Engineering-Computing Academy of
Science and Technology
BSIT
I
Course Code MMS 1A
Course Description Information Assurance and Security
Module Title Security in Cloud Computing
I. INTRODUCTION:
Cloud security is a collection of procedures and technology designed to address external and
internal threats to business security. Organizations need cloud security as they move toward
their digital transformation strategy and incorporate cloud-based tools and services as part of
their infrastructure.
II. PRE- DISCUSSION ACTIVITY:
In your own words (2-3 sentences each number) define the following:
1. Computing
2. Security
[Link]: CHAPTER 3” Cloud Computing”
Cloud Computing
Cloud computing is the delivery of different services through the Internet. These
resources include tools and applications like data storage, servers, databases,
networking, and software.
Cloud computing is on-demand access, via the internet, to computing
resources—applications, servers (physical servers and virtual servers), data
storage, development tools, networking capabilities, and more—hosted at a
remote data center managed by a cloud services provider (or CSP). The CSP
makes these resources available for a monthly subscription fee or bills them
according to usage.
Engineering-Computing Academy of
Science and Technology
BSIT
I
Compared to traditional on-premises IT, and depending on the cloud services
you select, cloud computing helps do the following:
Lower IT costs: Cloud lets you offload some or most of the costs and effort of
purchasing, installing, configuring, and managing your own on-premises
infrastructure.
Improve agility and time-to-value: With cloud, your organization can start
using enterprise applications in minutes, instead of waiting weeks or months for
IT to respond to a request, purchase and configure supporting hardware, and
install software. Cloud also lets you empower certain users—specifically
developers and data scientists—to help themselves to software and support
infrastructure.
Scale more easily and cost-effectively: Cloud provides elasticity—instead of
purchasing excess capacity that sits unused during slow periods, you can scale
capacity up and down in response to spikes and dips in traffic. You can also take
advantage of your cloud provider’s global network to spread your applications
closer to users around the world.
Challenges of Cloud Computing
1. Data Security and Privacy
Engineering-Computing Academy of
Science and Technology
BSIT
I
Data security is a major concern when switching to cloud computing. User or
organizational data stored in the cloud is critical and private. Even if the cloud
service provider assures data integrity, it is your responsibility to carry out user
authentication and authorization, identity management, data encryption, and
access control. Security issues on the cloud include identity theft, data breaches,
malware infections, and a lot more which eventually decrease the trust amongst
the users of your applications. This can in turn lead to potential loss in revenue
alongside reputation and stature. Also, dealing with cloud computing requires
sending and receiving huge amounts of data at high speed, and therefore is
susceptible to data leaks.
2. Cost Management
Even as almost all cloud service providers have a “Pay As You Go” model, which
reduces the overall cost of the resources being used, there are times when there
are huge costs incurred to the enterprise using cloud computing. When there is
under optimization of the resources, let’s say that the servers are not being used
to their full potential, add up to the hidden costs. If there is a degraded
application performance or sudden spikes or overages in the usage, it adds up to
the overall cost. Unused resources are one of the other main reasons why the
costs go up. If you turn on the services or an instance of cloud and forget to turn
it off during the weekend or when there is no current use of it, it will increase the
cost without even using the resources.
3. Multi-Cloud Environments
Engineering-Computing Academy of
Science and Technology
BSIT
I
Due to an increase in the options available to the companies, enterprises not
only use a single cloud but depend on multiple cloud service providers. Most of
these companies use hybrid cloud tactics and close to 84% are dependent on
multiple clouds. This often ends up being hindered and difficult to manage for the
infrastructure team. The process most of the time ends up being highly complex
for the IT team due to the differences between multiple cloud providers.
4. Performance Challenges
Performance is an important factor while considering cloud-based solutions. If
the performance of the cloud is not satisfactory, it can drive away users and
decrease profits. Even a little latency while loading an app or a web page can
result in a huge drop in the percentage of users. This latency can be a product of
inefficient load balancing, which means that the server cannot efficiently split the
incoming traffic so as to provide the best user experience. Challenges also arise
in the case of fault tolerance, which means the operations continue as required
even when one or more of the components fail.
5. Interoperability and Flexibility
When an organization uses a specific cloud service provider and wants to
switch to another cloud-based solution, it often turns up to be a tedious
procedure since applications written for one cloud with the application stack are
required to be re-written for the other cloud. There is a lack of flexibility from
switching from one cloud to another due to the complexities involved. Handling
data movement, setting up the security from scratch and network also add up to
Engineering-Computing Academy of
Science and Technology
BSIT
I
the issues encountered when changing cloud solutions, thereby reducing
flexibility.
6. High Dependence on Network
Since cloud computing deals with provisioning resources in real-time, it deals
with enormous amounts of data transfer to and from the servers. This is only
made possible due to the availability of the high-speed network. Although these
data and resources are exchanged over the network, this can prove to be highly
vulnerable in case of limited bandwidth or cases when there is a sudden outage.
Even when the enterprises can cut their hardware costs, they need to ensure
that the internet bandwidth is high as well there are zero network outages, or
else it can result in a potential business loss. It is therefore a major challenge for
smaller enterprises that have to maintain network bandwidth that comes with a
high cost.
