Chapter 1

Overview of Cloud Computing

1.1 Introduction
The era of cloud is the latest trend which provides various types of on-demand
services to the user on the basis of ‘pay-per-use’ manner, depending upon the
requirements of the end-users. The cloud computing has gained lots of pop-
ularity and gradually it is expanding its services to address millions of user’s
demand. The vision of cloud computing industries for the 21st century is
to grant computing services in a convenient way just like any other basic
services like water or electricity [1]. There is no longer a need to invest on
IT infrastructure or developing buildings for initial set-up, and hiring skilled
workforce, to run a business. Cloud computing allows small business owners
to start the business quickly by using cloud services, without thinking about
purchasing and setting-ups large infrastructure. Cloud computing uses various
technologies such as virtualization, distributed computing, cluster computing,
and service-oriented architecture (SOA), etc. [2]. Cloud computing is devel-
oping and constantly improving technology that still does not have any unan-
imous definition. Various opportunities are provided by the cloud computing
to the IT industries by offering a variety of services.
The traditional IT enterprise set-up requires a large infrastructure such as
big land space, hardware devices, expensive software licenses, and a big team
of IT experts for the establishment of the company. As time passes, there
is a requirement to upgrade the whole system of hardware and software to
maintain the growth and scalability of the company. Hence, it requires lots
of money, resources, and time to maintain and provision the services in tra-
ditional way. It makes traditional computing less economical way to start a
new business or upgrade the existing ones. Therefore, cloud offers a better
economical solution to address the need of organizations. In cloud computing,
there is no need to care about the failure and maintenance of any hardware
and software services. Developers can focus more on their coding skills rather
than focusing on setting up the test environment by downloading and in-
stalling various software [3].
Cloud computing is one of the evolving technologies which has been widely
used for IT outsourcing, infrastructure provisioning, platform provisioning,
software provisioning and database provisioning, etc. Let us now define the

DOI: 10.1201/9781003004486-1 3
4 Cloud Security: Attacks, Techniques, Tools, and Challenges

cloud computing term in a more formal way. Cloud is a term that has been
used historically by the telecommunication industries as an abstraction of
the network for the representation of the system diagram. Cloud computing
refers to an Internet-centric computing with virtual infrastructure. The Na-
tional Institute of Standard and Technology (NIST) proposed a definition of
cloud computing [4]. As per this definition “Cloud computing is a model for
enabling ubiquitous, convenient, on-demand network access to a shared pool
of configurable computing resources(e.g., networks, servers, storage, applica-
tions, and services) that can be rapidly provisioned and released with minimal
management effort or service provider interaction”. The definition is more fo-
cused on three main characteristics: (i) Cloud services are scalable, (ii) The
overall cost is charged on the basis of usage, and (iii) The quality of services
is distributed and managed to the clients.
Foster et al. [5] described grid computing along the concept of cloud com-
puting. Authors described the cloud computing as a kind of distributed com-
puting that is focused on the large-scale paradigm that contains a abstracted
pool, scalable, virtualized, dynamic, managed computation resources, large
storage and virtual platforms, which are delivered on-demand through the
Internet. The adoption of cloud services such as deployment environment, in-
frastructure, or applications has different impact on the industries. There are
several perspectives which can have the potential benefits of cloud services
such as: (i) It provides a simple process to establish an environment for ap-
plication development, (ii) It provides the potential to shorten the process of
idea to product, (iii) It provides better solution for the business community,
(iv) Simplifies the process for application development, and (v) Provides as-
surance of the quality of services like security and availability when required
[6]. However, there are still many issues which need to be addressed by the
vendors before provisioning any of the services online.
Let us now understand the technical terminologies of cloud architec-
ture. An OpenStack [7] cloud architecture is considered here a base model.
OpenStack is a global leading cloud management software opted by many
companies for developing cloud platform for public, private, or hybrid cloud.
It will be discussed in forthcoming sections. The key technology in the cloud
environment is virtualization which creates an abstraction layer above the un-
derlying hardware or software. It hides the complexity of physical hardware
and allows multiple operating systems to run on the same physical machine.
The abstraction layer is called as Virtual Machine Monitor (VMM) or Hyper-
visor. The cloud architecture with Xen as VMM is considered here. Xen VMM
is booted first as a primary boot system. Afterward, Linux kernel is loaded
as Dom0 domain by the Hypervisor. Dom0 is the privileged domain (admin-
istrative VM) which is used to control, configure, and manage all the other
VMs by the cloud administrator. Dom0 runs the device drivers and can ac-
cess the actual hardware, as shown in Figure 1.1. The networking between the
TVMs is provided by VMM. Networking in VMM bridges the virtual adapter
to the physical adapter. The tenant virtual machines (TVMs) are loaded after
 Overview of Cloud Computing 5

FIGURE 1.1: Basic architecture of Xen.

Dom0 and are also referred as untrusted domains (DomUs). VMM has the
highest privilege and full control over any VM running over it. Let us now
start understanding the cloud computing architecture.
A cloud environment typically consists of three types of servers: Cloud
Controller Server (CCS), Cloud Compute Server (CCoS), and Cloud Net-
working Server (CNS) [8], as shown in Figure 1.2. The CCS is mainly used
to handle all management-related work. The user VMs are hosted in CCoS
server. The CNS manages the network, routes the packets, and allocates IPs
to the nodes, etc. There are three types of cloud network: administrative, ex-

FIGURE 1.2: Basic architecture of cloud environment.

6 Cloud Security: Attacks, Techniques, Tools, and Challenges

FIGURE 1.3: History of cloud computing.

ternal, and tenant network. The tenant network carries the tenant’s data and
ensures the end-to-end transportation. Each tenant network connects a set
of VMs and is vulnerable to the threats. The administrative network mainly
deals with carrying the data corresponding to management commands such
as allocating, destroying, creating, and resuming TVM. The external network
connects cloud VMs to the external users via Internet. The administrator of
the cloud can configure the entire access control policies and has got highest
privileges in cloud environment.

1.2 History and Underlying Technologies

Basically, cloud computing is not a new idea or a new technology. It has been
evolved over the years. A brief history of cloud computing is shown in the
Figure 1.3. In the 1960s, John McCarthy [9] already anticipated that there
will be some computing facilities available for the general public like a util-
ity. In the same year, IBM and DEC used to provide their computers on
sharing basis [10]. IBM announced its first VM which runs on the physical
hardware, and creates the virtual machine environment in the year 1972 [11].
The cloud symbol was used in the year 1977 [12]. In the 1990s, the term cloud
has been used to describe a large ATM network. After the evolution of Inter-
net and world wide web, the term ‘cloud’ is coined by Ramesh Chellapa in
the year 1997 [13]. In the year 2006, it was used to describe a business model
by Google’s CEO Eric Schmidt [14]. After that, it gained a lot of popularity.
Since then, cloud computing has been mainly used to represent as a marketing
term in several business ideas. In July 2008, some big giants like HP, Yahoo,
and Intel announced a global computing laboratory, cloud computing, which
enriched with a variety of platforms for sharing the resources and technol-
ogy in the area of cloud [14]. Voas and Zhang [15] demonstrated six different
 Overview of Cloud Computing 7

phases of cloud computing evolution. Firstly, end-users can interact with a

mainframe which supports multiple applications. Users can interact directly
with their own system which drops the hardware cost with high computa-
tional power. Resource sharing can be done through a type of network either
LAN or WAN in the third phase. The Internet services can provide access to
remote services with an active account pay-per-basis. The next phase provides
high-performance computing and throughput using grid computing. Finally,
it provides all computing services through the Internet.
The concept of cloud computing is an outcome of evolution and advance-
ments of many other technologies, which makes cloud computing more pow-
erful. As the technologies grow, it introduces several emergences with other
key technologies. However, there are some key technologies that played a key
role in the development of cloud computing like mainframe, grid computing,
web 2.0, or service-oriented computing, etc. Let us now discuss some of the
key technologies:

1.2.1 Mainframe computing

Mainframe [16] is one of the key technologies which has large computational
facilities with multiple processing units. It provides large input-output opera-
tions, reliable computational technology, massive data movements, and pow-
erful tools. Generally, this kind of technology is used by large industries for the
transfer of bulk data, online transactions, resource planning, and operations
that are dealing with large input-output operations. Mainframes offer a large
computational platform with multiple processors that has the ability to pro-
cess the data as a single entity. Mainframes have a great feature of sustaining
computationally expensive load for many hours. It can handle all kinds of fail-
ures transparently. The systems were highly reliable due to the replacement
of the faulty components without shutting down the system. The key feature
of the mainframe systems was batch processing. Although the popularity of
these systems is reduced nowadays. Some latest versions of the system are still
used in online transactions, airline ticketing, and several government online
platforms, etc.

