Category: CSE Project Reports

Security measures taken 

Most of the organizations share their data to the service providers of cloud computing and seeks more security towards their confidential and personal data and need a proper protection mechanism towards their organizational data at different level of security and data protection across the cloud services should include different level of authentication and even the manager is insisting for different roles across the data protection.

Data controller and data processor should pay the required responsibility while providing the required security to the personal and organizational data that was shared across the cloud services.  The service providers are striving a lot to ensure the data security of their clients and they are implementing all the possible latest technologies in protecting the data of the customers. There are different models that can be used against the data protection of the organizations and all most each of them is implemented by the cloud service providers.

Network administrators are seeking the layer approach for their data, where the complete organization data is divided into different layers and each layer is provided with a separate level of security and access and most of the organizations are looking forward for the latest security implementations and even the service providers are implementing all the possible latest trends towards the data security of the organizations.

Organizations need to share all the data and the corresponding information to the cloud service providers such that get the complete range of services from the cloud and in some cases, few organizations cant share the most confidential information of the organization like financial documents and liabilities information. Public information is shared across the public clouds and even a detailed level of security is required in this context and if the cloud is the private cloud then more level of information security is required.

There are many hidden security threats across the third party adoption for the data security and most of the companies are losing their information with the public access through the third party websites and, if the data is lost it can’t be restored effectively if the data is maintained by the third parties and thus most of the companies are doesn’t prefer these third parties to ensure more security to their data. Most of the service providers maintain all the encrypted data of two or more companies on the same disk and thus there could be lot chances that end up with data segregation.

Risks associated with cloud computing 

There are many hidden security threats across the third party adoption for the data security and most of the companies are losing their information with the public access through the third party websites and, if the data is lost it can’t be restored effectively if the data is maintained by the third parties and thus most of the companies are doesn’t prefer these third parties to ensure more security to their data.

Most of the service providers maintain all the encrypted data of two or more companies on the same disk and thus there could be lot chances that end up with data segregation. If the service providers can maintain a separate data block to store the data of the individual organizations, then this problem can be solved to some extent.

There could be chances of service provider downtimes and in those cases, the clients should be connected to their respective data all the time and even the service providers should not involve the third parties during the downtime of the actual servers to recover the data and if this is the case, the third parties will hack the data of the organizations and it has happened many times with the famous cloud service providers.

Security consideration chosen before choosing the vendor 

Cloud computing services are implemented on a good scale and with good quality, the overall business value is increased and even the organizations can gain more customers and users and if any organization can employ the cloud services, their information and services can be deployed on a remote location or a remote device very easily and thus their overall business value is enhanced in this way.

The level of implementations across the cloud computing services purely depends on the service providers and in general the service provider should be trusted against the their quality of services being provided to the customers and if security is not at the required levels, the organizations are not willing to take risks by adopting the cloud services irrespective of the list of advantages available with cloud computing. Organizations are adopting the cloud services to enhance their business values in terms of improving the range of products and services.

In general they approach the cloud service providers and tell all the requirements against their business scope and thus they create the required facilities on the cloud and they simply use them to enhance their business value and with the perfect implementation of cloud services, all the organizations can find a simple and light weight platform to share their views and thoughts regarding the business scope and thus cloud computing is really beneficial in this context and , if the cloud services are properly utilized then, more customized applications and web services can be created by the organizations and thus a lot of cost and time are saved in terms of deploying the application requirements on the third party.

Cloud computing is the latest technology used widely across the computing world and has gained more popularity these days in terms of cost and time saving factors. There are different clouds that can be used by the clients and even the service providers are striving a lot to create new opportunities towards the cloud services and among the cloud types, private clouds, public clouds and hybrid clouds are the important ones. In general the private clouds are dedicated clouds and can be used by a single or more organizations together and get benefited with the service provided by the cloud providers.

