Security of cloud computing

?Introduction

Over the years, desire for enhanced performance in computing in terms of speed, storage capacity, scalability, intelligent systems, has been a driving force behind Technology innovations. The progressive development of technologies ranging from distributive, Utility, Grid, Autonomic Computing, and of recent Cloud Computing are evidence of this assertion. Distributive Computing refers to the means by which a single computer program runs on multiple computers simultaneously. Utility Computing on the one hand, provides on-demand infrastructure with the ability to control, scale, and configure that infrastructure.

Grid computing on the other hand enables the sharing, selection, and aggregation of geographically distributed resources including super computers, storage systems, data sources, and specialised devices owned by multiple organisation for solving large scale problems.[18][Buyya R. etal 2008]

Finally Autonomic Computing seeks to provide software products that do not require human intervention. It is a method of enabling electronic systems to self-manage by responding to problems, recover from outages and repair faults on their own. [16p.185][Sterritt R. 2005] Generally, it is evident from above that these platforms operate on similar concept or principle, However, the difference if any is often associated with the aforementioned performance, and support needs in keeping with their independent market orientation

Cloud computing, which is the focus of this article, is where users are provided with services without knowledge, expertise, or control over the technology infrastructure that supports them.[1] Barry, 2008) [1] In this way, Customers or users access services based on their requirement or demand without regard to where the services are being hosted or delivered. It is simply a mixture of grid computing and utility computing, both of which have existed for decades. In other words, Cloud Services is where Customer IT services is outsourced to independent third parties as opposed to individual computer or commercial servers. [5] Cloud computing therefore combines existing technology concepts into a hybrid utility Service oriented architecture (SOA) and certainly not a new concept neither a technological revolution.

In cloud, physical Infrastrure, application and storage are taken away from consumers and access as Services on virtual machines (VM) such as Infrastructure as a Service [IaaS}, Platform as a Service [PaaS], and Software as a service [SaaS] and the Service Level Agreement (SLA) managed through Autonomic Computing.

Given its agility and reduce cost factor attached to these services, Commercial Enterprises are inevitably being attracted by the offerings. Security concerns with the cloud model have gain currency. Cynics such as Ellison and Stallman, have all expressed their reservation on Cloud campaign describing it as a ?marketing hype' or ?a trap aimed at forcing more people to buy into lock, proprietary system that would ultimately cost more and more'. (Ellison 2008; Stallman 2008) By the very nature of Cloud infrastructure deployment and services, Enterprises have no control and ownership over their data assets contrary to their traditional method.

This raises security questions as to what Confidentiality, Integrity and availability mechanisms are in Cloud Computing Services. (Gartner,2008) outlines seven security concerns that could apply to any outsource cloud services - Privileged user access, regulatory compliance, data Location, data segregation, recovery, investigative support, and long term viability.

This paper discusses Security issues in Cloud Computing; structured as follows. Section 2 Introduces the Cloud formations and Services. Section 3 explains the associated Risks in cloud. Section 4 underscores Security mechanism to mitigate the risks. Section 5 describes Data Recovery mechanism and Finally Section 6 draws conclusion.

?Cloud Formations & Services

To better conceptualise how Cloud Computing model impacts on security architecture, it would require an understanding of the different cloud formations and how cloud outsourcing is delivered. Cloud providers such as Amazon, Microsoft, Dell, IBM, Google and Yahoo are making offering of services to clients on their infrastructure, deployed and managed differently. Cloud Services are deployed in different formations. Jericho Forum presented eight formations in cloud environment; (i.e Internal, External, Proprietary, Open, Proprietary Internal and External, open Internal and External, Parameterised and De-parameterised).[JerichoForum, 2009 p.3] All these formations have their benefits as well as associated risks. They can also be in-sourced (internal) or outsourced (external).