1.2.2 Cluster computing

Cluster computing [17] is an alternative or a low-cost choice to the super-
computers or mainframes. Cluster computing is a set of connected computers
with a high bandwidth network that behaves as a single unit. It can be con-
trolled by some set of tools. (as shown in Figure 1.4). These computers are
connected through a local area network and run its own instance of an oper-
ating system. Cluster computing provides high-speed computing and parallel
computing in the 1980s [1]. The main advantage of these systems is that they
have very cheap cost as compared with the mainframe computers and used
in some small organizations. Cluster computing has emerged with a several
8 Cloud Security: Attacks, Techniques, Tools, and Challenges

FIGURE 1.4: Cluster computing.

high-speed processors, low-cost platforms with connectivity, and software tools

for distributed computing. These kinds of systems provide higher reliability
due to easy detection and replacement of a faulty node. Load-balancing and
high-availability clusters improve the overall performance. The evolution of
cluster computing has contributed a lot toward the development of parallel
virtual machine (PVM) and message passing interface (MPI). It also provides
the ability to provide scalability if required with the increasing demand of
computational power.

1.2.3 Grid computing

In the early 1990s, grid computing [18] was introduced as an evolution of clus-
ter computing. It also makes use of group of physically connected computers
to execute a single dedicated operation and to solve some complex problems.
A grid is connected using a grid middleware software which is used to trans-
late the information from one format to another recognizable format. Let us
differentiate between the cluster and grid computing. Grid computing nodes
can be dispersed geographically and heterogeneous; whereas in cluster com-
puting, all nodes must be managed in a single location with a network. Grid
computing is also known as the predecessor of cloud computing due to its pro-
cessing power and distributed nature. The architecture of grid computing can
be used for redundant network connection and load-balancing environment.
The major benefit of grid computing is that it provides parallel processing
which enables a developer to divide a program into small segments and solve
the same each segment problem independently and then combine the results
of each segment to produce a single solution. Grid computing can be used for
a large organization where several machines are sitting idle at a particular
moment.
 Overview of Cloud Computing 9

1.2.4 Distributed and parallel computing

In the early 21st century, there were requirements of multiprocessor design
and faster programs to solve complex problems. Distributed and parallel com-
puting [19] address the problem and act as a foundational model of cloud
computing that supports connectivity of multiple nodes with a network. The
parallel and distributed computing provides several basic services like consis-
tency in memory updation, concurrency, mutual exclusion, message-passing,
and shared-memory. The major difference between these two is that dis-
tributed computing supports multiple processors that may be distributed in
different nodes and connected via memory channel using a common network.
Whereas parallel computing supports multiple processors deployed in same
node and communicate with shared memory bus. There are two kinds of pro-
cessor architecture in parallel computing: tightly coupled and loosely coupled
architectures. Tightly coupled multiprocessors are able to share memory and
communicate by information exchange among processors. In loosely coupled
multiprocessors, communication can be done by sending messages to each
other across the physical links. The most efficient topology of parallel com-
puting is a hypercube, in which each node is connected directly with some
neighbors.

1.2.5 Virtualization
Virtualization [20] is introduced around 40 years ago but it has limited number
of applications. It has not been utilized efficiently due to resource constraints.
However, these limitations have overcome and it has become the foundational
element of cloud. Virtualization allows the end-user to access several com-
putation technologies and storing components on-demand with a pay-per-use
basis. The main utilization of virtualization is that it simulates the interface
between hardware and end-user. Virtualization can be integrated with several
latest technologies, which helps in developing a powerful computing environ-
ment. Hardware virtualization integrated with the software stack provides the
platform called virtual machine instances. Several virtual machine instances
can be executed on high performance computers. To replicate the runtime
environment of programs, virtualization can be used. There are several types
of virtualization types such as hardware, software, storage, and operating sys-
tem virtualization. Virtualization is supported by specialized software such
as Hypervisor which provides connectivity between the server and the virtual
environment.

1.2.6 Web 2.0

A web interface is required through which cloud computing can deliver its ser-
vices. Currently, the web has been evolved with several services and function-
alities like interactive sharing, collaboration, the composition of application,
10 Cloud Security: Attacks, Techniques, Tools, and Challenges

and user-centered design. Web 2.0 [21] is the current state of online technology
that provides several new features as compared to the web. It provides the
better user interaction, improved channels, and collaboration. Web 2.0 is an
extended and dynamic version of the web which is able to share information
online through social media, Internet, and web-based communities. There are
several advantages of web 2.0 such as rich web application, latest technical
specification, user-friendly, and dynamic learning communities. There are sev-
eral applications of web 2.0 such as Google Maps, Flicker, Facebook, Blogger,
and YouTube. Flicker provides some advanced services to store digital im-
ages, videos, and online diaries. It brings interactivity and flexibility of the
web pages to improve the user experience using web-based access for desktop
applications. Finally, the main aim of web 2.0 is to leverage the utility of the
Internet to everyone.

1.2.7 Service-oriented computing (SOC)

SOC [22] is the foundational model for cloud computing and provides support
to the low-cost, flexible, and interoperable system. A good SOC model must
have the following properties like loosely coupled, platform-independent, and
transparent to the location. It is difficult to endeavor to adopt the SOC due
to the early stage of the technology and incompleteness of web services. There
are several standards for web services such as Web Services Description Lan-
guage (WSDL), the Simple Object Access Protocol (SOAP), and the Business
Process Execution Language (BPEL). SOC introduced two main concepts
such as Software-as-a-service (SaaS) and quality of service. The term SaaS
has been inherited from the application service provider (ASP) that delivers
the software services across the world on-demand and rental basis. Quality of
service requirements can be shared among the client and the providers. SOC
relies on service-oriented architecture (SOA) to build a service model and a
way to recognize applications and infrastructure. SOA is capable of the ser-
vice discovery, integration, and overcome different challenges of distributed
computing.

1.2.8 Utility computing

It provides computational services through an on-demand and pay-per-use ba-
sis. Utility computing [23] is a popular IT service that provides flexibility to
the end-user. Users can access these services economically. Utility computing
is a model that is very similar to basic service models such as electricity, tele-
phone, and gas. The end-user can access the services virtually using a virtual
private network through the Internet. The back-end services and infrastruc-
ture is managed by the service providers. There are several applications of
utility computing such as grid computing, cloud computing, and managed IT
services. It also includes some basic storage functionalities like virtual storage,
virtual server backup, virtual software platform, online backup, and most IT
 Overview of Cloud Computing 11

FIGURE 1.5: Cloud characteristics, service models, and deployment models.

solutions. Scalability, elasticity, virtualization, automation, and standard util-

ity computing are some of the characteristics of utility computing. The main
advantage of this model is that it reduces the cost of IT services, hardware,
and optimum utilization of existing services.
Let us understand the cloud characteristics, deployment models, and
service models which are explained in below sections and also shown in
Figure 1.5.

1.3 Definitions and Characteristics

The US Department of Commerce introduced an agency that is responsible
for providing standards in the field of Science and Technology, named the
National Institute of Standards and Technology (NIST). The NIST worked
continuously and after the 15th version. The NIST definition [24] of cloud
computing presents, “Cloud computing is a model for enabling ubiquitous,
convenient, on-demand network access to a shared pool of configurable com-
puting resources (e.g., networks, servers, storage, applications, and services)
12 Cloud Security: Attacks, Techniques, Tools, and Challenges

that can be rapidly provisioned and released with minimal management effort
or service provider interaction.” According to the NIST, few characteristics of
cloud are as [4]: broad network access, on-demand self-service, rapid elasticity,
resource pooling, or expansion, and measured service.
• On Demand Self Service: Email, services of server, application, or
network kind of computer services can be provided without explicit in-
tervention of the service provider. It also ensures that the customer
can perform all the required actions himself without any help from IT
experts. For example – any request of the consumer must be automat-
ically processed by the cloud platform, without explicit interaction of
the provider.
• Broad Network Access: The NIST ensures that the services of cloud
computing are available over the network through the Internet, which
can be used by diverse consumers like IoT devices, cell phones, and
laptops.
• Resource Pooling: To serve the multiple consumers with different ge-
ographical locations, providers used to pool the virtual resources and
dynamically assign them to the clients on-demand. At the higher level
of abstraction, customers must be able to specify locations like country,
data-center, etc.
• Rapid Elasticity: To scale on-demand, the capabilities available can
be elastically provisioned and released. The rapid elasticity can be dis-
bursed to provide the quantity.
• Measured Services: Cloud service can automatically control and opti-
mize resources at the level of abstraction according to the service type.
The resources should be monitored, controlled, and reported to have
transparency for all customers as well as provider.

1.4 Cloud Service Models

The cloud computing model is capable of providing convenient, on-demand,
and ubiquitous network access to storage, and services that can be provisioned
with minimal intervention. The cloud service providers (CSPs) ensure that the
cloud services are having the computational capabilities which can support
the essential characteristics of cloud computing. There is three kinds of possi-
ble service models provided by cloud computing such as Software-as-a-Service
(SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS)
[25]. The major factors to categorized cloud services are the cloud service
customers (CSCs) like end-user, IT operations, or developers, and computing
 Overview of Cloud Computing 13

capabilities like software, infrastructure, or platform. As per the NIST cloud

computing reference architecture (CCRA), the services are available at the
service layer of the orchestration layer. The explanations of the services are
as follows.