Public clouds are public in nature and can be accessed by any end users, where the hybrid clouds are the integration components of public and private clouds and combine the application and data layer together. Thus cloud computing offers many public and private services to the clients and there should be a perfect level of clients and the cloud service providers in this context to make the cloud utilization to the top extent. There are many service providers for the cloud computing services and the key among them are Amazon and Google and they are successful in gaining more number of customers in terms of public and private clouds as well. 

Apart from the wide range of clouds services and their corresponding advantages, there are few limitations attached with the cloud computing services.  Security can be considered as the key risk associated with the cloud computing services and the level of security provided by the service providers is varying as per the external and internal threats of the clients and there is no perfect security solution and model for the cloud computing services as of now.

Among these security threats, data security is the key issue to be considered on its top extent, as the data of the most of the organizations is maintained across the remote location and this process is accomplished by the service providers and in this context the clients can’t trust the service providers all the time. Providing the security to the client’s data is not an easy task and need lot of time and revenue and thus most of the small organizations don’t prefer the cloud services due to lack of trust on the service providers and the third parities against their organizational data.

There are many efforts driven towards building trust for the small organizations towards the cloud computing and the corresponding data protection and still there are many confusions towards the data protection of the clients. The main aim of this project is to do the research by considering few small companies and understand their perspective towards the existing security issues against the organizational data and evaluate their role in creating a safe environment. To execute this research, five small software organizations in UK are considered.

These companies are using the cloud services and have some issues with the security against their data and the research is done at their site to understand the level of impact on their overall business value and process due to the security for their data. Few respondents are identified for all the companies considered and the network administrators and business development managers and a separate questionnaire is prepared for both the types of respondents and the key findings from the interview process are as given below. 

All the research questions identified in the introduction chapter are answered in this chapter and as given below

When t he network administrators are asked regarding the level of visibility required to the organizations with respect to the data protection, one of the admin replied to the question like “We require a clear visibility of the data processing and we need a data log as well at regular intervals”. From this statement it is clear that, service providers should make a visible layer to the organizations such that the organizations can view their data operations without any restrictions and also a log should be prepared against all the day to day data operations and share to the clients as well. One of the network admin replied to the same question like “We need all the operations done on the private data by our employees and third parties on a regular interval and a details track of this is required”.

From his reply it is clear that if the organizations can view the private data operations done by their own employees or remote employees such that can be aware of all the data operations that were done at their own premises and remote location as well. When the same question is asked to one of the network admin, he replied that “Visibility of data depends on the level of applications that access the data and we required 100% visibility such that we need to track the application level metrics that uses and manipulates the data”.

From this statement it is clear that, there are many applications that run across the organizations and these applications will operate on the clients data in several manners and a clear view of the application level database operations are required in this context to understand what applications are modifying or manipulating the data objects of the organization that were saved across the remote locations.  When one of the network admin is asked the question, he replied that “Visibility to our data should be given and this visibility should be at different levels such that the top management can view all the data objects”.

From his opinion it is clear that even the visibility should be at different levels and the low level employees should be provided a less visibility of the data operations when compared to the top levels and finally the top level management should be given the top priority in this context. One of the network admin replied to the same question like “Irrespective of the data issues faced these days a clear vision should be given to us to understand what happening around and we should be able to track the status of the data operations executed at the remote location”.

From his reply it is clear that even there are some issues with the security of the data that was stored across the remote locations by the organizations, the companies should be aware of all the things that were happening out of the enterprise and even the service providers should make sure they provide the maximum visibility to the organizations in this context. Thus from this overall analysis it is clear that, visibility of the data operations executed at the remote location is really important to track and implement the required security measures to the data of the organizations in all the possible aspects. 

When the network administrators are asked regarding their future plans of improving the data security of their organization against the cloud services, one of the network admin replied that “We are planning to migrate from the public cloud mechanism to private cloud and also insisting the service providers to create a private space for us at their location”.

From this statement it is clear that, the primary solutions for more data security is that public clouds can be migrated to the private clouds and thus more security is added to the clients from the perspective of the service providers. Providing the private space to the individual clients is also the best way to create optimal security solutions against the data protection of the organizations.

