Category: CSE Project Reports

Threats across the clouds 

There are number of threats associated with the clouds and these threats are ever increasing irrespective of the steps being taken to reduce the threats across the clouds these days. Among different threats identified across the cloud implementation few important threats and the corresponding impact on the cloud security are reviewed in this section and given as below 

User threats: These threats are very common across the public clouds and occur mainly due to the improper and low standard cloud implementations. The main reasons for these user threats is that, if the user management and the identity management are at low standards, unauthorized users can access the data being stored across the clouds. Poor user management includes few cases like, suppose if an ex-employee of the cloud service provider can access the client data remotely, then it would become a major threat and the corresponding strategies should be handled by both the service providers and the customers. 

Quality of the data: Quality of the data is the serious concern to be considered among all the possible threats across the cloud security issues. In general the service providers maintain the data of the clients and different users can have access to the data and can manipulate the data as per the business requirements. Frequent updates to the customer’s data should be handled in an appropriate manner and the integrity of the data could raise new threats always irrespective of the threat handling mechanism in place. 

Change management: Change management is the crucial aspect to be considered across the security of the cloud. In general there are many chances, where the changes are imposed by the customers towards the services provided by the service providers and in some cases, these changes may lead to negative impact on the overall security of the cloud being provided. These changes can be either from the software or hardware side and a perfect change management mechanism should be in place, else there is lot of scope for security threats due to these changes. 

Thus there are number of attacks and threats across the security of the clouds and the common risks associated with the cloud security include privileged user access, data disposal, data location and segregation and all these risks are perfectly handled by the large cloud computing service providers and big organizations. When the case comes to small organizations who are planning to move towards the cloud computing are stuck up with lot of issues and they are thinking twice to adopt the excellent features provided by the cloud computing mainly due to these security risks and across the literature there is no evidence towards this aspect.

There is an identified gap with respect to the small companies and their attitude towards the cloud security and I would like to use this gap and do my search in terms of the small organizations attitude towards the cloud computing and how they are planning to go with the cloud technologies by considering all the issues related to cloud computing in this research. 

Cloud computing security

Security is the buzz word across the world and it plays an important role across different aspects related to network and information security. Any technology or implementation introduced across the networking world always suffers with some issues and among these issues security always seeks the top position. This tendency does not leave the cloud computing as well and the main issues faced by the customers and the service providers of the different clouds like public cloud, private cloud or hybrid could are purely related to the security.

In general the security across the cloud can be of two important types like the data security and the network security. Network security is obvious across any new implementation in the field of cloud computing and the majority of the risks are purely associated with the data security. As the cloud computing has promised the trusted levels on the top, most of the service providers and customers should trust each other before the customer automate their operations using the cloud computing technology. Cloud computing is purely a trust based business and the customers should trust the service providers in terms of their information security and data security.

As their data and the corresponding information related to their organization and customers are confidential in nature, most of the organizations tend to think twice before they opt the service providers for the cloud implementation. Databases are maintained across a remote location by the service providers and thus the customers always doubt about the security of their data and the mutual trust also fail in most of the cases, due to the case studied observed in past and also the customers may doubt the viability of the vendors in most of the cases.

In general the required security to the cloud operations are performed by the third parties apart from the actual customers and the actual service providers and these third parties concentrate more on the security of the clouds irrespective of the cloud being allocated like the public cloud, private cloud or the hybrid cloud. Even there are many measures taken against the security for the cloud computing, always there is an equal probability in term of the technical enhancements and the security related issues for the clouds maintained by the mentioned third parties.

Additional risks are associated with the security related issues across the cloud computing apart from the discussed business risks in the previous section. In general the security risks associated with the cloud computing can be either external or internal to the organization and thus the third parties who are handling the security related issues should have complete knowledge on the business operations provided by the corresponding service providers and the customers as well. To assess the level of security requirements for the cloud across the organizations and the service providers, few important aspects should be considered and they are as listed below 

• All the possible threats against the information of the clients should be analyzed in detail to provide the required security to the cloud and the corresponding data stored across the clouds
• Different types of attackers should be evaluated against their capabilities in attacking the client data in all the possible ways and mechanisms
• Analysis of all the other possible security risks associated with the current cloud implementation and the corresponding measures to be taken to handle the corresponding security risks
• Few case studies against the cloud security and the corresponding impact on the data of the customers should be evaluated to gain the required knowledge on handling the possible risks associated with all the clouds like public clouds, private clouds and the hybrid clouds.
• A detailed analysis on the future possible risks and the emerging risks should be done to evaluate the performance of the current security risk management strategies followed across the third party organizations .

Business risks associated with hybrid clouds 

Initially when the cloud computing concepts are introduced, the main focus was landed on the public clouds and the public clouds has gained more importance and could able to find many customers and services providers using the excellent feature of the public clouds. But when the time proceeds, the usage of public clouds was reduced due to the lot of security risks associated with the public clouds and thus most of the customers and the organizations were forced to shift towards the private clouds. The number of risks and the corresponding impact on the business due to the private risks is less when compared to the public clouds, as the private clouds are mainly used by a single owner or organization and thus has found great market across the cloud computing.

