud computing security, or more simply, cloud security refers to a broad set
of policies, technologies and controls deployed to protect data, applications,
and the associated infrastructure of cloud computing .it is a sub-domain of
computer security, network, and more broadly, information security.
 In cloud computing there have a data center where clients data stored ,and
that data have a backup also, so in case if there any earthquake or natural
disasters than clients data are stored in other data center.
 If one data center in India than another backup data center in USA.

Security associated with the Cloud

 Security concerns associated with cloud computing fall into two broad
categories: Security issues faced by cloud providers (organizations providing
software, platform, or infrastructure as a service via the cloud) and security
issues faced by their customers (companies or organizations who host
applications or store data on the cloud).the responsibility is shared ,however
.The provider must ensure that their infrastructure is secure and that their
clients data and applications are protected ,while the user must take measure
 to fortify their application and use strong passwords and authentication
measures.
 Encryption helps to protect data from being compromised .it protect data that
is being transferred a well as data stored in the cloud. Although encryption
helps to protect data from any unauthorized access, it does not prevent data
loss.
Since all the data is transferred using internet, data security is of major concern in
the cloud. Here are key mechanisms for protecting data.
 Access control:
Access control methods ensure that authorized user’s access the data and the
system.
 Auditing:
In cloud computing auditing is done automatically.
 Authentication:
Cloud computing is changing the way we interact with devices software, data
and processes. Identity management and authentication form the basis for
security whether in the cloud or on the local network.

TOP security concerns for Cloud-based Services

 Data Breach
 Hijacking of accounts
 Insider Threat
 Malware Injection
 Insecure APIs
 Denial of Service Attacks
 Data Loss
 Abuse of Cloud Service

Security Issues
 Location:
Where the data is actually stored
 Data Segregation: how vendors keep a certain degree of separation between
one customers data and another.
Encryption (also known as encoding, or converting data or information into
code).
 Recoverability: how quickly and effectively can a user’s information be
recovered after a large disaster.
 Long term Viability:
What will happen to user information should a vendor go out of business or
be acquired by another larger company.
  Hacking:
This is the most daunting issue for most users, what if someone hack into my
information and shares it with the world?

Hacking into the Cloud

 Attacks on high profile companies such as citigroup Inc., Sony corp. and even
Apple.
 The case of mat Honan
 Steps that users can take to keep their data safe:
 Back-up everything
 Passwords protection
 Do not link accounts together
 Optimize the use of “two-factor authentication” used by both Google
and face book.

How the Government is protecting users of the cloud

 September 2009-the federal cloud computing initiative
 1986 two primary uses of computer network:
 ECS-electronic communication services
 RCS-Remote computing services
 The national initiative of standards and technology (NIST)
 NICE-The national initiative for Cyber security Education

Cloud Security (Top Five Security Concerns)

When evaluating potential providers of cloud-based services, you should keep
these top five security concerns in mind.

1. Secure data transfer:

All of the traffic travelling between your network and whatever service you’re
accessing in the cloud must traverse the Internet. Make sure your data is always
travelling on a secure channel; only connect your browser to the provider via a
URL that begins with ”https.” Also, your data should always be encrypted and
authenticated using industry standard protocols, such as IPsec (Internet Protocol
Security), that have been developed specifically for protecting Internet traffic.

2. Secure software interfaces:

The Cloud Security Alliance (CSA) recommends that you be aware of the
software interfaces, or APIs, that are used to interact with cloud services.
”Reliance on a weak set of interfaces and APIs exposes organizations to a variety
of security issues related to confidentiality, integrity, availability, and
accountability,” says the group in its Top Threats to Cloud Computing
document. CSA recommends learning how any cloud provider you’re considering
integrates security throughout its service, from authentication and access control
techniques to activity monitoring policies.

3. Secure stored data:

Your data should be securely encrypted when it’s on the provider’s servers and
while it’s in use by the cloud service. In Q&A: Demystifying Cloud Security,
Forrester warns that few cloud providers assure protection for data being used
within the application or for disposing of your data. Ask potential cloud
providers how they secure your data not only when it’s in transit but also when
it’s on their servers and accessed by the cloud-based applications. Find out, too, if
the providers securely dispose of your data, for example, by deleting the
encryption key.

4. User access control:

Data stored on a cloud provider’s server can potentially be accessed by an
employee of that company, and you have none of the usual personnel controls
over those people. First, consider carefully the sensitivity of the data you’re
allowing out into the cloud. Second, follow research firm Gartner’s suggestion
to ask providers for specifics about the people who manage your data and the
level of access they have to it.

5. Data separation:
Every cloud-based service shares resources, namely space on the provider’s
servers and other parts of the provider’s infrastructure. Hypervisor software is
used to create virtual containers on the provider’s hardware for each of its
customers. But CSA notes that ”attacks have surfaced in recent years that target
the shared technology inside Cloud Computing environments.” So, investigate
the compartmentalization techniques, such as data encryption, the provider uses
to prevent access into your virtual container by other customers.
Although you should address these security issues with the cloud provider
before you entrust your data to its servers and applications, they shouldn’t be a
deal breaker. Cloud computing offers small businesses too many benefits to
dismiss out of hand. After all, you already met many of these security challenges
the first time you connected your network to the Internet.