One of the admin replied to the same question like “In future we are planning to create a security alliance with the service providers and discuss the audit regularly without any failures”. From his reply it is clear creating a security alliance with the service providers can be considered as the best solution in this context as they can discuss the security threats and issues in the audit process on a regular interval with the service providers and thus getting updated with all the issues.

When the same question is asked to one of the network admin, he replied that “In future we are planning to have a dedicated cloud for us and don’t want to share the Information to the service providers or any other third parties.”  From this analysis it can be observed that always maintaining the private clouds would be the optimal solution to have more access and security to the client’s data and also sharing only few parts of the data to the service providers is also the possible solution in this context.

One of the network client replied to the same question like “We are doing lot of research and development on different security models for protecting the organizational data and in future we will implement them”. From his reply it is clear that, most of the organizations are doing a lot of R and D towards development of their own security models for protecting the data and if this is the case, there is lot of scope for introduction of the sophisticated security models and even they can be used for more applications and can be integrated with the existing applications and security models.

When one of the network admin is asked the same question, he replied that “We are planning to have a hybrid cloud such that, all the data and application tiers are under our control and we can monitor each and every aspect in detail”. From his opinion it is clear that, a hybrid cloud can be implemented across the future cloud computing services, thus both the application and database layers are tightly integrated in this process and even the clients can have the complete control over the database and application operations. 

Data security measures followed by the organizations in the opinion of network administrators 

In this section, the actual data security measure followed by the organizations against the data protection that was shared for the cloud service is given as per the opinion of the five network administrators interviewed and is as given below 

When the network administrators are asked regarding the security models they use across their organizations for the data protection that was shared across the cloud services, one of the admin replied that “We don’t directly implement any security model from our side but insist the service providers to use the cloud switch security model as it has the unique features like all the keys are maintained under the guidance of the firewalls and we hold the complete control of those keys”.

From this statement it is clear that most of the organizations has the required control on the data security of their own organizations and insist the service providers to maintain the required security model and in this case cloud switch model is used, where it stores the data in the encrypted form and the encryption keys are available with the organization itself. One of the network admin replied to the same question like “We use the HDFS security model for data protection and it provides the ultimate security for our data”.

From this statement it is clear that few organizations use their own security standards to protect their data and in this case, HDFS (Hadoop Distributed File System) is used as their required model and the main advantage with this model is that, the files are distributed randomly across the disk and the key distribution mechanism is available with the clients and the data owners. When one of the network admin is asked the same question he replied that “We insist our service providers to install the cloud cube model across the data protection and different layers of security are provided with this model”.

From this statement it is clear that, most of the organizations are aware of different security models and in this case a separate cloud cube model is used and the service providers will give different physical layers that were external and internal to the organizations. One of the admin replied to the same question like “We not aware of the data security models and the complete control is given to the service providers and we trust them in this context”. From his reply it is clear that, few organizations strive a lot and trust the service providers in this context and the service providers will implement the security models.

From this overall analysis it is clear that, the service providers should be aware of all the security requirements of the clients and implement the required security model and this model should hold the key logic in different aspects. The most commonly security model for data protection is the cloud cube model and this model provides maximum protection to the data in terms of different layers in terms of physical layer that was external and internal to the organization. 

Findings from the opinion of Network administrators 

Network administrators from all the five companies considered for the research are interviewed to gather the required information to understand the impact and requirements of data security for their organizations and the key findings are given in this section as below 

Data security requirements for organizations in the opinion of network administrator 

Network administrators are asked regarding the level of security requirements for their data and their opinions are analyzed in this section. When on the network admin is asked the question like what are the expectations towards the data security, he replied that “We always expect a layer approach for the data protection and our service providers can handle this”. From this opinion it is clear that, even the network administrators are seeking the layer approach for their data, where the complete organization data is divided into different layers and each layer is provided with a separate level of security and access.