1.4.1 Software-as-a-service (SaaS)

SaaS [26] model enables the access to cloud-based web application with the
existing infrastructure of the organizations. The SaaS applications run on the
CSP’s side and maintained and controlled by the vendors. The services can
be accessed with a paid licensed subscription, or for free but with limited ac-
cess. To access the services of the cloud, one is not supposed to install any
new application, infrastructure, or software. The major benefits of SaaS are
affordability, ready-to-use, affordable, and accessible anywhere. There is no
requirement of having on-premise hardware for the cloud service model which
is opted by small-scale organizations. These services can be accessed any-
where with Internet connectivity. The applications integrated with the SaaS
are ready to use services and require no set-up or installation. Although there
are several benefits of this service model, some demerits are also there in the
SaaS model like lack of control (full access of the vendors) and slower speed
(applications are accessed through the Internet and run in remote servers).
The SaaS-based cloud services have fewer features and functionalities as com-
pared to the client-server co-relations. Although these disadvantages can be
avoid if the organization deals with the offered features only.

1.4.2 Platform-as-a-service (PaaS)

A third-party vendor provides a platform through which we can develop, test,
or run the applications. PaaS [27] service model has the capability to eliminate
the need for in-house premises hardware and software installations. Unlike
SaaS, we can control and manage the underlying cloud platform through the
deployed applications. Default services are offered in terms of the servers,
networking, or storage manageable by the vendors or the platform providers.
The main advantages of the Paas service model are cost-effectiveness, multiple
programming language support, scalability, minimum development time, and
enhanced collaboration. In the PaaS model, it is difficult to switch from one
PaaS vendor to another vendor, which is the major drawback of this model.
PaaS model is having some security and compatibility issues with the cloud
model. So, due to compatibility issues, we may be required to leave some
elements out of the cloud model.

1.4.3 Infrastructure-as-a-service (IaaS)

IaaS [28] is the most flexible cloud model which provides the complete
and scalable control over the customization and management with existing
14 Cloud Security: Attacks, Techniques, Tools, and Challenges

infrastructure. This model has the capability to replace the traditional in-
frastructure components and on-premise data-centers like servers, networking
devices, and storage units. It provides a virtual provision of computing ser-
vices over the cloud through the Internet. Amazon Web Services, Microsoft
Azure, and Google engines are some of the examples of the CSPs. Minimized
capital cost, simple deployment, and flexibility are the main advantages of the
IaaS model. In the IaaS model, it is very easy to deploy the servers, storage,
and networking for smooth functioning. However, the cost of the IaaS model
is more than the PaaS or SaaS model. It’s difficult to get the detailed insight
details of the IaaS model due to restrictions imposed by cloud admin.

1.5 Cloud Deployment Models

Cloud services are the future of IT solutions which is all about outsourcing the
services and infrastructure to access it through the Internet. The growth of
cloud computing enhances the service deployment models [29] and its strate-
gies. So, there are several enterprises of cloud solutions which depend on the
degree of required outsourcing. To enable the fast-loading, there are thou-
sands of servers and storage devices of cloud hubs. Cloud hubs are given the
priorities to the user according to the closeness of the user’s geographical loca-
tion. Therefore, the deployment models of cloud computing can be categorized
based on geographical location. A more specific categorization is provided ac-
cording to the administrative domains of the cloud. The categories of various
deployment models are as follows.

1.5.1 Private cloud

Private cloud [30] can be used by stand-alone organizations. It also provides
control over security and backed up by a firewall that can be hosted externally
or internally. These kind of clouds are implemented within the campus or a
building for private use and generally can be accessible to the organization
itself. Private clouds are the best solution for the organizations which require
high-security and availability. It also has the possibility of testing applications
and systems with low cost as compared to other cloud services. Some key
advantages of private clouds are as follows:

• Information Protection: The first and major key advantage of private

cloud is to keep the information safe within the premises of the organiza-
tion. Although several public cloud vendors claim for the good quality
services with high-security. There are lots of vulnerabilities which are
founded by several hackers in the past.
 Overview of Cloud Computing 15

• Assure Service Level Agreements: Data replication, monitoring and

maintenance, recovery, and appropriate recovery mechanisms are some
of the requirements which are expected from the private cloud to ensure
the quality of services. Although public cloud vendors provide some of
the features. All features can be achieved through the private cloud.
• Compliance Using Procedure: To deploy and execute some appli-
cations through any third-party services, the standard procedure and
operations need to be ensured. It may not be possible for virtual public
infrastructure.
These kinds of services and benefits make the private cloud more secure and
available for better services. If we consider the architectural view, private
clouds are heterogeneous in nature due to deployment using existing infras-
tructure. It could be a desktop grid, a cluster, a data-center, or a combination
of them. Although private cloud has lots of features, they have limited capa-
bility to scale elastically on-demand when compared with the public clouds.

1.5.2 Public cloud

Public cloud [31] services are provided for public use through a network for
general use. End-users do not have any control over the location of infras-
tructure. The canonical viewpoint of the public clouds says that services are
available with anyone, from anywhere using the Internet. Public clouds are
available as a shared cost model or pay-per-use per user basis. These kinds of
model are best suited for the growing or variable requirement organizations.
They offer the solution to minimize the IT infrastructure cost and can handle
the existing infrastructure. There are some key advantages of public clouds.
• Multi-tenancy: A public cloud has a multitude of users, not as a single
user and a user can work in a virtual environment separately than the
other users. This is one of the primary requirements to provide effective
monitoring of the user and provide quality of services.
• Ubiquitous Model: A public cloud is able to offer all three service
models such as platform (for example, Google AppEngine), infrastruc-
ture (for example, Amazon EC2), and Software (for example, sales-
[Link]).
• Less Restrictions: If we consider an architectural view of public clouds,
there are very few restrictions. Public clouds can be composed of geo-
graphically dispersed data-centers to share the load of users and to serve
server them according to their locations.
These kinds of clouds are having several benefits but less secure due to avail-
ability for the general users. Public clouds also provide a wide range of services
to the end-user with the existing infrastructure. So, there is no need to set-up
high configuration hardware or software to start a new organization.
16 Cloud Security: Attacks, Techniques, Tools, and Challenges

1.5.3 Community cloud

Community clouds [32] are distributed systems that can be created with the
help of distinguishing cloud integration to address the specific requirements.
Basically, it is a mutually shared model among several organizations which
are belonging to a particular community like government agencies, banks,
scientific research, and commercial organizations, etc. These models of cloud
can be developed by an internal employees or third-party vendors by multiple
administrative domains. Some key benefits of community clouds are discussed
as below:
• Control and Convenience: Community clouds have enough flexibility
to design it as per the requirements. So, there is no conflict between
control and convenience that can make all decisions through a collective
effort.
• Environmental Sustainability: Community clouds are supposed to
emit less carbon due to the under-utilization of resources. So, these
clouds tend to provide more environmental sustainability.
• No Single Point of Failure: There are multiple administrative hosts
that provide infrastructure and support to the community cloud. If there
is one system failure, then the remaining system will work properly.
A community cloud can also be formed as an aggregation of the resources
of several communities. Community clouds are heterogeneous in nature and
independent from the vendor’s agreements. These clouds are also known as
open systems due to that fair competition among different solutions.

1.5.4 Hybrid cloud

Hybrid cloud [32] consists of a large hardware and software infrastructure
that can fulfill the requirements of multiple users. This model combines the
best practices of a public and private cloud but as separate entities. A hybrid
cloud can provide scalability, security, and flexibility to the end-user. There is
an ideal situation of the organization in which an organization uses a private
cloud within the organization and uses the public cloud to interact with its
customers. There are some key points about hybrid clouds:
• Scalability: Hybrid clouds can address the scalability issues and can
provide distinguished clouds for different services. For example, to deal
within the premises and outside of the premises.
• Cloud-Bursting: In the hybrid cloud, we can have several services or
resources for a time period till required which can be released after usage.
This kind of flexibility is provided by the hybrid cloud and is known as
cloud-bursting.
 Overview of Cloud Computing 17

• Infrastructure Management: Hybrid clouds provide the facility of

infrastructure management software like OpenNebula which is a kind of
scheduler that provides cost-based scheduling.
The provisioning of services can leverage the distinguished other services to
ensure the quality of services. There are several other benefits of hybrid cloud
such as higher efficiency, faster deployment, low upfront cost, and simple to
manage infrastructure.

1.6 Cloud Service Platforms

In this section, various cloud service platforms are explained which are offered
by various cloud vendors.

1.6.1 Amazon web service (AWS)

Amazon Web Services began its IT infrastructure services for various firms
which are provisioning web services. These services are known as cloud com-
puting nowadays. The main advantage of this kind of services is that they
replace capital expenditure to operational expenditure (low-cost paradigm).
AWS provides a scalable, reliable, and low-cost infrastructure in the cloud that
provides hundreds of businesses around the world. AWS provides computation
services and various other services to help grow an organization. The services
are based on several protocols such as HTTP, REST, and SOAP protocols.

1.6.2 Microsoft azure

Microsoft Azure [33] service is provided for Windows platform that mainly
have three components that provide particular services to the end-users such
as windows Azure, SQL, dot NET, and azure services. The services run on
the cloud servers. For example, the SQL server is offered as a service by SQL
azure. The local applications are running through the .net services. There are
distinguish services which are offered for the cloud users like virtual machines,
identity, storage, mobile services, data management, and messaging, etc.