The level of security implementations are also well defined across the private clouds and later even there has emerged few risks with the private cloud implementation as well as discussed in the previous sections. The main risks associated with the private cloud are defined at the layered level and these risks are mainly focused on technology rather than the business values and thus the cloud market has partially shifted towards a more and better alternative known as hybrid clouds.

As per the survey conducted by the Unisys in January 2011, most of the customers, organizations and service providers are showing their interest towards these hybrid clouds and in general a typical hybrid cloud composes both the required features of the public clouds and the private clouds in all the required aspects. The level of security to the data and services provided to the customers across these hybrid clouds is on top scale when compared to both the public clouds and the private clouds.

The impact of the public cloud and the private cloud is equal across the hybrid clouds and when in specific the private clouds are concentrated, the private clouds are operated at a virtualization level and have great impact on the security features embedded across the hybrid clouds. A high level implementation of the hybrid clouds has gained more customers and apart from the wide range of advantages provided with the hybrid clouds, there is few business risks as well associated with these hybrid clouds.

The risks associated with the public cloud and private cloud may also come across these hybrid clouds and the service providers are striving a lot to come up with an optimal solution to these hybrid clouds. The common security risks associated with the public clouds are reduced a lot across these hybrid clouds and the layered risks associated with the private clouds as discussed in the previous section are not completely eliminated and the service providers are looking up for the best solution to get rid of these risks as the hybrid clouds are popular only these days and the usage range is limited when compared to the public and private clouds.

The typical controlling mechanism associated with the hybrid cloud implementation is failed in some cases, as the public cloud features are dominated across these hybrid clouds and the service providers can’t handle these issues as of now, as it was not widely used across the organizations. Thus if the hybrid cloud can be used widely and the corresponding operational performance of these hybrid clouds can be assessed in future a better solution to these control related security issues can be solved very easily. 

Business risks associated with private clouds 

In general the risks associated with the private clouds are less when compared to the public clouds and the main reasons for this is that, the private clouds are owned by a particular organization and has great control over the several issues like data and security. Apart from the wide range of risks associated with public clouds, there are few identical and considerable risks with the private clouds as well, but the main difference comes across the level of impact on the business.

The level of impact due to the public cloud risks is very high when compared to the private clouds and the different private cloud risks to the business values are reviewed in this section. The risks associated with the private clouds can be categorized at a layered level and in general there are three important layers, where these private risks are identified like the virtual machine layer, the virtual infrastructure layer and the disaster recovery layer. The actual risks associated at these layer is given below

Virtual infrastructure layer 

The level of risks associated with the virtual infrastructure layer varies from cloud to cloud, as the private clouds are owned by single organizations and they follow their own implementation of the infrastructure. The common areas where the virtual infrastructure risks are identifies are the storage devices, virtualization servers, virtualization management and the network connecting the devices.

The storage level risks mainly occur due to the reason that, if any of the nodes across the virtualization fails, the other nodes should also suffer with this and thus the overall performance is affected a lot due to the node failures and it may take some time to set back the operations. Virtualization servers also tend to fail and thus the nodes attached to server may fail due to the server failure and also the network connecting the nodes across the cluster also tends to fail due to many reasons and thus the network management risk is also associated with these private clouds at the virtual infrastructure layer.

The virtual machine layer 

Virtual machine layer risks are associated with the private clouds and these risks can be considered as the promising risks to be handled by any organization in terms of their business values. Server image, storage allocation and high availability promising are the common issues related to the risks associated with the virtual machine layer across the private clouds. Storage allocation is accessed by different end users across the virtual machines and there could be some data loss problems and due to this the server would become down for some time and that too at the crucial hours of the business. Higher availability of the server also may cause some risks associated with the virtual machine layer.

Disaster recovery layer 

Disaster recovery layer risks are most common across the private clouds and in general the disaster recovery mechanism tries to operate above the cloud services and tries to reduce the risk of could failures and data loss across the private clouds. If the disaster recovery layer is associated with some risks, the total operation of the clouds are affected and thus the handling the risks associated with the disaster recovery layer is always a tedious job to the private cloud service providers.

Replication settings are the key areas where the disaster recovery layer fails and if the replication is not done properly, there could be lot of chances where the data is not replicated properly and finally the required database may contain unwanted data across the servers and even the duplicates are generated on a large scale. Storage mapping is the key issues to be covered once the replication settings are handled, the actual usage of the storage mapping comes in to picture when the data is stored on a large scale across the virtual servers .

If the mapping to the storage of the data is associated with some risks, then the ultimate nature of the mapping algorithm against the disaster recovery is affected and thus always a perfect storage mapping should be established across the virtual servers to ensure a perfect and risk free private cloud operations. Recovery management deals with some predefined management techniques to handle the errors and common failures across the clouds. If the recovery management is set to deliver some risks, then the actual operations and services provided by the private cloud are affected a lot and thus always handling the recovery management risks is important than any other risk as discussed till now.