One of the network admin replied to the same question like “We need a perfect authentication mechanism and all the users should be provided with limited access to the data as per their privileges” and from this statement it is clear that, authentication can be considered as the best way to provide the data security for the organizations and even a limited access is desired in this context, such that users are not provided the complete authorization to the data. One of the admin said for the same question like “A strict encryption and decryption mechanism should be implemented for the data across the cloud for the organization” and from the statement it is clear that, even the traditional approaches for security like encryption are also implemented across the data security for the organizations and even most of the service providers are implementing this techniques as per the business requirements.

One of the network admin replied to the same question like “We always need additional security requirements for the cloud data protection and all we need is a recent trend in this context”. From this statement it is clear that, most of the organizations are looking forward for the latest security implementations and even the service providers are implementing all the possible latest trends towards the data security of the organizations.

 

Sharing the organizational data to the cloud service providers also plays an important role in deciding the level of data security requirements and when one of the network admin asked regarding this, he replied like “In general we share all the data to the service providers and in few cases, we won’t share the most confidential aspects”. From this reply it can be analyzed that, most of the organizations need to share all the data and the corresponding information to the cloud service providers such that get the complete range of services from the cloud and in some cases, few organizations cant share the most confidential information of the organization like financial documents and liabilities information.

When one of the network admin was asked the same question, he replied that, “We share most of the information such that our customers should be aware of the process and products of our organization, but seeks more security this information against illegal access”.  From this statement it is clear that all the public information is shared across the public clouds and even a detailed level of security is required in this context and if the cloud is the private cloud then more level of information security is required. One of the network admin replied to the same question like “We decide up on the public and private information and public information has less security constraints and the private information has limited and privileged access”.

From this statement it is clear that, most of the organizations are categorizing their data in to two important aspects like public and private. Private data is protected more when compared to the public clouds and they are insisting the limited and access level restrictions to the private clouds. One of the network admin replied to this question like “Multi layer security requirements are mandatory for our private data and service providers are also implementing the same” and from this statement it is clear that, almost all the organizations are implementing the multi layer architecture for the security of the private data, where the top end management has complete rights on the data and a hierarchy of data access is required for most of the organizations.

When one of the network admin is asked regarding this question, he replied that “We share only the public data and information related to products and services and in few cases we share the private information and seeks more security for this data”. From this statement it is clear that, all the information related to products and services can be shared publicly and the private information need more security and this scenario is common among all the companies and service providers. 

There are few third parties that provide the data security to the organizations and when the network administrators were questions with respect to this, one of the network admin replied that, “We can’t trust the third parties all the time and there are lot of disadvantages like loss of data and unauthorized access”.  From this statement it is clear that, most of the organizations do not trust the third parties in sharing their organizational data and they have lot of doubts with respect to their data loss and other issues.

When the same question is asked to other network admin, he replied that, “There are many security threats with the third parties and we lost our data in some aspects, and out applications are hacked and information stolen due to this implementations”. From his opinion it is clear that, there are many hidden security threats across the third party adoption for the data security and most of the companies are losing their information with the public access through the third party websites. One of the network admin replied to the same question like “Restoration of data is not possible with the third party adoption towards the cloud computing and even the lock to the data does not works with third parties”.

From this statement it is clear that, if the data is lost it can’t be restored effectively if the data is maintained by the third parties and thus most of the companies are doesn’t prefer these third parties to ensure more security to their data. One of the network admin replied to the same question like “There are few advantages by adopting the third parities for the data security if they are reliable and in most of the cases we can’t trust them unless are more reputed”. From this statement it is very clear that, apart from the advantages provided by the third party data security providers there are many threats across the security and most of the organizations are striving a lot to choose the reputed companies while giving their data.

One of the network admin answered to the same question like “Third party data protection mechanism can’t be trusted always, as there are many limitations with them and the key among them is their reliability and durability”. From this statement it is clear that, third parties can be used for the data protection of the organizations which they share the data for the cloud services and in most of the cases, these third parties are not reliable and durable and if this is the case, the actual organizations may lose the important data and also lose the confidence of their users.

