UNIT-5

BCA613: Cloud Computing

Securing the Cloud: Cloud Information security fundamentals, Cloud security
services, Design principles, Policy Implementation, Cloud Computing Security
Challenges, Cloud Computing Security Architecture. Legal issues in cloud
Computing. Data Security in Cloud: Business Continuity and Disaster Recovery, Risk
Mitigation, Understanding and Identification of Threats in Cloud, Trust
Management.

Cloud Security: -
Cloud security refers to protecting data stored online via cloud computing environments (instead of data
centers) from theft, deletion, and leakage. There are many protective methods that help secure the
cloud; these measures include access control, firewalls, penetration testing, obfuscation, tokenization,
virtual private networks (VPN), and not using public internet connections.

Cloud Information security fundamentals: -

1. Understand what you’re responsible for – different cloud services require varying levels of
responsibility. For instance, while software-as-a-service (SaaS) providers ensure that applications are
protected and that data security is guaranteed, IaaS environments may not have the same controls. To
ensure security, cloud customers need to double check with their IaaS providers to understand who’s in
charge of each security control.
2. Control user access – a huge challenge for enterprises has been controlling who has access to their
cloud services. Too often, organizations accidently publicly expose their cloud storage service despite
warnings from cloud providers to avoid allowing storage drive contents to be accessible to anyone with
an internet connection.
3. Data protection – data stored on cloud infrastructures should never be unencrypted. Therefore,
maintain control of encryption keys where possible. Even though you can hand the keys over to cloud
service providers, it is still your responsibility to protect your data. By encrypting your data, you ensure
that if a security configuration fails and exposes your data to an unauthorized party, it cannot be used.
4. Secure credentials – AWS access keys can be exposed on public websites, source code repositories,
unprotected Kubernetes dashboards, and other such platforms. Therefore, you should create and
regularly rotate keys for each external service while also restricting access on the basis of IAM roles.
Never use root user accounts – these accounts should only be used for specific account and service
management tasks. Further, disable any user accounts that aren’t being used to further limit potential
paths that hackers can compromise.
5. Implement MFA – your security controls should be so rigorous that if one control fails, other
features keep the application, network, and data in the cloud safe. By tying MFA (multi-factor
authentication) to usernames and passwords, attackers have an even harder time breaking in. Use MFA
to limit access to management consoles, dashboards, and privileged accounts.
6. Increase visibility – to see issues like unauthorized access attempts, turn on security logging and
monitoring once your cloud has been set up. Major cloud providers supply some level of logging tools
that can be used for change tracking, resource management, security analysis, and compliance audits.
7. Adopt a shift–left approach – with a shift-left approach, security considerations are incorporated
early into the development process rather than at the final stage. Before an IaaS platform goes live,
enterprises need to check all the code going into the platform while also auditing and catching potential
misconfigurations before they happen. One tip – automate the auditing and correction process by
choosing security solutions that integrate with Jenkins, Kubernetes, and others. Just remember to check
that workloads are compliant before they’re put into production. Continuously monitoring your cloud
environment is key here.

Cloud Security Design principles: -

• Implement a strong identity foundation: Implement the principle of least privilege and enforce
separation of duties with appropriate authorization for each interaction with your AWS resources.
Centralize identity management and aim to eliminate reliance on long-term static credentials.
• Enable traceability: Monitor, alert, and audit actions and changes to your environment in real
time. Integrate log and metric collection with systems to automatically investigate and take
action.
• Apply security at all layers: Apply a defense in depth approach with multiple security controls.
Apply to all layers (for example, edge of network, VPC, load balancing, every instance and
compute service, operating system, application, and code).
• Automate security best practices: Automated software-based security mechanisms improve
your ability to securely scale more rapidly and cost-effectively. Create secure architectures,
including the implementation of controls that are defined and managed as code in version-
controlled templates.
• Protect data in transit and at rest: Classify your data into sensitivity levels and use mechanisms,
such as encryption, tokenization, and access control where appropriate.
• Keep people away from data: Use mechanisms and tools to reduce or eliminate the need for
direct access or manual processing of data. This reduces the risk of mishandling or modification
and human error when handling sensitive data.
• Prepare for security events: Prepare for an incident by having incident management and
investigation policy and processes that align to your organizational requirements. Run incident
 response simulations and use tools with automation to increase your speed for detection,
investigation, and recovery.
Policy Implementation In Cloud Computing: -
1. Secure cloud accounts and create groups
Ensure that the root account is secure. To make daily administration easier and still adhere to cloud
security policies, create an administrative group and assign rights to that group, rather than the
individual.
2. Check for free security upgrades
Every major cloud provider allows and encourages the use of two-factor authentication (2FA). There is
no reason not to have 2FA on your cloud security checklist for new deployments, as it increases
protection from malicious login attempts.
3. Restrict infrastructure access via firewalls
A lot of companies use web scale external-facing infrastructure when they adopt cloud. They can quickly
protect private servers from external access.
4. Tether the cloud: -
Some cloud-based workloads only service clients or customers in one geographic region. For these jobs,
add an access restriction to the cloud security checklist: Keep access only within that region or even
better, limited to specific IP addresses. This simple administrator decision slashes exposure to
opportunistic hackers, worms and other external threats.
5. Replace passwords with keys
Passwords are a liability: cumbersome, insecure and easy to forget. Every seasoned administrator knows
that Monday morning user-has-forgotten-password scenario.
Make public key infrastructure (PKI) part of your cloud security policies. PKI relies on a public and private
key to verify the identity of a user before exchanging data.
6. Turn on auditing and system monitoring
A lot of administrators don't think about monitoring until it's too late. Systems create logs in huge
amounts. Use tools that capture, scan and process these logs into something useful for cloud capacity
planning, audits, troubleshooting and other operations.