1.6.3 Google cloud platform

Google provides a cloud platform which is named as Google Compute Engine
(GCE) [34]. GCE is the IaaS component that is used for global infrastructure
which runs different services such as Gmail, YouTube, Google search engine,
and other services. A GCE instance can start with a disk resource that is
known as persistent disk. GCE provides the facility to the end users to launch
18 Cloud Security: Attacks, Techniques, Tools, and Challenges

the virtual machine on demand that can be customized according to their

requirements. It provides several features like VM performance, transparent
maintenance, billing, pricing model, and global scope for images and snap-
shots. Google VMs can boot within 30 seconds that is about 4–10 times faster
than other VMs.

1.6.4 IBM cloud

IBM provides cloud services [35] which is a public platform with different
products like storage, computation, networking, development, testing, secu-
rity, etc. The operation and management of these services is done by IBM.
The IBM cloud platform combines IaaS and PaaS and integrates the ser-
vices of infrastructure with different platforms. This cloud platform supports
both large and small organizations. IBM cloud services are built to support
the requirements of public cloud or multi-cloud model. It provides different
open-source technologies such as Kubernetes, computation options, Red Hat
Openshift, VMs, or containers. Cloud native applications can be deployed to
ensure workload portability.

1.6.5 Adobe creative cloud

The video editing, designing of the graphics, web development, and many
more services are the collection of software services which are provided by
the adobe creative cloud. Adobe creative cloud [36] is available on monthly or
annual subscription and delivered via Internet. It retains several features of
adobe creative suits with new features like instant upgradation, easy-sharing,
storage to the cloud, etc. There are some services provided by the adobe
creative cloud such as spark, premier rush, XD, Fonts, and portfolio. It is a
tool which enables both collaboration and creativity. It builds fully functional
websites from ground data to mobile designing. Creative cloud supports both
MAC OS and windows version of the system.

1.6.6 Kamatera
Kamatera [37] is a part of global cloud service provider which contains a
rich set of services for all kind of organizations. It uses most advanced tech-
nologies with high level of customer services. Kamatera is operating thirteen
global data-centers and serving thousands of customers including application
developers, international enterprises, SaaS providers, etc. It provides a rich
set of services such as cloud server with web hosting, wordpress server host-
ing, storage, cloud private network, virtual private servers, and many more.
Kamatera clients can customize the services of the company according to their
requirements and scale their services on hourly or monthly basis.
 Overview of Cloud Computing 19

1.6.7 VMware
VMware [38] is a virtual-machine platform which is an abstraction of x86 PC
hardware to execute the multiple operating system in an unmodified way.
It indicates that multiple deployments are possible for desktop applications
without rebooting or partitioning. VMware cloud comprised SaaS and IaaS
which is ideal solution for application service providers (ASPs), Internet ser-
vice providers (ISPs), and PaaS. The multi-cloud solutions can deliver a cloud
operating model for all kind of applications. It is a world’s leading public cloud
which provides protection and scaling for vSphere-based applications. VMware
reduces the overall operational overhead expenses and achieves faster cloud
strategy in terms to leveraging the existing skills. It is still continuing to invest
on people, innovation, employee productivity, and business.

1.6.8 Rackspace
Rackspace [39] offers cloud backup and block storage. Cloud block storage is
released in the year 2012 and powered by OpenStack service. The Rackspace
cloud provides cloud-based products and services, which offers cloud stor-
age, virtual private server, load balancer, backup, monitoring, and databases.
Rackspace cloud services deliver the innovative capabilities which increase ef-
ficiency, and generate new revenue streams. It provides distinguish services
such as management of hosting, professional services, security and compliance,
business intelligence, and application managed services. It is used to deliver
high performance by using solid-state drives and hard drives. Whereas backup
services provide file-level backups and compression techniques to improve
security.

1.7 Challenges Ahead

Although cloud computing has gained lots of popularity these days due to
its adaptability by the industries during a short time period. However, the
research in the cloud is still in its initial stage. There are a significant amount
of issues that are still needed to be addressed. Several new challenges also
keep emerging for industrial growth. In the current section, we discuss some
key research challenges of cloud computing.

1.7.1 Virtual machine migration

To balance the load of the data-centers in the cloud computing, virtual ma-
chine migration comes into picture. It also enables the CSP to provide the
highly responsive and robust mechanism in the data-centers. This process has
20 Cloud Security: Attacks, Techniques, Tools, and Challenges

been evolved from the process migration techniques, which are used to imple-
ment the migration in real-time. Authors of VMware [40] have performed some
live migration of VMs which can be implemented in a part of the milliseconds.
Another team of authors [41] is able to migrate the entire OS and its appli-
cations as a single unit which is able to avoid several problems like migration
at the process level and VM level. The main advantage of VM migration is to
avoid the hotspot in the real-time, which helps to detect workload hotspot.
The secure VM migration is an evolving research area in which research is
still going on.

1.7.2 Interoperability and standards

Cloud computing is a kind of service-based model to provide infrastructure
such as water and electricity. For the proper utilization of the services, several
vendors want to provide interoperability and standards between distinguish
solutions. But, vendor lock-in is one of the major obstacles against the growth
of cloud services. If an organization wants to switch its CSP, then it requires
a considerable amount of time, conversion cost, and resources. Hence, the
presence of interoperability and standards provide a room to choose the vendor
and switch them easily. There are some organizations that are leading the
path to standardize the services of cloud computing such as Cloud Computing
Interoperability Forum (CCIF), DMTF Cloud Standards Incubator, and Open
Cloud Consortium [42]. Another approach to provide the standards to the
cloud is a general reference architecture and a standard interface through
which a user can interact.

1.7.3 Security and privacy

A secure communication among cloud nodes [43] helps in meeting the confi-
dentiality and privacy of user’s data. To achieve the high-end security among
the data-centers, good security measures should be in place. One cannot rely
on CSP for providing better security solutions. The providers must achieve
the following objectives such as auditability as a check point and confidential-
ity to secure access. Confidentiality factor can be implemented through the
use of encryption techniques, whereas the auditability can be ensured by us-
ing remote attestation techniques. These techniques need a trusted platform
module as a proof of security. However, remote attestation techniques are not
sufficient. Hence, there is a need to build a trust mechanism at each layer of
the cloud. The development and deployment of efficient and robust Intrusion
Detection System (IDS) is another security challenge in cloud. Specially, some
of the intrusions may target hypervisor layer to compromise the entire system.
Introspection-based approaches play a vital role to provide cloud-specific se-
curity solutions. However, not much research work has been done in this area.
 Overview of Cloud Computing 21

1.7.4 Energy management

There is another issue with the cloud services called as management of en-
ergy. The 53% of the total expenditures of the data-centers have invested in
powering and cooling of the system [44]. Hence, CSPs have more pressure to
reduce this cost and improve the energy efficiency for the operational cen-
ters and cut down the total cost. It attracts the researchers to improve the
energy-efficient techniques and meet the requirement of government standards
as well. There are several solutions to reduce the power consumption provided
by several researchers [45] like the architecture based on the energy, scheduling
of jobs for energy-aware, and the protocols used for the networking purpose.
Although several techniques have been proposed by authors. However, it is
more challenging to achieve a trade-off among the application performance
and energy-efficient mechanisms.

1.7.5 Accessibility issues

The access control applies to the read and write allowances for [46] authenti-
cated users. The username and password are used to provide the authentica-
tion of the system. In the multi-tenant cloud environment, there are a large
number of customers. A significant number of customers are in the multi-
tenant cloud world. Each client uses website or front-end GUI to access cloud
services. Therefore, distinguished and efficient access control techniques are
required to be developed to solve the authorization issues.

1.8 Conclusion
Cloud computing has gained popularity in recent time to manage and deliver
services through the Internet. Cloud computing can provision applications,
storage space, and several software services as per the demand of users. The
ultimate aim of cloud computing is to deliver the services as pay-per-go man-
ner just like basic services such as water and electricity. In fact, a small indus-
try or start-ups can initiate their work without any pre-defined hardware or
software requirements. However, despite of having significant advantages pro-
vided by cloud computing, there are several key challenges which are still not
covered by researchers like energy management, security, trust, interoperabil-
ity, etc. We also provided some few definitions with the discussion on history
of cloud computing. Various key technologies have also been surveyed with
the emergence of cloud. The standard definition with cloud characteristics
has also been covered in the current chapter. Various cloud service models,
such as IaaS, PaaS, or SaaS have also been discussed along with cloud de-
ployment models such as private cloud, public cloud, community cloud, and
Chapter 2
Introduction to Cloud Security

2.1 Introduction
Cloud security consists of set of technologies, controls and policies designed
to protect the applications, infrastructure and data of cloud environment.
It can also be considered a sub-branch of computer security and network
security. It consists of the security constraints designed to incorporate the
cloud service provider and end-user perspectives. The importance of cloud
security has been immensely increased in the modern computing era. There
are several users who are gradually adopting cloud for hosting their appli-
cations and data. However, there are still various concerns which prohibit
the users/enterprises/organizations to adopt the cloud-based infrastructure.
Cloud Security Alliance (CSA) did a survey in the year 2019 and found that
security is the major concern for majority of users [47].
CSA’s report stated that a total of 81% users have the security concern
while adopting the public cloud platforms. Whereas 62% users are worried
about data loss and leakage risks and 57% people are worried about the reg-
ulatory compliance as shown in Figure 2.1 [47]. They found 49% users have
concern for issues related to integration with rest of non-cloud IT environment
while adopting the public cloud infrastructure. Around 44% users have legal
and cost related concerns. A total of 39% users are worried about the visi-
bility issues and 35% emphasize more on application-migration related cloud
adoption concern. There were 32% users who have concern related to lack of
expertise staff to handle the cloud services. There also stated that 23% users
have concern of not having a staff to manage cloud services. Only 2% cases
were reported for having vendor lock-in related issues.
The flexibility and easiness of cloud services have opened doors for at-
tackers. The attacking incidents which are happening in the cloud-based IT
environment, raises a big question for securing cloud environment. Some of
the security agencies have reported various attacks such as Virtual Machine
Escape, discovered by research outfit VUPEN security [48] in 2012. This at-
tack affected the error handling function of Intel processors. According to the
report of European Network and Information Security Agency (ENISA) [49],
Dropbox has been affected by Distributed Denial of Service (DDoS) attack.
The DDoS botnet was also launched against amazon web services. Hackers

