Secutiry Implications of Cloud Computing Comments
SECURITY IMPLICATIONS OF CLOUD
Narendran Calluru Rajasekar
November 30th, 2009
Dr Chris Imafidon
(formerly Queen Mary University of
MSC Internet Systems Engineering
University of East London,
University of Oxford.
Table of Contents
2 Cloud Computing
2.2 Understanding Cloud Computing
3 Security Implications
3.1 Security Components
3.2 Security Threat
3.3 Authentication and Access
3.4 Data Security
3.5 Tempting Target for Cybercrime
3.6 Benefit to Risk Ratio
3.7 Legal Issues
5 Appendix - Glossary
This paper is focussed on the security implications
of cloud computing. Before analysing the security implications, the
definition of cloud computing and brief discussion to under cloud
computing is presented. The actual analysis of this paper focuses
on the basic security components of cloud computing and security
threats involved in various aspects of cloud computing.
There are many leading providers in the market like
Google, Amazon, Microsoft, HP and IBM. They provide different
services and call it with their own names. What exactly is cloud
computing? It isn't new; it already exists in different forms such
as Virtualisation, Software as a Service, Utility Computing etc.
The major aspect in cloud computing is that it is exploited based
on the pay per usage charging model.
Though cloud provides many benefits one of which is
moving the capital expense to operational expense, the security and
legal issues are very high and an organisation can decide to adopt
cloud only on based on benefits to risk ratio.
The security implications in cloud computing is
discussed in detail in this paper.
Keywords: Cloud Computing, Cloud Security, Cloud
Legal Issues, Security Implications
Cloud computing is an evolving technology and has
no concrete definition for it yet. The cloud service providers
provide different services based on different capabilities such as
SaaS (Software as a Service), PaaS (Platform as a Service), IaaS
(Infrastructure as a Service). After analysing definitions from 20
different authors, Vaquero, L., L. Rodero-Merino, et al. (2008)
proposed the following definition for cloud computing.
"Clouds are a large pool of easily usable and
accessible virtualized resources (such as hardware, development
platforms and/or services). These resources can be dynamically
reconfigured to adjust to a variable load (scale), allowing also
for an optimum resource utilization. This pool of resources is
typically exploited by a pay-per-use model in which guarantees are
offered by the Infrastructure Provider by means of customized
- Vaquero, L., L. Rodero-Merino, et al. (2008)
According to Dikaiakos, M., D. Katsaros, et al.
(2009), vision of 21st century is accessing Internet services from
light weight portable devices, instead of accessing it from a
traditional Desktop PC. Cloud computing is a technology which will
facilitate companies or organisation to host their services without
worrying about IT infrastructure and other supporting services.
The cloud concept draws on the existing
technologies which aren't new such as Centralised Computing,
Distributed Computing, Utility Computing, SaaS. It is new in the
way it integrates all the above and shifts them from a processing
unit to a network (Weiss, A., 2007).
The cloud computing facilitates a starting company
by moving Capital Expense to Operational Expense (Computing, D. and
M. Creeger, 2009). Amazon (EC2, S3), Microsoft Azure, IBM Blue
Cloud, HP Cloud Assure are some of the cloud computing services
available in the market Kaufman, L. M. (2009).
Organisations can decide upon their operating model
either by running their own private cloud or buy it from
3rd party service providers based on their requirements
(Grossman, R., 2009). The private cloud is similar to public cloud
but it has its own security and compliance needs hosted for and by
their own (Rash, W., 2009).
Cloud computing provides extensive computing power
for web services but is not mature enough to perform HPC (High
Performance Computing). Napper, J. and P. Bientinesi (2009)
experimentally shown that the execution speed per dollar spent
decreased exponentially with increase computing cores and hence the
cost of solving linear systems increased exponentially. Which means
cloud computing is in its evolving stage.
Sloan, K. (2009) has explored and demystified the
technologies involved in cloud computing in which he discusses
about the challenges posed in security of cloud computing.
According to him, security components could be added to the
security layer and be delivered as Security as a Service. Figure 1
shows the security architecture of cloud computing.
Figure 1: Cloud Computing Security Architecture
(Source: Sloan, K., 2009)
To ensure CIA (Confidentiality, Integrity and
Availability) of the information, the service provider should offer
tested encryption schema, stringent access controls and scheduled
data backups (Kaufman, L. M., 2009).