Cloud Computing Security Challenges: -

Top 7 Advanced Cloud Security Challenges
It becomes more challenging when adopting modern cloud approaches Like: automated cloud
integration, and continuous deployment (CI/CD) methods, distributed serverless architecture, and
short-term assets for tasks such as a service and container.
Some of the advanced cloud-native security challenge and many layers of risk faced by today's cloud-
oriented organizations are below:
1. Enlarged Surface
Public cloud environments have become a large and highly attractive surface for hackers and disrupt
workloads and data in the cloud. Malware, zero-day, account acquisition and many malicious threats
have become day-to-day more dangerous.
2. Lack of visibility and tracking
Cloud providers have complete control over the infrastructure layer and cannot expose it to their
customers in the IaaS model. The lack of visibility and control is further enhanced in the SaaS cloud
models. Cloud customers are often unable to identify their cloud assets or visualize their cloud
environments effectively.
3. Ever-changing workload
Cloud assets are dynamically demoted at scale and velocity. Traditional security tools implement
protection policies in a flexible and dynamic environment with an ever-changing and short-term
workload.
4. DevOps, Develops and Automation
Organizations are adopting an automated DevOps CI/CD culture that ensures the appropriate security
controls are identified and embedded in the development cycle in code and templates. Security-related
changes implemented after the workload is deployed to production can weaken the organization's
security posture and lengthen the time to market.
5. Granular privileges and critical management
At the application level, configured keys and privileges expose the session to security risks. Often cloud
user roles are loosely configured, providing broad privileges beyond the requirement. An example is
allowing untrained users or users to delete or write databases with no business to delete or add database
assets.
6. Complex environment
These days the methods and tools work seamlessly on public cloud providers, private cloud providers,
and on-premises manage persistent security in hybrid and multi-cloud environments-it including
geographic Branch office edge security for formally distributed organizations.
7. Cloud Compliance and Governance
All the leading cloud providers have known themselves best, such as PCI 3.2, NIST 800-53,
HIPAA and GDPR.
It gives the poor visibility and dynamics of cloud environments. The compliance audit process becomes
close to mission impossible unless the devices are used to receive compliance checks and issue real-time
alerts.

Cloud Computing Security Architecture: -

The difference between "cloud security" and "cloud security architecture" is that the former is built from
problem-specific measures while the latter is built from threats. A cloud security architecture can reduce
or eliminate the holes in Security that point-of-solution approaches are almost certainly about to leave.
The cloud security architecture also organizes security measures, making them more consistent and
easier to implement, particularly during cloud deployments and redeployments. Security is often
destroyed because it is illogical or complex, and these flaws can be identified with the proper cloud
security architecture.
Understanding Security of Cloud
Security Boundaries
The Cloud Security Alliance (CSA) stack model defines the boundaries between each service model and
shows how different functional units relate. A particular service model defines the boundary between
the service provider's responsibilities and the customer. The following diagram shows the CSA stack
model:

Key Points to CSA Model

o IaaS is the most basic level of service, with PaaS and SaaS next two above levels of services.
o Moving upwards, each service inherits the capabilities and security concerns of the model
beneath.
o IaaS provides the infrastructure, PaaS provides the platform development environment, and SaaS
provides the operating environment.
o IaaS has the lowest integrated functionality and security level, while SaaS has the highest.
o This model describes the security boundaries at which cloud service providers' responsibilities
end and customers' responsibilities begin.
o Any protection mechanism below the security limit must be built into the system and maintained
by the customer.