DOI: 10.1201/9781003004486-2 25
26 Cloud Security: Attacks, Techniques, Tools, and Challenges

FIGURE 2.1: Concerns shown by enterprizes/user while adopting public

cloud infrastructure.

used the exploit in ElasticSearch and attacked the amazon EC2 instances in
2014 [50]. It has also been reported by cyber threat defense that 75% attacks
apply the known vulnerabilities which are still present in software in 2014
[51]. Infact Code Space is attacked by attackers, causing destruction of the
customer’s sensitive data in 2014 [52]. Symantec reported that 494 vulnera-
bilities and two zero-day vulnerability in 2015 [53].
Internet Security Threat Report stated the proportion of evasive-malware
samples in cloud environment that can detect the virtualization environment
as shown in Figure 2.2 [54]. Cisco does the recent survey and classified Trojan
as top five malware attacks to gain access to user’s computer and organization
network [55] in 2017. It is one of such attack which gains access to user’s
computers and network. The investigation carried out by cisco reveals that
75% organizations are victim of malicious software which can be used to launch
advanced attacks. As per CSA report in 2018, there were a total of 23420
phishing website links were found which have very high compared to 2016
report [56]. Recently, a cloud service provider company “iNSYNQ” became
a victim of ransomeware attack which caused shut down of their network
system, making it difficult for customer to access the services on 2019 [57].
The increasing attacking incidence each year raises a concern for security
in cloud environment. Below, some of the key vulnerabilities in cloud are
discussed which are usually exploited by attackers as shown in Table 2.1.
 Introduction to Cloud Security 27

FIGURE 2.2: The attack statistics of virtualization-aware evasive malware

samples in cloud environment.

TABLE 2.1: Key vulnerabilities in cloud environment

Vulnerabilities Consequences
Loss of physical control on the data located in remote cloud servers
Lack of physical control
can lead to data leakage and modifications, etc.
The under-provisioning of bandwidth can lead to consumption of
Under-provisioning of bandwidth
resources by causing flooding attacks such as DDoS.
Compromising the billing model of cloud can incur in generating the
Pricing model of cloud
incorrect billing information, causing disputes between CSP and tenants.
Breaching the securing control through insecure APIs can cause unauthorized
Insecure Browser and APIs
access to resources
Attackers can gain the control on the management console and gain
Illegitimate access to management interface
access to administrative access.

2.1.1 Vulnerabilities present in cloud

Let us now understand various major vulnerabilities in Cloud Computing.

Vul1 – VM Co-tenancy
The co-tenancy, also called as co-residence refers to sharing of same physical
resources by different cloud customers or tenants. Cloud computing provides
the better utilization of resources through this concept in which different ten-
ants may have their VMs, running in the same physical machine. It raises a
serious concern about security. Such a vulnerability can be exploited in launch-
ing attacks such as VM Escape attack [48], Cross-VM side channel attack [58],
etc.

Vul2 – Lack of Physical Control

In cloud computing, the tenant’s data, program and their computation is out-
sourced to remote servers of cloud. This leads to lack of physical control on
tenant’s data, programs and machine, etc., which may result in dangerous
attacks [59]. For example, the tenant’s data residing in remote cloud servers
28 Cloud Security: Attacks, Techniques, Tools, and Challenges

can be modified, leaked or even lost. An attacker can inject the malicious code
in the tenant’s software application running in cloud and cause harm in cloud
resources. It could lead to dispute between cloud service provider and tenants.
It is difficult to ensure the data confidentiality and integrity just by making
use of traditional security mechanisms.

Vul3 – Under-provisioning of Bandwidth

Traditional DDoS attacks have been prevalent in cloud computing environ-
ment as well in which network layer is flooded with excessive traffic connec-
tions to exhaust the resources. In addition, a new form of DDoS, exploits the
feature of under-provisioning of resources in cloud environment. In this form of
DoS, shared resourced such as memory, storage and computation is consumed
by attacker excessively, making the other VM users deprived from resources.
DDoS in cloud, also takes the benefit of under-provisioning of cloud resources.
CISCO’s states that a data center design is under provisioned with a factor of
2.5:1 to 8:1 which means the network capacity of data center is less than the
average capacity of hosts running in same subnet [60]. The under-provisioning
of bandwidth exploited by attackers in flooding the network.

Vul4 – Pricing Model of Cloud

Cloud Computing is based on the pay-as-you-go pricing model. The pricing
model is based on the computation of metrics such as bandwidth consumed,
servers/VM hours, storage capacity, bandwidth, CPU utilization, etc. How-
ever, if pricing model is compromised, the billing information generated by
cloud service provider will provide the incorrect information [61]. Tenants will
suffer by paying for additional billing charges. One such attack is called Eco-
nomic Denial of Sustainability (EDoS) attack [61] which affects the pricing
model of cloud adversely.

Vul5 – Insecure Browser and APIs

Cloud vendors provide a rich software API support in order to allow cus-
tomers to interact and manage with services. The APIs helps to effectively
perform the service provisioning, service orchestration, service usage and ser-
vice deallocation/release through web browser (client program). Any vulner-
ability present in the APIs can be used by attackers in breaching the security
of cloud services. There are many web-based attack possible such as phishing
attack, SSL certificate spoofing attack, cross-site scripting attack (XSS) and
sql-injection attack, etc. [62]. Web Security standards should be followed by
the APIs in order to ensure the safety of services though web-based attacks.
 Introduction to Cloud Security 29

Vul6 – Illegitimate Access to Management interface

A management interface such as AWS management console [63], is used to
manage the client’s subscription for resources such as instance, storage, com-
putation, etc. If the management console is breached by unauthorized users, it
may lead to drastic consequences. Cloud environment consists of more number
of users and administrators when compared to traditional computing envi-
ronment. It raises the probability of gaining unauthorized access to the cloud
resources through a weak management interface. Insecure cryptographic keys
and algorithms can also result in such security breach. For example, Amazon
EC2 management interface was breached in the year 2011 through XSS attack
which exploited a cryptographic loop hole in service.

Vul7 – Insecure Internet Protocols

Any algorithmic vulnerability present in internet protocol can also be helpful
for attackers in bypassing the cloud security mechanism. ARP poisoning is one
such example of protocol vulnerabilities which can be exploited by a malicious
VM user. A malicious user can exploit the vulnerability in re-routing the traffic
of some co-located VM to malicious VM. Some other attacks which exploit
protocol vulnerabilities are RIP attack, DNS poisoning attack, flooding attack,
etc. HTTP protocol is also vulnerable to session-hijacking session-riding and
used as web application protocol for web service running in cloud [64].

2.1.2 Need of cloud security

Cloud computing has become a successful business model because of the ease
and flexibility in provisioning and managing services. However, the lack of
control on data and services has raised serious concerns related to security.
Therefore, there are still many enterprises who fear in migrating their services
to cloud. In traditional data centers, there was a direct control on every layer in
the computing stack from hardware to software. However, in virtualized data
centers, the direct control is lost and complete stack comes directly under
the control of cloud service provider. Hence, an organization is required to
have a significant level of trust with cloud service provider before transferring
services into cloud. Security has been the major barrier in adoption of cloud
services over the years [47].
There are three different types of cloud service models in cloud, i.e. SaaS,
PaaS, and IaaS. The vulnerabilities and security requirements for each layer
varies from layer-to-layer. SaaS provisions the web-based services in most of
the cases through internet. Attackers target the API interface of the web
portal and sometimes the secure shell (SSH)to launch attacks in SaaS services
by hijacking private keys, credentials and API keys of the tenants. The web
interface can be exposed to cross site scripting attack (XSS) and signature
wrapping attack [62].
30 Cloud Security: Attacks, Techniques, Tools, and Challenges