However, three types of Cloud outsourcing exists; Cloud Infrastructure as a service, cloud platform as a Service and Cloud software as a Service. [19p.270](Joint A. etal 2009) In Cloud infrastructure/Platform as a Service (IaaS), applications, operating system, storage and other relevant computing resources are rented to customers. The providers run the whole computing platform and allow Clients access to the resources off-premises over the internet.

Illustrate an example of (IaaS)

Amazon for instance, is the most prominent storage provider using S3 to provide storage access to customers via REST and SOAP resources around the world.[18 p.612][Buyya R. e tal2008]? In infrastructure as a Service, the client pays consumption as utility, but has no control or ownership over the infrastructure. Cloud Storage service on the one hand, is where an Enterprise stores and retrieves data from a storage provider's facility over the Internet, owned and managed by the provider off-premises. Finally, Cloud Software as a Service (SaaS) is where software applications are run and hosted on SaaS provider's infrastructure and access by customer through internet browser. [3 p.15][Sloan K. 2009]

Cloud software as a service [SaaS]

An example of SaaS, is Google application Engine, and Gmail etc. These services are made possible through a combination of virtualised, cloud and Utility computing models. Virtualisation using Virtual machine (VM) platform, is a process of abstracting computer applications, services and operating systems from the infrastructure on which they run. [2 p.15][Slon,K. 2009] Abstraction forms an important part of virtualised environment. It could be seen in the foregoing that by the very nature of these services, data flow is pooled in public domain. In the absence of a robust cloud based security mechanism, the potential for security breach between customer and provider cannot be ruled out. In this section, I have explained the different Cloud formations and outsourcing services; the next section will discuss associated Risk in Cloud Services.

Associated Risks In Cloud

Good IT governance and managing risk and security policy forms an essential part in any Enterprise Security Architecture. In traditional Enterprise IT services, Security solutions tools against external threats are provided using Firewalls, Intrusion Detection System, virtual Private Network, Anti-virus, and encryption coupled with strict enforced policies. In contrast with cloud outsourcing, business-critical data are kept outside the Enterprise security boundary with no control or Policies to enforce. To mitigate this problem, a risk based data classification process by a customer is relevant and by far the best model for data security management in virtual and or non-virtual environment'.[Mattson,2009 p.15] Data classification process gives enterprises the opportunity to take stock of their important security exposures, and project their strategies towards solving the most critical ones.

Therefore in Cloud Infrastructure as a service the crucial issue hinges on ?security and integrity' of customer sensitive data in the facility of the provider, which raises several security questions. For instance, in the event of a problem with provider's infrastructure in a given circumstance, what mechanism is in place to ensure integrity and availability of customer's data? Secondly, what mechanism is provided to suggest that employees at provider's storage facility will not tamper with stored data on the servers? Thirdly, in the event that a particular customer is under investigation what legal mechanism is provided in making sure that the data is recoverable irrespective of where the data might be located? Finally, what is the trust level for conducting an audit in cloud? In case of any dispute between provider and customer, what exit strategy is provided for the customer?

From a risk management perspective, the most prominent risks in outsourcing are information Security concerns and loss of management control.[31p.3772][Yang D.H etal,2006]) Since there are no security standard specific to cloud computing, [20 p.11][Mansfield,2008],? the need for Customer assurance of Confidentiality, Data Integrity and Availability of their information cannot be over emphasised. The success as a provider of cloud based application services will depend on players themselves in terms of reliability, Security, availability, performance, and management of Service Level Agreement (SLA)'.[Stinchcombe, 2009 p.31] In this context, customer sensitive information in transit and at rest requires robust security mechanism and protection against potential threats and vulnerabilities associated with cloud services. The next section will discussed vulnerabilities in the three cloud service models and then followed by solutions to mitigate them.