Cloud security architecture and shared responsibility model: -

The security and security architectures for the cloud are not single-player processes. Most enterprises
will keep a large portion of their IT workflow within their data centers, local networks, and VPNs. The
cloud adds additional players, so the cloud security architecture should be part of a broader shared
responsibility model.
A shared responsibility model is an architecture diagram and a contract form. It exists formally between
a cloud user and each cloud provider and network service provider if they are contracted separately.
Each will divide the components of a cloud application into layers, with the top layer being the
responsibility of the customer and the lower layer being the responsibility of the cloud provider. Each
separate function or component of the application is mapped to the appropriate layer depending on
who provides it. The contract form then describes how each party responds

Legal issues in cloud Computing: -

Data Protection
Data protection is one of the most critical legal issues you must consider when using the cloud for your
operations. It is especially important if your business includes handling the personal data of individuals
in any form. There are data protection regulations with strict provisions on how you handle the personal
data of individuals.
Data Privacy and Security
Another essential legal issue in cloud computing that you should pay attention to is data privacy and
security. If a third party receives unauthorized access to private information about your clients, it can
damage your company’s reputation. Your business risks losing sensitive and corporate confidential
information in the case of a security breach. You may also have to compensate your customer for
violating their data privacy, which would cost your business a lot.
Data Ownership (Intellectual Property Rights)
It is safe to assume that you own all the rights to data sent to the cloud by your company. However, it is
advisable that your Service Level Agreement (SLA) with the CSP expressly indicates that your company
has full rights to the data stored in the cloud and can retrieve it whenever you want. It is also essential
to have these provisions in place, especially concerning data generated inside the cloud. The CSP may
want to claim newly generated data because it was generated in the cloud through a data analytics
solution.
Jurisdiction Issues
The issue of differences in laws applicable across different jurisdictions is one of the legal issues in cloud
computing. For instance, the government can require CSPs to disclose client data in some jurisdictions.
However, in some other jurisdictions, there is express protection for data stored in the cloud, and in
those jurisdictions, governments cannot access it without following due process.

Business Continuity and Disaster Recovery : -

Data protection and business continuity offerings were once only financially accessible to large
companies that could afford to construct a secondary data center. However, the public cloud and cloud
hosting providers have made business continuity and disaster recovery services available to the masses.

Benefits of cloud business continuity: -

There are numerous benefits to using the cloud for business continuity (BC). The most obvious is that
on-premises workloads can be configured to fail over to the cloud, substantially reducing an
organization's downtime. This enables mission-critical applications to run even if the organization
experiences data center issues.
The cloud also simplifies disaster recovery (DR) planning. On-premises continuous data protection
offerings can often be configured to write a backup copy to the cloud. This ensures that critical data is
replicated to an off-site location where it's protected against disasters that might affect the data center.
An organization could also use a cloud-based disaster recovery service, which can be a less expensive
and simpler alternative to a custom cloud-based DR offering.

Disaster recovery as a service (DRaaS) is a cloud computing service model that allows an organization
to back up its data and IT infrastructure in a third party cloud computing environment and provide all
the DR orchestration, all through a SaaS solution, to regain access and functionality to IT infrastructure
after a disaster.