Zhang et al. [65] proposed an attacking framework to launch cache-based

side channel attack in PaaS cloud. The victim’s VMs execution is traced
by providing the extended version of Flush-Reload attack. The tenants co-
location is traced first and then the private key information is extracted by
the proposed attacking framework. Other form of PaaS attack targets the
VM images and injecting malicious code resulting into data stealing [66]. IaaS
infrastructure can also be subjected to various attacks.
The cloud infrastructure can be subjected to various malware and network
attacks. For example, the virtual switch which connects the co-located VMs,
can be sniffed to monitor the network traffic of co-located VMs. The virtual
network can also be subjected to ARP spoofing, MAC spoofing attacks. ARP
spoofing is used to reroute the traffic to malicious VM by alerting the ARP
table. MAC spoofing is used to imitate another host in the same network [67].
The pricing model of cloud can also be compromised, leading to incorrect
billing report generation for the infrastructure usage or software usage or
platform usage.
CSP usually provides maximum access privileges of VMs to the cloud
customers/tenants. A malicious tenant can attempt to gain root access of
machine by installing malicious software such as rootkits. Once root access is
obtained, attacker can try to breach the security of hypervisor or even the host
operating system. In addition, nowadays, attackers are making the malware
code more advanced which senses the monitoring virtualized environment and
even the security analysis tool. On detection of the analysis environment,
malware changes its behavior and bypasses the detection approach. Hence,
traditional security techniques may fail to detect such advanced malware. A
compromised VM can be used to launch further attacks in cloud and is a big
threat to cloud. It may ultimately lead to monetary disputes between service
provider and service consumers.
One of the key features of cloud is portability and inter-operability of
services. However, the live migration of services can be exposed to serious se-
curity and privacy threats. Man-in-the-Middle (MITM) is one such threat in
which intruder can eavesdrop the connection and mimic the destination ma-
chine [68]. The sender machine will then communicate with attacker machine,
considering it as destination machine. Some of researchers, who are working
in the area of cloud security, have proposed security frameworks [69, 70] to
deal with security threats in cloud. However, a centralized security framework
becomes a bottleneck when there is an increase in the number of TVMs in
the cloud host and when the security tool uses centralized resources.
A distributed security framework that deploys the same security solution
at all layers in cloud becomes less efficient because of the limitations associ-
ated with different layers. One of the security solutions could be monitoring
specific security-layer(s) of cloud which will be centrally controlled and con-
figured by Cloud Service Provider (CSP). It will enable the CSP to assign the
specific security solution based on the tenants demands. In some of the exist-
ing frameworks, the security solution is deployed in individual tenant virtual
 Introduction to Cloud Security 31

machine which will be controlled by the administrator for security reasons.

The chances of subversion of security tool, in such a scenario is quite high.
Moreover, the security becomes much costly as individual security daemons
are developed and deployed in each of the virtual machine. Moreover, the
virtual machine-level solutions cannot be directly applied to the hypervisor-
layer. Research are working toward introspection approaches for providing the
security from hypervisor-layer.
The shared and distributed nature of cloud is complex and prone to vari-
ous security challenges. The implementation of the security solution by cloud
customers is not applicable to the management level behind the virtual infras-
tructure. Although a service level agreement (SLA) is signed between service
provider and service consumer and major security and privacy related aspects
highlighted. However, there is still no standard design methodology for SLA
[66]. Moreover, in present scenario, customers are still least aware about the
attacking incidents and open vulnerabilities and reports. There is a strong
need to work toward cloud security area to provide more efficient, transpar-
ent and distributed security solutions to deal with various cloud threats.

2.2 Cloud Security Concepts

It is important to understand some important security concepts in cloud before
understanding the security solutions. Some of the important security concepts
associated with cloud are multi-tenancy, virtualization, data outsourcing, trust
management and meta security, etc. The details for the same are given below.

2.2.1 Multi-tenancy
Multi-tenancy enables the tenant users to share the running instances. The
sharing of single cloud platform improves the efficiency of the system. In case
of IaaS cloud providers, multi-tenancy refers to the sharing of Virtual Ma-
chine Monitor (VMM) among multiple VMs. In case of PaaS cloud providers,
multi-tenancy allows the users to share the same developing platform such as
Java Virtual Machine (JVM) and .NET platform. In case of SaaS provider,
it enables the provider to share the application software among multi-tenant
users. It’s easy to maintain, configure and manipulate the data stored in the
single database. On one hand, multi-tenancy provides above benefits to the
provider; however, it also expands the threat model and can be exploited us-
ing co-residence attacks as single server is being shared by multiple VM users.
Cross VM side channel attack is one of such attack which attacks the co-
located VMs by exploiting information of side channels such as cache, power,
heat, etc. [71]. Denial of Service (DoS) is another example that can be launched
32 Cloud Security: Attacks, Techniques, Tools, and Challenges

FIGURE 2.3: Types of hypervisor.

against co-located VMs very easily. VMM DoS can even consume the resources
of the underline sharing platform [60].

2.2.2 Virtualization
The key technology in cloud environment is virtualization that powers the
cloud environment. Virtualization enables the extraction of computing re-
sources, services, operating system and applications from underline infras-
tructure on which they run. Two key components of virtualization are vir-
tual machine (VM) and hypervisor/virtual machine monitor (VMM). A VM
basically represents the emulation of the physical resources which runs an
operating system called as guest OS. The emulated devices such as virtual
RAM, virtual disk, virtual network interface card (vNIC) card provide the
same functionalities of physical devices. A guest OS can host different ap-
plications and does not have direct access to hardware. VMM or Hypervisor
runs above the hardware or software and hides the complexity of physical
hardware. It allows the execution of multiple guest operating systems (OSes)
in same machine. Hypervisor can easily create, delete and run different VMs
having different OSes installed which is an essential requirement to provide
the elastic and on-demand services in cloud computing. There are two types
of hypervisors: Bare Metal Hypervisor (called Type I) and Hosted Hypervisor
(called Type II), as shown in Figure 2.3. In former case, VMM can directly
run on top of the hardware and access resources. Hypervisor is booted first
and have access to the real device drivers. Xen [72], VMware ESX/ESXi [73]
are some examples of Type I Hypervisor. In later case, it is host OS which is
booted first and at the time of launch of first VM, hypervisor is loaded post-
boot. The Hypervisor runs above the host operating system as a user space
application. It shares device drivers from host OS to handle the input-output
and completely depends on host OS for its operations. VMware Workstation
[74] and Oracle Virtual Box [75] are examples of type II Hypervisor. Gradually
software were developed for implementing cloud computing platform such as
 Introduction to Cloud Security 33

Open Nebula [76], VMware vSphere [73], OpenStack [7], Citrix XenSever [72],
HP Helion Eucalyptus [77], etc.

2.2.3 Data outsourcing

Data outsourcing is one of the key benefits provided by cloud service provider.
It refers to the transferring of the computing, security, and especially storage
to off-premise third party organization which controls the off-premise infras-
tructure. The capital expenditure (CapEx) along with operational expenditure
(OpEx) is reduced to a significant extent. Due to outsourcing, customer loss
their physical control over data which is one of the most important security is-
sues in cloud computing. Data outsourcing also causes privacy violation as the
data is outside the physical access of customers. In order to resolve this issue,
customers need to be very careful while selecting a trusted service provider.
Habib et al. [78] have addressed the issue of how to select a trusted service
provider. A CSP should achieve the important security goals such as confiden-
tiality, integrity and availability, etc. There are some approaches to preserve
the privacy of outsourced data from outsiders. For example, Slamanig et al.
[79] proposed an approach based on accumulator which maintains the Access
Control Lists (ACL) having different permissions (read, write, and delete) for
different users. The owner of the data can only grant/delete/modify access to
the data for outsiders. In this way, unauthorized access to outsource data will
be denied by the server. Another scheme called privacy-enhanced access con-
trol for outsourced data is proposed by Raykova et al. [80]. In their approach,
coarse-grained access control is combined with fine-grained cryptographic ac-
cess control. Adding cryptographic access control policies overcomes the trust
issues with outsourced data.

2.2.4 Trust management

Trust is one of the crucial security issue concepts. It is very important for a ser-
vice provider to build a trust between the tenant users and service providers.
Tenant’s data resides on off-premise datacenters which is completely outside
the control of users. This loss of physical control raises a concern of trust
on service providers. It is a multi-phased phenomenon to evaluate the trust.
The security of tenant’s data relies on the security management policies im-
plemented by service provider. Tenants have to trust on them. In addition,
trust on underline infrastructure of cloud such as operating system, guest OS
image, hardware, application software, cloud network is another important
concern for the tenant users. A trusted third-party (TTP) can authorize, au-
dit the sensitive data of tenants and provides the security from illegitimate
users. However, TTP can be compromised which leads to user’s sensitive data
on danger. Trustworthy systems are also discussed by Yasinsac and Irvine
[81]. Tenants have to trust that systems will work fine for different circum-
stances such as operational error, system error, human intervention error, etc.
34 Cloud Security: Attacks, Techniques, Tools, and Challenges

The trust-based systems ensure the system security as well along with the
business continuity of the organization.

2.2.5 Metadata security

Cloud Organizations also maintains the massive amount of metadata which
is called “data about data”. It contains sensitive information in different for-
mat. For example, Web Service Description Language (WSDL) [82] is one of
the examples of metadata. An attacker can exploit the WSDL and modify it.
This may cause the leakage of the user’s confidential data. There are some
security concepts associated with it such as data sanitization, data separation,
data location and data maintenance. Data sanitization refers to permanently
destroying the piece of data stored in different locations in cloud. It is a irre-
versible process of destruction of data. During removal, some of the metadata
may not fully deleted resulting data leakage of user’s sensitive information.
Data separation causes the tenant to use the data of his/her domain and
denial of access to other domain’s data. However, data separation is done
in the same hard disk being shared among multiple tenants. A poor imple-
mentation of separation policy will result in data leakage. Cloud offers data
migration with VMs whenever required. The mobility feature may sometime
result into loss of sensitive information and also increase the chances of errors
in metadata. Man in the Middle Attack (MITM) [83] is one such threat to
data in transit. It may also be dangerous to keep data at multiple-locations
for backup. Data maintenance is another important security concept. Main-
taining the metadata along with the applications is another challenging task.
Sometimes, security attacks can take place during updation of the software
patches.