7. Lack of Knowledge and Expertise
Due to the complex nature and the high demand for research working with the
cloud often ends up being a highly tedious task. It requires immense knowledge
and wide expertise on the subject. Although there are a lot of professionals in the
field they need to constantly update themselves. Cloud computing is a highly
paid job due to the extensive gap between demand and supply. There are a lot
of vacancies but very few talented cloud engineers, developers, and
Engineering-Computing Academy of
Science and Technology
BSIT
I
professionals. Therefore, there is a need for upskilling so these professionals
can actively understand, manage and develop cloud-based applications with
minimum issues and maximum reliability.
Cloud Security
Cloud security is a discipline of cyber security dedicated to securing cloud
computing systems. This includes keeping data private and safe across online-
based infrastructure, applications, and platforms. Securing these systems
involves the efforts of cloud providers and the clients that use them, whether an
individual, small to medium business, or enterprise uses.
Cloud security is the whole bundle of technology, protocols, and best practices
that protect cloud computing environments, applications running in the cloud,
and data held in the cloud. Securing cloud services begins with understanding
what exactly is being secured, as well as, the system aspects that must be
managed.
As an overview, backend development against security vulnerabilities is largely
within the hands of cloud service providers. Aside from choosing a security-
conscious provider, clients must focus mostly on proper service configuration
and safe use habits. Additionally, clients should be sure that any end-user
hardware and networks are properly secured.
Engineering-Computing Academy of
Science and Technology
BSIT
I
The full scope of cloud security is designed to protect the following, regardless of
your responsibilities:
Physical networks — routers, electrical power, cabling, climate controls, etc.
Data storage — hard drives, etc.
Data servers — core network computing hardware and software
Computer virtualization frameworks — virtual machine software, host
machines, and guest machines
Operating systems (OS) — software that houses
Middleware — application programming interface (API) management,
Runtime environments — execution and upkeep of a running program
Data — all the information stored, modified, and accessed
Applications — traditional software services (email, tax software, productivity
suites, etc.)
End-user hardware — computers, mobile devices, Internet of Things (IoT)
devices, etc.
Cloud computing operates in three main environments:
Engineering-Computing Academy of
Science and Technology
BSIT
I
1. Public cloud services are hosted by CSPs. These include software as a
service (SaaS), platform as a service (PaaS) and infrastructure as a
service (IaaS).
2. Private clouds are hosted by or for a single organization.
3. Hybrid clouds include a mix of public and private clouds.
CHAPTER 3” Cloud Computing Security Measures”
1) Multifactor authentication
Adopting multifactor authentication processes can help to keep your information
secure from data breaches. If you currently use cloud services in your organisation,
you’ll probably be familiar with these. Perhaps a code gets sent to your phone or you
have single-use passwords in place. While this may be more time-consuming, it’s a
simple step to take against cloud security threats.
2) Use strong passwords
Speaking of passwords, it’s crucial that users have strong passwords in place to begin
with. We recommend using a password management service, such as LastPass, to store
passwords. This allows you to create complex passwords without having to remember
them, as well as share them across the company securely. We also recommend
changing your passwords regularly for maximum security.
3) Permissions sharing
Another way to assist cloud computing security is to track who you allocate permissions
to, as well as exactly what they can access with those permissions. Data can often be
Engineering-Computing Academy of
Science and Technology
BSIT
I
compromised through the lax sharing of credentials or not updating the systems when
someone leaves the company or changes roles. Companies should ensure employees
do not share their account details with anyone as another essential security measure.
4) Ensure encryption
We recommend that any data passed between your company and the cloud is
encrypted. You can do this through a virtual private network (VPN), which ensures all
users benefit from a standard level of encryption. As the name suggests, VPNs are
private connections that nobody outside the network can access – especially useful for
remote working. There are also several third-party encryption tools out there you can
use to encrypt files before uploading them, should you prefer to do that.
5) Install anti-virus software
Sometimes cloud security isn’t at fault, it’s the system you’ve accessed it from. Shield
yourself from hackers and malicious software by ensuring your anti-virus protection is
up-to-date on every machine you use. This is particularly important for remote workers
who use their own hardware – ensure there is a policy in place for this.
6) Back-up your data
One of the most important cloud computing security measures you can take is backing
up your data. It’s crucial to have a contingency plan in place should anything happen to
your information, such as loss or corruption. You may opt to have a local back-up or
even utilise another cloud service – or do both. You can never have too many back-ups!
Engineering-Computing Academy of
Science and Technology
BSIT
I
7) Put it to the test
Often the best way to ensure cloud security is to test it out. If you are a large
organisation with highly sensitive information on the cloud, you can hire ethical hackers
to assess how safe it really is. Your cloud provider should also be able to offer
vulnerability testing, which should be an ongoing process to keep your security up-to-
date.
While the potential security issues in cloud computing may seem daunting, the pros far
outweigh the cons. Employing strong, but simple security measures and finding a
trustworthy cloud provider will help to ensure your data is safe. Find out more about
our cloud services online and get in touch with the team today to discuss your
migration.
IV. ASSESSMENT:
1. Define Cloud Computing
2. What are the cloud computing security measures?
Reference List:
Cloud Computing
[Link]
Prepared by: Reviewed by: Recommending Approved:
Approval:
Justin Nichol P. Jane M. Fernandez Virgo Lopez Rhonda Padilla
Pasamonte Dean,E-Coast Vice President for President
Faculty,E-Coast Academics