Cloud Business Continuity: -

Cost. Although the public cloud was once known as an inexpensive alternative to on-premises
operations, those savings have become more difficult to realize in recent years. As such, it's important
to know how much your BC plan will cost.
Hardware and software compatibility. Some applications won't work in the cloud, while others will
function in the cloud but are too costly to run in that environment.
Cloud provider's reputation and what they're doing to ensure business continuity. You shouldn't trust
your mission-critical workloads to a provider with a reputation for periodic outages or one that could go
out of business next week. A reputable provider should offer a service-level agreement that guarantees
a minimal level of service.
Data ownership. Your provider should be transparent about where your data will be stored, and the
terms of service should ensure you retain ownership of your own data.
The cost of getting your data out of the cloud. Most cloud providers charge a data egress fee for any
data moved off the cloud. This includes data that is migrated to an organization's own data center or to
another cloud. These fees can be quite substantial, so it's important to know how much it will cost to
move your data elsewhere. Even if you don't plan to take your data out of the cloud, there are certain
backup and recovery operations that can trigger data egress fees. Ensure you're aware of when such
fees can be incurred.
Who is responsible for backing up data and what methods will be used? Most cloud providers have
adopted a shared responsibility model in which the provider is responsible for maintaining the
underlying infrastructure, and subscribers are responsible for backing up and protecting their own data.
Cost and availability of support within the cloud. It's important to verify that help will be available in
times of crisis, and what that support might cost.
Security. Check to see if your cloud-based BC plan will undermine security. This is especially true in
regulated industries where penalties can be incurred for breaches or violating security best practices.
Risk Mitigation: -
Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.
Comparable to risk reduction, risk mitigation takes steps to reduce the negative effects of threats and
disasters on business continuity (BC). Threats that might put a business at risk include cyberattacks,
weather events and other causes of physical or virtual damage. Risk mitigation is one element of risk
management and its implementation will differ by organization
There are five general steps in the design process of a risk mitigation plan:
1. Identify all possible events in which risk is presented. A risk mitigation strategy takes into
account not only the priorities and protection of mission-critical data of each organization, but
any risks that might arise due to the nature of the field or geographic location. A risk mitigation
strategy must also factor in an organization's employees and their needs.
2. Perform a risk assessment, which involves quantifying the level of risk in the events identified.
Risk assessments involve measures, processes and controls to reduce the impact of risk.
3. Prioritize risks, which involves ranking quantified risk in terms of severity. One aspect of risk
mitigation is prioritization -- accepting an amount of risk in one part of the organization to better
protect another. By establishing an acceptable level of risk for different areas, an organization
can better prepare the resources needed for BC, while putting fewer mission-critical business
functions on the back burner.
4. Track risks, which involves monitoring risks as they change in severity or relevance to the
organization. It's important to have strong metrics for tracking risk as it evolves, and for tracking
the plan's ability to meet compliance requirements.
5. Implement and monitor progress, which involves reevaluating the plan's effectiveness in
identifying risk and improving as needed. In business continuity planning, testing a plan is vital.
Risk mitigation is no different. Once a plan is in place, regular testing and analysis should occur
to make sure the plan is up to date and functioning well. Risks facing data centers are constantly
evolving, so risk mitigation plans should reflect any changes in risk or shifting priorities.

Common Cloud Security Threats: -

Cloud services have transformed the way businesses store data and host applications while introducing
new security challenges.
 1. Identity, authentication and access management – This includes the failure to use multi-factor
authentication, misconfigured access points, weak passwords, lack of scalable identity
management systems, and a lack of ongoing automated rotation of cryptographic keys,
passwords and certificates.
2. Vulnerable public APIs – From authentication and access control to encryption and activity
monitoring, application programming interfaces must be designed to protect against both
accidental and malicious attempts to access sensitive data.
3. Account takeover – Attackers may try to eavesdrop on user activities and transactions,
manipulate data, return falsified information and redirect users to illegitimate sites.
4. Malicious insiders – A current or former employee or contractor with authorized access to an
organization’s network, systems or data may intentionally misuse the access in a manner that
leads to a data breach or affects the availability of the organization’s information systems.
5. Data sharing – Many cloud services are designed to make data sharing easy across organizations,
increasing the attack surface area for hackers who now have more targets available to access
critical data.
6. Denial-of-service attacks – The disruption of cloud infrastructure can affect multiple
organizations simultaneously and allow hackers to harm businesses without gaining access to
their cloud services accounts or internal network.
Cloud Attack Lifecycle
Attackers have two avenues of attack to compromise cloud resources:
1. The first is through traditional means, which involves accessing systems inside the enterprise
network perimeter, followed by reconnaissance and privilege escalation to an administrative
account that has access to cloud resources.
2. The second involves bypassing all the above by simply compromising credentials from an
administrator account that has administrative capabilities or has cloud services provider (CSP)
administrative access.
When a main administrative account is compromised, it is far more detrimental to the security of the
cloud network. With access to an administrative account, the attacker does not need to escalate
privileges or maintain access to the enterprise network because the main administrative account can do
all that and more.
This poses the question: How can the organization properly monitor misuse of CSP administrative
privileges?
It is no longer enough to identify a suspicious login attempt to protect your cloud network. Modern day,
sophisticated hackers are able to access an account through social engineering exploits, such as phishing.
It is now essential to monitor the behavior of accounts that are already logged into and detect any
suspicious activity.

Trust Management in Cloud Computing: -