2.3 Cloud Security Standards

Various unwanted attack incidents happening in cloud environment, have led
to the generation of security standards. Various security standards have been
discussed which covers different cloud security aspects. As per the author’s
assessment, various cloud security standards are as follows.

2.3.1 Information technology infrastructure library (ITIL)

ITIL [84] is security management framework that identifies best guidelines
and practices which defines the process-based integrated approach for manag-
ing the cloud information technology services. ITIL is applicable to all type of
IT services including the cloud services. ITIL makes sure that proper security
 Introduction to Cloud Security 35

care is take at all three levels of business operations, i.e. strategic level, tac-
tical level and operational level. ITIL provides best practices for information
security process that can be modified and used by any IT organization. A
framework with continuous improvement is provided which can be aligned as
per the changing need of the IT services. As cloud computing is such type of
continuous changing organization. Here, the security guidelines and practices
must be modified dynamically as per the business need. ITIL breaks down the
information security practices into various levels:

1. Policies: The key objectives aimed by the organization to achieve. item

Processes: What guidelines to follow to meet the objectives?
2. Procedures: How to distribute the activities among people and settling
down the important deadlines.
3. Work instructions: What are the instructions to be performed for doing
specific activities.
The key challenge faced by the organization while adapting ITIL is to redefine
the set of ITIL processes that they are having efficiently. The organization
is supposed to identify the gaps in the existing security processes and then
mapping them as per the ITIL framework.

2.3.2 Control objectives for information and related

technology (COBIT)
COBIT [85] is another security standard which is developed by international
professional association ISACA which provides best practices for IT manage-
ment and governance. It acts as an interface between processes and business
goals. The model can also be used together with more standards such as
ISO/IEC 27000 and ISO/IEC [Link] includes the following compo-
nents:
1. Process descriptions: It focuses on the having a reference process model
and a common language in an organization. The reference model maps
the responsibility areas of planning, building, running, and monitoring.
2. Control objectives: A set of high-level requirements are provided which
are to be implemented by management for having good control on IT
Processes.
3. Management guidelines: The guidelines helps in measuring performance,
setting up common objective, assigning responsibilities, and mapping
relationship between processes.
4. Maturity models: These models are used to measure the maturity and
capability for each process and identify the gaps.
36 Cloud Security: Attacks, Techniques, Tools, and Challenges

2.3.3 ISO/IEC 20000

ISO/IEC 20000 [86] belongs to internationally well-known standards for IT
service management not limited to cloud services. It reflects the best guide-
lines within ITIL. This standard is developed by ISO/IEC JTC1/SC7 in 2005.
Overall, there are thirteen parts for this standard. Various requirements to
establish, implement, maintain and continuously improve the service manage-
ment system (SMS) are specified in ISO/IEC-20000-1 :2018. The applications
of SMS as per the requirements in ISO/IEC 20000-1:2011 have been provided
by ISO/IEC 20000-2: 2012. The scope definition and usability of ISO/IEC
20000-1 in applications, is being given in ISO/IEC 20000-3. ISO/IEC 20000-4
for process assessment has been withdrawn and a new series of documents
have been developed by ISO/IEC JTC1/SC7. To achieve the requirements of
ISO/IEC 20000-1, the best practices have been defined by ISO/IEC 20000-5.
The requirements for assessment has been defined by ISO/IEC 20000-6:2017.
The integration of SMS and quality management system and/or information
security management system (ISM) have been defined by ISO/IEC 20000-7.
The standard ISO/IEC 20000-9 has been withdrawn. ISO/IEC 20000-10:2018
defines the concepts of ISO/IEC 20000 and identifies the relationship between
ISO/IEC 20000 and other standards. ISO/IEC 20000-11:2015 defines the re-
lationship between SMS and ISO/IEC 20000-1. ISO/IEC 20000-12 defines the
relationship between SMS such as CMMI and ISO/IEC 20000-1. The rela-
tionship between SMS such as COBIT and ISO/IEC 20000-1 is defined in
ISO/IEC 20000-13.

2.3.4 Statement on standards for attestation engagement

(SSAE)
SSAE [87] is standard developed specially for auditing tasks which is applica-
ble to cloud service providers as well. The total 16 audits come under one of
the three classes of Service Organization Controls (SOC): SOC 1, SOC 2 and
SOC 3. SOC 1 focuses on financial reporting control. SOC2 assesse the secu-
rity control of technical and operational tasks and defines the trust services
principals for them. SOC 3 ensures and reports whether the service provider
is meeting the principals of trust services. The reports generated by SOC3 are
freely distributed. NIST provided a Cybersecurity Framework (CSF) which
focuses on applying the federal security assessment and security authoriza-
tion controls in industries owning their own infrastructure. CSF is a standard
security framework for private cloud service providers.

2.3.5 Cloud security alliance (CSA) cloud controls matrix

CSA [88] provides the guidance for ensuring the cloud security and provides
the certification for same in order to promote the security enabled delivery
of cloud services. A Cloud Controls Matrix (CCM) has also been published
 Introduction to Cloud Security 37

by CSA that provides the description of key security control which can be
used to assess the services of cloud providers. This is very useful document
that ensures the effective implementation of the cloud security governance.
CCM provides guidance in 16 domains of security including identity and access
management, application security. Key management, mobile security and data
center operations. The 16 domains primarily focus in three areas of cloud
computing: Architecture, Governance and Operation in Cloud Computing. A
baseline is set by the CMM for helping organizations to achieve best cyber
security strategies. Customers can use CCM metrics to compare various cloud
service providers. By following CCM, organizations are preparing themselves
to follow other standards such as HIPAA, NIST, ISO 27001, HIPAA, etc.
Security frameworks explained above such as ITIL, ISO/IEC 20000, and
ISO/IEC 27001/27002 security frameworks focus on:
• Ensuring that current security policies are according to the need.
• Applying the security baseline in all IT operations.
• Ensuring that all the services are secure from cyber threats.
Incorporating these frameworks in the organization impact the organizational
growth and reduces the risk from outsider threats.

2.4 CSA Cloud Reference Model

The cloud security reference model [89] addresses the relationships of different
cloud stakeholder classes. As per the security control and concerns, each of
them is placed in the architecture. The following need to be known for avoiding
confusions in services:
• The term how cloud services are deployed is completely related with
where the cloud services are provided. The description of public or pri-
vate cloud can be done as external of internal.
• It is very important to understand the security boundaries of the organi-
zation who should have to follow a well-demarcate perimeter as security
perimeter. Cloud services are consumed in the manner of the location of
security perimeter of the organization.
• The deployment and consumption of cloud is not only related with the
location (internal or external) of cloud services but also related with
physical location of resources and who consumes the resources who is
responsible for security, governance, policies and standards.
38 Cloud Security: Attacks, Techniques, Tools, and Challenges

In addition, the location of assets, the security risks are also associated
with followings:

• Who is responsible for managing assets and how assets will be managed.
• Which type of assets, information and resources are being managed?
• What are the controls being selected and how they are integrated?
• What are compliance issues associated with services?

Infact ISO/IEC 27002 says that the introduction of external third parties
or services should not affect the organization’s information processing facil-
ities. There is a difference in the responsibilities and methods for securing
different cloud models. It raises various security challenges with customers.
Cloud customer can only be aware about the type of security controls and at
what level they are implemented if the cloud service provider (CSP) share such
information with customers. The customers can be tremendously misguided
for making risk management decisions without proper awareness about the
security controls. CSA cloud security architecture maps the cloud model with
the security controls as shown in Figure 2.4 [89]. Once the mapping is done, it
becomes easier to determine what needs to be performed to feed back the risk
assessment framework. It helps in deciding how the risk should be addressed,

FIGURE 2.4: CSA cloud security reference architecture.