Virtual servers and the clusters in general fail due to many reasons and to eliminated and identify these failures across the large networks, these recovery management techniques are really important and the common risks associated with the recovery management include, mal-functionality of the servers and the nodes across the cluster and they do not respond to the failure mechanism in the failure identification process.

Thus the disaster recovery layer has a wide role to play across the private cloud security and in general as the private clouds are owned by a separate organization, they should take care of their own disaster recovery methodologies and then only should consult the corresponding service providers for the ample quality in their private clouds and also to reduce the corresponding risks as discussed.

Security across the network: Security across the network is always required across the public cloud implementation, as most if the network resources are shared using this cloud. If the vendor does not take ample care regarding the network security, there could be some chances where the sensitive information related to the vendors and customers is stolen by the unauthorized users like anomalies and intruders across the network, which always pees their ears across the public clouds. In most of the cases, the customers can be considered as the culprits who violate the security across the network for the public clouds, as once they move towards the public clouds, they simply neglect protecting their own data and thus develop an attitude towards losing the data across the network being worked across these public clouds. 

Compliance: Compliance is the main risk associated with the public cloud implementation and need more attention towards this in terms of the business risks. Few customers always want their data to be stored across few locations even across the public clouds and this is the primary violation towards the public clouds and per rules; the data cross the public clouds should be made available at global level. In most of the cases, customers are the real responsible persons to this risk rather than the service providers.

 Identity management: Identity management mainly deals with the level of implementation used to identify a particular persona cross the public clouds and in most of the cases, each and every organization fails to achieve this as they are more concentrated on the data security rather than the identity management. Always the public clouds create a new opportunity across the threats and it has been noted that more identity threats are associated with the public clouds when compared with other clouds as discussed. In general the customers are responsible to handle these identity management issues and they should educate the user towards this and also have a tight audit towards the identity management across the public clouds and thus it reduces the risk for the service providers. 

Data integration: Data integration is the main issues where most of the customers and vendors of the public clouds work around and there are many chances where there can exist the data soils across the public clouds. As the public clouds are accessed by most of the end users and they can update or delete the data as per their business requirements and at end of the day, a perfect integration mechanism should be adopted in order to ensure the data stored across the data center is accurate and perfect and ready to use by a new customer for the next day. If the integration mechanism fails at the public cloud levels, the new users and the service providers hang out with the old and irrelevant data in most of the cases. A perfect integration mechanism is always missing across the public clouds due to lack of ample standards as discussed. 

Vendor viability:  Reliability is the most promising factor for almost all the organizations and their viability is measured against their duration of their operations in the market and also the level of service provided by them. In general the success or failure of any cloud implementation mainly depends on the viability of the service provided and the customers fail to assess this aspect across their clouds. There are some chances where few service providers may wind up their operations and thus if that is the case, there could be chances, where the customers loose hopes even on a good and reliable service provider as they are much worried up on the data being shared to the public clouds. 

Vendor lock-in:  Vendor lock in the issue rose due to the adoption of the culture by the service provider from the traditional software organizations. In most of the cases, these service providers will lock the customers due to many reasons and the customers should wait and request the service providers to release the required services. The most common reasons shown by the vendors is that, they usually say that the cloud is under maintenance and required some to upgrade, but the actual reasons can be something else than customer expectations. 

Resource sharing: Resource sharing can be considered as one of the primary risks associated with the public clouds. As the public clouds are designed in a manner to provide the ample services to the maximum number of customers at a single point of time, the service providers usually follow a loosely coupled resource sharing and maintenance mechanisms. The main problem with the public clouds is that, each and every user has equal rights on the cloud and demand for the resources and the other should simply wait till the cloud resources are free and this risk can’t be eliminated and if anyone want this to be streamlined, they should go for a private cloud implementation. 

Availability: Availability refers to the service providers and the common tendency of these service providers is that, they usually give lot of promises to the customers during the sing up process and the actual availability is missing in most of the cases. The main reasons for this case is that, as the public cloud is accessed by more number of people, there are many chances of cloud low operations and the corresponding service providers are worried about to bring back the services and mean while if there is any other issues, this particular service provider is not available to the customers in most of the cases and even this risk can’t be eliminated across the public or vendor clouds. 

Manageability: Manageability is the common risk associated with the public clouds and the main reason for this is that, in most of the cases the customers are not aware of the managers who are handling the cloud operations and services. As the scope of the management is very high across the public clouds, these management issues are obvious across the public clouds and can’t be skipped in most of the business cases. 

Legal ambiguity: Public clouds are grey in area in terms of the legal aspects and the corresponding agreements written are not clear in most of the cases. The main responsibility for this is with the customers and most of the customers think that, as the cloud is anyways public they take the issues in an easy manner and skip the legal versions to be identified across the public clouds. 

Thus there are many risks associated with the public clouds in terms of business and few of them are identified and reviewed above. The most common risks include the data integrity, network security and the identity management. Customers and vendors should take ample interest towards these risks management strategies for a better growth of the public or vendor clouds in future.