From the overall analysis of this question it is clear that, most of the organizations don’t trust the third parties for their data protection and also they don’t have hope on their reliability in terms of their data protection. Thus if the service providers can make this process simple and build the required confidence among the small organizations in terms of the trust towards their public and private data, then the business value of both the small organizations and the cloud service providers can be increased a lot. 

There are lot of risks associated with the data security that was shared across the cloud services and when the network administrators are asked regarding the same, one of the network admin replied that, “When the data is processed outside the enterprise there are many risks associated and key among them is lack of data location servers even to the organizations”. From this statement it is clear that, if the organizations share the public or private data to the cloud service providers, they store the data at the remote locations and in some cases, even the data is stored in a different country and if this is the case, the management of the organizations are not aware of the situations and can’t locate their data when the service providers servers are down. 

When one of the network admin is asked the same, he replied that “Data recovery can be considered as the key problem with the data security across cloud computing and we need a separate data recovery protocol for this situation”. From his answer it is clear that, if the data is lost for any known or unknown reasons, the service providers should be able to recover the data and in most of the cases, they can’t do this and also the organizations are seeking a data recovery protocol in this context and if it can be implemented, then job the service providers would become very easy.

One of network admin, replied to the same question like “Data segregation is the key issues faced by our organization and out service provider need to maintain our data in a separate disk” and from this statement it is clear that most of the service providers maintains all the encrypted data of two or more companies on the same disk and thus there could be lot chances that end up with data segregation. If the service providers can maintain a separate data block to store the data of the individual organizations, then this problem can be solved to some extent.

When one of the network admin is asked regarding this question the reply is “Storage of the encrypted keys is the main security risk associated with the data, as the service providers will store the data of one organization at other organizations and thus our data should be safe from the second organization employees”. From this reply it is very clear that most of the service providers store the data of one organization at a remote location and the actual data should be encrypted and the corresponding encryption keys should be made available to the client organization such that the employees of the remote organizations can’t access this data. 

One of the network admin replied to this question like “Availability of data to the clients all the time should be considered from the service provider’s point of view and even the involvement of third parties should be eliminated at maximum possible levels”.

From this statement it is clear that, there could be chances of service provider downtimes and in those cases, the clients should be connected to their respective data all the time and even the service providers should not involve the third parties during the downtime of the actual servers to recover the data and if this is the case, the third parties will hack the data of the organizations and it has happened many times with the famous cloud service providers. 

As the main of this research is to understand the level of data security requirements for cloud computing in the perspective of small organizations, the corresponding business managers are asked regarding the security requirements and the respective opinions are given in this section as below 

When the business development managers are asked regarding the level of security requirements for their data, one of the managers replied that “We required a perfect protection mechanism for the personal data and confidential data of the organizations”. From his reply it is clear that, most of the organizations share their data to the service providers of cloud computing and seeks more security towards their confidential and personal data and need a proper protection mechanism towards their organizational data at different level of security. When one of the business development managers is asked regarding this question, he replied like “We need different level of authentication for the organizational data and this should includes different roles like data processor and data controller”.

From the opinion of this business manager it is clear that, data protection across the cloud services should include different level of authentication and even the manager is insisting for different roles across the data protection. Data controller and data processor should pay the required responsibility while providing the required security to the personal and organizational data that was shared across the cloud services. 

One of the managers replied to this question like “A proper visibility to our database operations is required and we need a day to day log for all the database access done from the service providers”. From this opinion of the business development managers it is clear that visibility to the database operations is required for almost all the organizations and this visibility helps the organizations to ensure their data is not misused or copied by any intruders or third parties and even the service providers of the cloud computing should ensure that they provide a clear log which contain all the day to day operations of the data to the organizations. One of the business development managers when asked the same question, he replied that “All our information should be categorized into different levels and each level should be assigned with different security levels while accessing the data”.

From his opinion, it can be understood that, if the cloud service providers can give ample facilities to the information being accessed by the third parities it would become the major security threat and thus different levels of security is required against the organization information. The whole information of the organization should be categorized into various levels and the topmost levels of information should be accessible to only limited users and thus the low level information need not have more security and with this implementation the organizations can gain more confidence on the cloud service providers.