There are many clouds available in the market and
the enterprises will start using different clouds for different
operations. Eventually there will be a situation where the cloud
integration services would be required which again would require a
different approach of security implications (Kim, W., 2009). Also
there is no single regulatory organisation which regulates the
standards for cloud security. Organisation needs to check where the
assurance comes from? (Everett, C., 2009).
Although, the basic security components have been
identified, the security requirement varies with respect to the
domain and business needs. Cloud Security Alliance (2009, April)
has identified 15 different domains in cloud computing as shown in
the figure 2.
Figure 2: Different domains in cloud computing
security Source: Cloud Security Alliance (2009, April)
Since the area is vast and there is no standards
clearly defined, cloud security clearly lags and business needs to
understand the dangers and weigh them against the benefits (Greene,
For instance, the database service provided by
Amazon S3 doesn't support flexible authorisation and granular
security (Brantner, M., D. Florescu, et al., 2008).
To guarantee the privacy of information hosted on
servers in cloud, the information could be encrypted which can only
be decrypted at the client level with a key. Again this is only
reliable if the data can be quickly decrypted at the client level
as it might need high processing power. The multi-core processors
which are evolving will make this possible and provide greater
integration of information (Hewitt, C., 2008).
A researcher at IBM has cracked a problem with
"homomorphic encryption" which is believed boost cloud computing by
enabling service providers to analyse the data without actually
compromising them (Saran, C., 2009).
In reality, even the leading service providers
don't deliver high level of security. For instance, Google services
can be used using both http and https. Though by default the
service runs using https which is SSL encrypted, it sometime drops
back to http which in unencrypted. This will allow attackers to
monitor the network traffic and capture the credentials of a
specific user (news article: Computer Fraud & Security, 2009).
Also when uploading email attachments, Google doesn't use https by
default, although the settings could be change to use https always
(Herrick, D., 2009).
Providing security for cloud computing requires
more than authentication using passwords and confidentiality in
data transmission. Vieira, K., A. Schulter, et al. (2009) have
proposed a solution for intrusion detection in cloud computing. The
solution consists of two kinds of analysis behavioural analysis and
knowledge analysis. In behavioural analysis, the data mining
techniques were used to recognize expected behaviour or a sever
deviation of behaviour and in knowledge analysis security policy
violations and attack patterns were analysed to detect or prevent
Antivirus scanning can be done on the cloud to
reduce the risk of malicious activities. It is an expensive
operation and doing it once ahead of time for benefit of many could
be advantageous, and with the power of cloud more anti-virus
engines can be employed to make more efficient. The challenge here
is bridging the gap between the threat release and the virus
signature release (Walsh, P. J., 2009). Although antivirus scanning
is an expensive operation, it should be repeated with the release
of new virus signatures.
Firewalls could be implemented as a virtual machine
image running in its own processing compartment or at the hardware
level at each gateway in "out of band" firewall management channels
(Sloan, K., 2009).
The communication between cloud services and
consumers can be secured using SSL. Since the technology is too
familiar, users usually ignore the warning which can be exploited
by attackers. Google has demonstrated such type of exploitation in
cloud based services. On the other hand, a flaw in indexing system
design of Zoho has resulted in security vulnerability where one
user can read others documents. Also there are other XSS and CSRF
attacks which were successful on cloud which makes it vulnerable to
attacks (Mansfield-Devine, S., 2008).
In SaaS model, the developer should always assume
that intruders have full access to the client as anyone including
intruders can buy the software. Though they are not supplied with
source code, they still have access to binaries using which they
can exploit the vulnerabilities. Hence there should always be a
verification mechanism to verify client requests before execution
(Viega, J., 2009).
Authentication and Access
There are different authentication mechanisms for
different services. The most commonly used mechanisms are Open Id,
Open Auth, and User Request Token. The Open Id and Open Auth
mechanism is usually used in mobile devises where the
authentication information cannot be stored, or have it firewalled
as done in regular PC. Yahoo and Google use User Request Token
mechanism for authentication where as Amazon AWS uses a custom
mechanism which mirrors the Open Id and Open Auth mechanisms and in
addition to it, the calling program signs the outbound header
elements using HMAC-SHA1 algorithm (Christensen, J., 2009).