Vulnerabilities

All Indication is that Cloud applications are browser based; an interface whose weaknesses are well known. In software as a Service [SaaS] for instance, if a customers' browser is insecure could give way to potential exploit by malicious hackers. Recently, Security researchers at Arbor Networks have discovered a malicious application in Google's cloud-based application development environment, AppEngine. The malicious application acted as a ?command-and-control hub, used by cybercriminals to issue download instructions to zombie computers that make up a botnet'.[33][Angela,2009]? Similarly, if the channel between the two ends is not fully secured; in a worse case scenario, customer's sensitive information in transit may be equally compromised. From a risk management perspective, an unencrypted data existent in the cloud may be considered ?Lost? by the customer.[32] [CSA p.12]

Platform as a service [PaaS] also has its potential vulnerabilities. The threats in this area are in two folds; firstly, security of users' browser and second a software bug on the deployed Customer application hosted on the provider's Infrastrure. These two situations if not secure could compromise customer data in transit. The Los Angeles Police Department and the city attorney's office for example, had expressed concerned that ?if their confidential information in e-mail messages were stored on Google's cloud servers instead of the city's own data centre, it might be exposed'.[34][3tera,2009] For Google to win over the council, it had to accept list of legal offers which includes among others encryption of data in transit and at rest. In this context, one may argue that security offers in Google cloud services seems dependent on the type of customer it is dealing with and in which case its security protection may differ from customer to customer. Although in cloud customer application service deployment, emphasis is place on using programming languages and tools supported by the provider such as java, python, .Net. However, when it comes to business services in the cloud, the cyber criminal only needs to exploit one hole to hack and get access to multiple sites.[20 p.9][Mansfield,2008]

Infrastructure as a service [IaaS) on the other hand, require security of both application and Customer stored data in the provider's Servers. Depending on what type of Service Level Agreement (SLA) is concluded with the customer, the responsibility of ensuring quality of service and availability of data rest on the Provider. An application that runs on virtual machine will require patched management, its thus important that providers deploy code to virtual machines to avoid users creating instances of servers using flawed, unpatched code.[Mattsson, 2009 p.16]

Virtual Machine of an IaaS

A typical VM of an Infrastructure as Service components available for customers to process and store their data locally in cloud. However, because ?local data storage is not persistent across machines restarts, most application use external persistent storage environment as illustrated in Fig 4 below.

Cloud-based persistent storage

Amazon's AWS Elastic Computer Cloud (EC2) is a good example of an IaaS offering, but MIT researchers in collaboration with University of California have identified security holes on its EC2 cloud service infrastructure. In the report sent to Amazon CEO, the researchers revealed how malicious attackers could search for, locate and attack specific targets.[34][Jaikuma,2009] Amazon acknowledged the report, and made announcement that it had taken steps to fix the problem.

In the absence of an efficient security mechanism, both Customer and Server end points are zones potentially vulnerable in IaaS model. This suggest that in spite of the transformation of existing customer infrastructure and services into cloud utility service oriented architecture, Security, Transparency and Assurance are crucial issues providers have to tackle in order to win-over security concerns of target customers. This brings into prominence the need to for a cloud based Security as a Service (SaaS) platform independent of the Providers.

Security Mechanism

The pervasiveness of Cloud computing does not represent a secure environment; Security, identity and Access control are still very immature in the cloud framework.[Jericho forum, presentation u-tube] However, collaboration among Security professionals coupled with ongoing academic Researches are important steps geared towards creating a secure environment for Businesses in cloud or intending to switch to cloud. Prominent among such efforts is the collaboration of the Jericho Forum and Cloud Security Alliance (CSA); and independent non-profit making organisation. This body have released an eighty page ?Security guidance as critical areas of focus in cloud computing'. With similar collaboration in this sphere, an ultimate realisation of an accepted standard cloud based security mechanism may come to fruition. For now CSA's best practice guidelines stands to help businesses in making sound and appropriate decisions on cloud services and deployment.

Notwithstanding the lack of standard cloud based security mechanism, existing Encryption technologies are still useful tools utilized to ensure confidentiality, integrity, authentication and non-repudiation on customer data in transit and at rest. However, the efficiency of this approach would also depend on the type of Cryptosystem used and Key management techniques.