One of the business development managers replied to the question like “A perfect security model should be implemented for our data and this should prevent the illegal access and updates to the organizational data”. It can be concluded from his statement that, there are different security models to protect the data of the organizations and if the service providers can implement these security models, the data of the companies can be protected in a professional manner. 

When the business development managers are asked the question like, does the service providers ensure the required security levels, one of the managers replied that “Our service providers implements the latest security models and these include encryption and other sophisticated methods to ensure our data security”. From this statement it can be analyzed that, even the service providers are striving a lot to ensure the data security of their clients and they are implementing all the possible latest technologies in protecting the data of the customers.

There are different models that can be used against the data protection of the organizations and all most each of them is implemented by the cloud service providers.  One of the business development managers replied to the question like “Service providers always take the inputs from us in this context and they are almost successful in providing the data security” and from this statement it is clear that, almost all the cloud service providers are taking the right steps in providing the required data protection for the customers.

One of the managers replied to the same question like “Our service providers maintains all the possible data breaches and escalates us before taking the necessary actions towards these possibilities”. From this statement it can be concluded that, a perfect list of all the possible security threats is maintained by the service providers and they take all the precautions to get rid of these situations. When the same question is asked to one of the business development mangers, he replied that, “Service providers applies the multi layer approach to protect the data of our organization and provides access only to the privileged employees” and from this statement it can be understood that, always applying the multi-layer approach for the data protection is the primary step to be taken. Always a certain privileges should be set against the users and employees for a limited access.

One of the business development managers replied to the question like “Different security areas are provided by the service providers within the data protection and a prefect authentication is provided for our data”. From this statement it can be analyzed that, a separate security area is provided to the client data and a proper authentication is required to access this area and most of the service providers are following this to ensure the data protection of the organizations. From the overall analysis it can be concluded that, almost every service provider is striving a lot to ensure maximum protection to the data of the customers and organizations and implementing all the possible solutions in this context. 

Each and every organization will have different requirements with respect to the cloud computing services and when the business development managers are asked regarding this, one of the managers replied that “We always look for non physical deployment of communication and mailing served from the cloud service providers”. From his opinion it is clear that, few communication mechanisms and aspects like email servers and exchange servers are hard to be maintained across the physical location of the organizations and thus if they adopt the cloud services in this context, the organization job is reduced a lot and also the requirements for infrastructure are also reduced a lot.

One of the business development managers replied to the same question like “We always require a simple solution and application where all our business partners and the corresponding employees are in contact through a simple web page”. From this statement it can be analyzed that, most of the organizations are looking for the best solution to be in contact with the employees and business partners and a simple web application can solve these issues and it is known that a perfect cloud computing can provide this facility to their customers a lot.

When the same question is asked to one of the business development managers, he replied that, “We required a perfect mobile workforce and need to track the day to day operations using the cloud services” and from his opinion it is clear that, if cloud computing is used in a perfect manner, all the day to day operations can be tracked and monitored even in a remote location. One of the business development managers replied to this question like “We use all the internet based applications and benefits and integrate them with our applications using the cloud services”.

From his statement it is clear that, cloud computing services provide a wide range of free internet applications and services and they can be easily deployed and used across the new program development and most of the organizations are following the same as per the opinion of this particular business development manager.  When one of the business development managers asked the same question he replied that “We use the cloud services for an online solution of CRM software and it is really helpful as of now”. From this statement it is clear that even enterprise level applications like CRM are also provided by the cloud computing services and thus most of the organizations are using them and getting benefited in this context. 

Thus from this overall analysis it is clear that, organizational business value is improved a lot with the implementation of the cloud services and the level of services provided by the cloud service providers. Apart from the range of benefits available with the cloud computing for the business value of the organizations, there are few security issues against the data being given to the service providers and they are discussed and analyzed based on the opinion of business development managers and given as below