2FA (Two Factor Authentication) is one other
authentication mechanism which requires two identities or proof
which user knows (PIN or Password) / has (Hardware Token, Mobile
Phone, Smartcard). Though this mechanism is more secure than the
other type of authentication, handling tokens or smartcards could
be a burden to users. In this scenario, mobile phones or smart
phones can act as a proof if software which generates tokens
similar to hardware tokens is installed on it (Abraham, D.,
The organisations using cloud computing should
maintain their own data backups even if the providers backs up data
for the organisation. This will help continuous access to their
data even at the extreme situations such as data providers going
bankruptcy or disaster at data center etc (Viega, J., 2009).
Mowbray, M. and S. Pearson (2009) has proposed a
client based privacy manager to eliminate the fear of data leakage
and loss of privacy in cloud computing. In the paper, they have
presented a scenario of salesforce.com which can undergo a security
threat; theft of sales data and various ways that an intruder can
gain knowledge based on the un-encrypted data. The threats include
the collection of personal information and getting inappropriate
access to the information. Based on this scenario a set of
requirements was derived which include the minimization of personal
and sensitive data used in cloud and maximising security protection
of data. Finally the overall architecture for client-based privacy
data manager has been depicted.
On the other hand, Wang, C., Q. Wang, et al. (2009)
says that the model in which public verifiability is enforced can
be used where the third party auditor audits the data without
intervening with user's time to ensure the data security.
Target for Cybercrime
Internet is always a ground of attack for malicious
activities. The cloud computing offers a tempting target for
cybercrime for various reasons. To maintain data integrity, many
providers require 100% of customer's data to be placed in cloud
which means that if compromised 100% of data is available to
attackers. Leading providers such as Google and Amazon have
existing infrastructure to deflect cyber attacks, but this might
not be the case with all providers. The cloud architecture is such
that it has interlinks with multiple entities and compromise with
any one of the weakest links would compromise all the linked
entities (Kaufman, L. M., 2009).
The cloud community watching services analyses the
cloud activities constantly to detect and prevent newly injected
viruses and malicious activities. Active participation of many
organisations in this community will help them to curb the
malicious activities more effectively (Hawthorn, N., 2009).
3.6 Benefit to
Viega, J. (2009) presents a scenario of software
industry where developers would not have much control over IT
Infrastructure. In this scenario, IaaS would be beneficial where
the communication between the cloud and local machine is encrypted
so that man in middle cannot intercept the traffic. This would be a
huge cost saving for the company.
As discussed in section
3.2, in SaaS model the attackers have very less information
i.e., the binaries of the software which is quite justifiable to
have modest application security program. The cost-effective
reality for many organisations is to hire someone to do cheap
security testing and skip the cost of training developers on
security best practices and review their work (Viega, J.,
IT industry's recent focus is on cloud computing
due to the 'credit crunch' and a global recession. The key legal
issues in cloud with respect to sourcing arrangements are DPA (Data
Protection Act 1998), duties of confidentiality and database right.
For instance, in the method of storing large volume of data in
cloud, the servers could spread across the world. It is debatable
whether the informed consent can actually be given in this vague
situation. Similarly there are intricacies over confidentiality and
database rights as well (Joint, A., E. Baker, et al., 2009).
It is perfectly possible to use cloud-computing in
UK in a legal compliant and low risk manner. This would require
alteration in operating model which could erode the benefits of
cloud computing if not considered in early stages and if
contractual or operational management is not properly adopted,
there could be significant increase of operational risk (Joint, A.,
E. Baker, et al., 2009).
A news article published by Computer Fraud &
Security (August, 2009) indicates that the data might be subject to
search and seizure by government agencies if not specific contracts
are made between the service providers. When Google was asked how
this situation would be handled, they said that their customers
would be notified about any legal order it receives. Hence it is up
to the customers to get specific agreements from the service
The definition of cloud computing is emerging as
the various organisations that are developing cloud services are
evolving. It is evident that the cloud computing by itself is in
evolving stage and hence the security implications in it aren't
complete. Even the leading cloud computing providers such as
Amazon, Google etc are facing many security issues and are yet to
stabilise. Achieving complete solution for legal issues is still a
question. With this level of issues in cloud computing, decision to
adopt cloud computing in an organisation could be made only based
on the benefits to risk ratio.