Encryption

?Strong encryption with key management is the core mechanism that cloud computing systems must use to protect data. Encrypted data is protected; even whereas someone has the data without its corresponding keys, they cannot use the data at all.[Callas Jon, CSA p.72] Given the fact that communication between customer and provider in cloud is Web based (i.e via the internet). Security of data in transit remains vulnerable hence the need to deploy logical security mechanism that would ensure confidentiality, integrity, authentication and non-repudiation between the two entities. The use of Encryption on data in transit and at rest has been strongly recommended by CSA in their Guideline of using cloud computing and other security professionals elsewhere. The best way to achieve this goal is by using strong proprietary cryptography algorithms such as Symmetric, Asymmetric or combination of both.

In a Symmetric cryptography such as Data Encryption Standard (DES) or 3DES among others, the sender and receiver use the same Secret key for encrypting and decrypting messages. The advantage is because it is much faster than Asymmetric algorithm and harder to break if using a large Key size. The down side of this method is how to manage key exchanges. Against this backdrop, it would thus require a secure mechanism to deliver keys properly. Symmetric algorithm also provides confidentiality but not authenticity or non-repudiation. [CISSP, CH8 p.681]

On the other hand using an Asymmetric algorithm such RSA, DSA among others; two different keys are used, one private and the other Public. Sender encrypts message with the Public key of recipient and message decrypted by the recipient using his private key. The merit of this method is better key distribution, scalability and provides authentication as well as non-repudiation. Its down side is that it is much slower compared to symmetric algorithm.

Security Of Data In Cloud

In the context of cloud computing, security of data could be achieved by using combination of both symmetric and Asymmetric Algorithms on data in transit as well as at rest. These cryptosystems as discussed above would together provide security attributes of confidentiality, integrity, authentication and non-repudiation.

The key security issue here is the internet browser where contact is established between customer and server. Using a Secure Socket Layer (SSL) over HTTP or TSL could overcome this problem. This protocol can provide secure channel for key delivery between Customer and Provider Server in cloud. [Mansfield D.20 p.10, 2008] Since the job of SSL is to provide secure channel, the back end of provider's server may require further protection as well. With Asymmetric and Symmetric Cryptography deployed together, even if the data packet is intercepted along the path, confidentiality is provided by the algorithms. The intruder will find it difficult to decrypt the data in the absence of the Secret Key. Nevertheless, there are a number of other security technologies in use for encryption, Authorisation and authentication such as [Kerbros, IPSec,VPN,PGP]. Provision of security between two entities is therefore not limited to only SSL/TSL.

Security Of Data At Rest

The use of hybrid approach (Symmetric and Asymmetric cryptography) in encrypting as well as key distribution is supported by a security technology innovation by a group of developers assigned by Microsoft in 2008. The technology innovation claim to ?provide data security in an off-premise environment and enables cloud-based data storage to function as a secure ?drop-box' for data that corresponds to a customer.[Meijer et al, 2008 p.1] The technology uses a Public/private Key cryptography that correspond to a private key of customer. Key exchange between service provider and customer is handled by a system transferor via an encrypted digital envelope.

Example of cloud-Based secure data repository.

In this system, data that is drop by customer is encrypted using a Public Key that corresponds to a user's specific private key. Since the private key is kept secret by both parties, the stored data is protected. Further security is also added to the data at rest by partitioning of the cloud based data repository into multiple partitions. This creates independent secure storage for every Customer, and each with its own separate key pair. ?Each of these multiple partitions can correspond to any number of indexing criteria , and not limited to identity of user, data type, data content, data topic or author, etc; [p.1 para. 0010] as illustrated in Fig? below.

Example of the Security and Key Management components of the system.

As depicted above, the system has ability to facilitate encryption of data stored in each partition in a way that data can be secured and limited for use by designated services or customer. This limited use is made possible by control of the private key needed for decryption of the stored data. Furthermore, the security component received data inputs from customer, whereas the key management component analyse the input, automatically to determine an appropriate public key which then encrypt the input prior to storage into data partition. [ibid, p.4]

The key management component generates the Public/Private cryptographic key pair as a function of the identity of the customer. [Ibid p.8] Based on the nature of this cloud security system, one could argued that since the service provider has private keys to decrypt stored data in the various partition, security of stored data in this context has be based on SLA Trust agreement between the parties.

Data Recovery

?Investigative support

Service Level Agreement (SLA)

Conclusion

Bibliography

?Krissi Danielson:?? Distinguishing Cloud Computing from Utility Computing March 26, 2008: Interview with 3Tera Chairman and CEO Barry X Lynn; Utility Computing Company. <URL: http://www.ebizq.Net/MT4-cp.cgi?_mode=view&amp;blog_Id=32&amp;Id=8>

Richard Stallman with Guardian: Cloud Computing; Guardian Technology News Monday 29 September 2008; URL: Http://www.guardian.co.uk/technology/2008/Sep/25/Computing.Internet/

?Larry Ellison: Oracle's Ellison nails cloud computing; September 26, 2008 URL: http://news.cnet.com/8301-13953_3-10052188-80.html

?Security in? Virtualised World: Network Security, Volume 2009 .Issue 6, august 2009,pp.15-18 - Kevin Sloan-

?A concise introduction to autonomic Computing: Advanced Engineering Informatics, Volume 19, issue 3, July 2005, pp.181-187 - Roy Sterritt, Manish Parashar, Huaglory Tianfield, rainer Unland.

?Cloud Computing and emerging IT Platforms: Vision, hype, and Reality for delivering computing as the 5th Utility: Future Generation Computer Systems, Vol 25, issue 6, June 2009, pp.599-616 - Rajkumar Buyya, Chee Shin Yeo, Srikumar Venugopal, James Broberg, Ivon Brandic

?Hey, you, get off of the cloud? Computer law & security review, Vol 25, issue 3, 2009, pp.270-274 -Andrew Joint, Edwin Baker, Edward Eccles

?Danger in the Clouds - Network Security, Vol.2008, issue, December 2008, Pages 9-11 Steve Mansfield- Devine

?Developing a decision model for Business process outsourcing- Dong hoon Young, Seongcheol Kim, Changi Nam, Ja-won Min - Elsevier - May 2006.

?CSA: Cloud Security Allaince: Security Guidance for critical areas of focus in cloud Computing: April 2009 - URL: www.cloudsecurity alliance.org/guidance/>

?Moscaritolo Angela November 10 2009, Rogue appEngine application - Arbor Networks - URL: www.scmagazeous.com/Rogue-AppEngine-app/article/157518/

?Vijayan Jaikumar (2009) Amazon downplays reports of vulnerabilities in its EC2 cloud services. URL-www.inforworld.com/d/cloud-computing/amazon-downplays-reports-vulnerabilities-in-its-cloud-services-994/

?Ulf Mattsson (2009) Real security for virtual machines: Network Security- Elsvier

?Neil Stinchcombe (setember/October (2009) Technology- inforsecurity- Elsvier

?Henricus Johannes Maria Meijer, William H. Gates, Raymond E. Ozzle, Thomas F. Bergstraesser, Michel Connolly, Alexander G. Gounares, Debi P. Mishra, IraL. Snyder, Melora Zaner-Godsey -? April 2008 - Data Security in an Off-Premise Enviroment - pp.1-11

?John Sherwood, Andrew Clark, David Lynas (2005) Enterprise Security Architecture: A Business driven Approach; CMP Books, USA.

?Shon Harris (2008) All-in-one CISSP Exam Guide - 4th edn. McGraw Hill, New York. P.

dog the bounty hunter tacoma narrows bridge weather nyc open marriage department of justice doj dept of justice