There is a general assumption at the basic level of
all security mechanisms that brute force attack would take
considerable time to break it. Considering the power of cloud
computing with distributed technology can bring to the computing
power, breaking the keys used currently is not far from now! This
is a flaw in the low level assumption which could collapse entire
security of cloud.
5 Appendix -
||Two Factor Authentication
||Confidentiality, Integrity and Availability
||Cross Site Request Forgery
||Data Protection Act 1998
||Hash based Message Authentication Code
||High Performance Computing
||Hyper Text Transfer Protocol
||Secure Hyper Text Transfer Protocol
||Infrastructure as a Service
||Platform as a Service
||Software as a Service
||Secure Hash Algorithm
||Secure Socket Layer
||Cross Site Scripting
 Kaufman, L. M. (2009)."Data
Security in the World of Cloud Computing." IEEE Security andPrivacy
 Kim, W. (2009). "Cloud
Computing: Today and Tomorrow."Journal of object technology 8(1):
 Grossman, R. (2009). "The Case
for Cloud Computing." ITPROFESSIONAL 11(2): 23-27.
 Rash, W. (2009). Is cloud
computing secure? Prove it. tech in-depth,eWeek. 2009: 8-10.
 Computing, D. and M. Creeger
(2009). "Cloud Computing: AnOverview." Distributed Computing
 Weiss, A. (2007). "Computing in
the clouds." COMPUTING 16.
 Saran, C. (2009). Cryptography
breakthrough could secure cloudservices. Computer Weekly. 2009:
 Hawthorn, N. (2009). "Finding
security in the cloud."Computer Fraud & Security 2009(10):
 Everett, C. (2009). "Cloud
computing - A question oftrust." Computer Fraud & Security
 (2009). "Data in the cloud
might be seized by governmentagencies without you knowing."
Computer Fraud & Security 2009(8): 1.
 (2009). "Industry to Google:
encrypt your cloud." ComputerFraud & Security 2009(6):
 Hewitt, C. (2008). "ORGsfor
scalable, robust, privacy-friendly client cloud computing."
IEEEInternet Computing 12(5): 96-99.
 Viega, J. (2009). "Cloud
Computing and the Common Man."Computer 42(8): 106-108.
 Vaquero, L., L. Rodero-Merino,
et al. (2008). "A break in theclouds: towards a cloud definition."
ACM SIGCOMM Computer CommunicationReview 39(1): 50-55.
 Wang, C., Q. Wang, et al.
(2009). Ensuring data storage security incloud computing.
 Vieira, K., A. Schulter, et al.
(2009). "Intrusion DetectionTechniques in Grid and Cloud Computing
 Napper, J. and P. Bientinesi
(2009). Can cloud computing reach thetop500?, ACM New York, NY,
 Mowbray, M. and S. Pearson
(2009). A client-based privacy managerfor cloud computing, ACM.
 Herrick, D. (2009). Google
this!: using Google apps forcollaboration and productivity,
 de Assunao, M., A. di Costanzo,
et al. (2009). Evaluating thecost-benefit of using cloud computing
to extend the capacity of clusters, ACMNew York, NY, USA.
 Cloud_Security_Alliance (2009,
April). "Security Guidance forCritical Areas of Focus in Cloud
Computing." Retrieved Nov 25, 2009, from http://www.cloudsecurityalliance.org/guidance/csaguide.pdf
 Christensen, J. (2009). Using
RESTful web-services and cloud computingto create next generation
mobile applications, ACM.
 Dikaiakos, M., D. Katsaros,
etal. (2009). "Cloud Computing: Distributed Internet Computing for
IT andScientific Research." IEEE Internet Computing 13(5):
 Brantner, M., D. Florescu, et
al. (2008). Building a database on S3,ACM.
 Greene, T. (2009).
"Cloudsecurity fears cast shadow at RSA." Network World 26(16).
 Joint, A., E. Baker, et
al.(2009). "Hey, you, get off of that cloud?" Computer Law and
SecurityReview: The International Journal of Technology and
Practice 25(3): 270-274.
 Walsh, P. J. (2009).
"Thebrightening future of cloud security." Network Security
 Sloan, K. (2009)."Security in a
virtualised world." Network Security 2009(8): 15-18.
 Mansfield-Devine, S.
(2008)."Danger in the clouds." Network Security 2008(12): 9-11.
 Abraham, D. (2009). "Why2FA in
the cloud?" Network Security 2009(9): 4-5.