 Introduction to Cloud Security 39

accepted, transferred and mitigated. The gap analysis maps the cloud ser-
vices and classifies them against architecture model. As an output of this gap
analysis, general “security”� posture can be determined and can be related to
the asset’s assurance and protection requirement. It then becomes possible to
map the security architecture with regulatory, business and other compliance
requirements.
The security controls in IoT are quite similar with the security controls in
IT environment. However, because of the various types of service models, op-
erational models and technologies used by cloud computing, there are different
risks associated to an organization in cloud environment than traditional IT
environment. The security controls are implemented at various layers such as
physical security layer, network infrastructure security layer, IT system se-
curity layer and information/application security layer. In addition, security
controls are implemented at people and process level like assigning different
roles and responsibilities and change management, respectively.
The security responsibilities vary for both service provider and service
consumer for each of the cloud service models. For example, let’s consider
the example of Amazon’s AWS EC2 service which is IaaS service offered by
Amazon. With respect to this service, the service provider is responsible for
the security controls such as securing the hypervisor (virtualization-layer),
physical security and environmental security, etc. The service consumer will
deal with the security controls such as instance security such as security of
applications, operating system and consumer’s data. However, for SaaS service
models such as [Link]’s customer resource management (CRM) which
deals with the entire stack. The provider not deals with security control of
environmental and physical security but also deals with security controls for
applications, data and infrastructure. This reduces many of the responsibilities
of cloud customer related to directly handling the security controls.
Presently, there is no provision for the consumers to understand for what
are their responsibilities for ensuring security. However, CSAs are making ef-
forts to define standards in cloud audits. The cost efficiencies supported by
providers are one of the major focuses of attraction of cloud service provider.
The efficiencies are provided by making the services flexible so that a large
number of customers can takes its benefits. It is not fortunate that solutions
integrated with the security are not perceived flexible. The rigidity often comes
because of the abstraction in the infrastructure and lack in the visibility which
often makes it difficult to integrate the security controls specially at the net-
work layer.
In SaaS environment, the negotiation of the security controls with their
scope is done in service contracts. The privacy, compliance and service lev-
els issues are handled legally in service contracts. However, in IaaS services,
the key responsibility of securing the underline infrastructure is of service
providers and the remaining cloud stack is the responsibility of the consumers.
However, In PaaS services, the provider is responsible for securing the plat-
form. The consumers are responsible for developing the applications in a secure
40 Cloud Security: Attacks, Techniques, Tools, and Challenges

FIGURE 2.5: NIST cloud security reference architecture.

way including the security of the developed applications. It is very crucial to

understand the difference between the security control with respect to each
service model in order to deal with the risks associated with organizational
operations.

2.5 NIST Cloud Reference Model

The formal model of cloud computing security reference architecture (NIST
SRA) has been derived from NIST reference architecture (NIST RA) as shown
in Figure 2.5 [90] which depicts various architectural components. The archi-
tecture depicts that the components identified by NIST RA, should be safe.
The ultimate aim of cloud customers is to find out the security controls which
best fits the security needs of customers. The ordered list of all the architec-
tural components and sub-components are described as follows:

2.5.1 Architectural components of consumer

The cloud customer’s responsibilities were not explained in earlier architec-
ture NIST RA. However, NIST SRA provides the detailed description of the
cloud customer’s architectural components. The architectural components of
consumers are described with their sub components on the following pages.
 Introduction to Cloud Security 41

Secure Cloud Consumption Management

This component includes functions which are very important for the opera-
tions of services used by consumers. The various sub components are
i Secure Configuration: It is responsible for the secure management of the
following areas: rapid provisioning, resource changing, monitoring and re-
porting, metering, service level agreement management.
• Rapid provisioning: It refers to automatic deployment of cloud ser-
vices and resources in the cloud systems. The secure provisioning of
resources ensures that the requests are coming from the authorized
and authenticated sources.
• Resource Changing: It refers to doing the configuration changes, up-
grades and resource reassignments/release, etc. in the cloud environ-
ment. The secure resource changing ensures that only authenticated
and authorized requests for resource are considered.
• Monitoring and Reporting: The virtual resources are monitored and
reports are generated in some time intervals. The secure monitoring
and reporting ensures that the limited/required use of resources.
• Metering: It refers to the billing facilities provided by service provider
to generate bills based on the usage of resources. The secure metering
refers that the pricing model should not be compromised by attacks
such as EDoS.
• Management of Service Level Agreement: It refers to managing the
SLA definitions, monitoring, and policy enforcement. The secure SLA
management ensures the visibility of clauses with customers.
ii Secure Portability/Interoperability: It makes sure that data can be moved
securely to various cloud environments. The components mapped to this
sub-component provide higher flexibility for the security of data which is
being transferred to the different cloud providers. The data security and
protection scheme are enforced to mitigate the risks. A greater amount
of flexibility is provided for securely transferring data/applications over
another cloud provider’s platform by incorporating security components
at this level. However, there are many other challenges other than security
while supporting data migration. Providers are working in this direction to
support interoperability feature to students via secure channel. The basic
requirements for supporting such as feature varies service model to service
model.

iii Secure Business Support: It includes services used for running business
operations like management of service contracts, payment, business rela-
tionships with other cloud actors and many more, as listed briefly:
42 Cloud Security: Attacks, Techniques, Tools, and Challenges

• Cloud actors such as Broker, Auditor and Carrier are managed at this
level along with their business relationship. The interaction between
the cloud actors is formally authorized and authenticated as per the
security guidelines.
• Business Issues and other problems related to cloud are discussed
with the actors identified for organizations’ cloud ecosystem. The best
security practices are discussed to ensure the business continuity.
• The service contracts are managed to ensure the secure set-up of
contracts, secure termination and closing, etc.
• Only those services are procured where security concerns have been
addressed properly.
• The payment and invoices are also managed securely by following
best security practices to avoid any fraudulent transaction.
This architectural component also includes various other features such as
provisioning of identities and credentials to the employee of organization
and contractors by applying access control policies and business continuity
plans.
iv Secure Organizational Support: It is responsible for covering processes,
policies and procedures given by an organization to support the overall
secure consumption management of cloud. The compliance management,
audit management and the governance risks and compliance, the stan-
dards related to technical aspects, policies and standards for information
security, etc., are sub-components of this architectural component.

Secure Functional Layer

The components are used to secure the cloud functional layer and rely on the
particular cloud service model used. The modules of this layer are:
First is SaaS cloud ecosystem, in which cloud consumer only has limited
administrative control of applications. In another way, it can be said that
minimal access control in cloud and security components are provided. Sec-
ond is PaaS cloud ecosystem, in which cloud consumer has the control on
applications. In addition, some control is also given for the hosting runtime
environment. However, there is no or limited access to the infrastructure such
as access to network, server and storage.
Lastly, third is Iaas cloud, in which cloud consumer has some control in
the provisioned infrastructure mainly, virtual machine, middleware and guest
OS. The access to virtual computing resources offers more privileges to the
users than other service models. However, access to host or physical server and
hypervisor is still not granted. For example, a cloud customer can implement
a security system such as firewall to secure the infrastructure allocated to it.
The access control policies are specific to a service model. The details about
access control, rules, policies and standard is clearly specified in the SLA.
 Introduction to Cloud Security 43

2.5.2 Architectural components of CSP

Various activities are carried out by the service provider such as coordination,
management of the resources, etc. A proper ecosystem need to be managed
for the provisioning of secure cloud services at various levels such as SaaS,
PaaS, and IaaS. The sub-components are as follows:

Secure Cloud Ecosystem Orchestration

Cloud provider performs the functions of orchestration of services, manage-
ment of services, privacy and security aspects. By NIST, it is described as
the composition of various design components that supports which help the
provider in coordinating and arranging the cloud components. It has the fol-
lowing components and sub components, as follows:
i Secure service and deployment layer: The requirements of security com-
ponents depend on the type of service offered to the customers. In case
of IaaS cloud, the cloud provider has full control on all the infrastruc-
ture resources such as physical server, networking resources and storage.
It also executes the management software for accessing the hardware and
has full control on it. The cloud consumers are offered the access of virtual
resources such as virtual machine, virtual network, etc.
ii In case of PaaS cloud, cloud service provider handles all the computing re-
sources and facilitates the middleware and runtime execution environment.
The PaaS ecosystem offers all development tools and/or infrastructure to
the customers. PaaS customers have certain control the development tools
and deployment infrastructure. In case of SaaS cloud, the provider has
complete control on full stack and handles the maintenance, configuration
and updation of applications as well. Service provider provisions the ser-
vices to customers in SaaS ecosystem for effective usage. Customers have
limited control in the application only.
iii Secure abstraction of resources and control layer: It represents the security
components which a CSP would implement in order to provision the safe
access to the physical components. It is the responsibility of the service
provider to ensure that proper security processes and components are in
place to enable the legitimate access to the resources. The data owned
by one tenant should be safe from other tenants sharing the resources.
The data of one user should not be accessed by other users. The non-
privileged users should not be allowed to access the service management
related functions.
iv Secure physical resource layer: The physical resources such as Memory,
CPU and networking resources (firewall, router) and storage devices (Hard
disks, etc.), should also be secured from the unauthorized access. This
layer facilitates such security components which ensure same. The other
44 Cloud Security: Attacks, Techniques, Tools, and Challenges

resources such as ventilation, heating, communication and power are also

included at this layer.
v Secure cloud service management: It has been described with the perspec-
tive of requirements as follows:
a Secure provisioning and configuration : It provides the following func-
tionalities:
• Rapid provisioning: The services are provisioned and deployed au-
tomatically on receiving the service demand from the customer.
• Resource updation: It refers to upgrading and maintaining resources
as per the modified security policy.
• Resource Monitoring and Reporting: Cloud virtual resources and
cloud events are monitored and security reports are generated which
also comprises of resource usage statistics.
• Metering: The billing facility is provided with some abstraction
based on the service type (processing, storage, etc.)
b Secure interoperability and portability: It provides the assurance that
the customer’s data can be easily transferred securely to various cloud
ecosystems as per the requirements of security as identified by SLA. The
maintenance time and downtime should be fixed at minimum level.

c Secure business support: It comprises of business related services which

supports the security processes of customer’s and provider’s. For exam-
ple, contract management, customer management, inventory manage-
ment and reporting and auditing, etc.

2.5.3 Architectural components of broker

The services defined for cloud broker can be classified into following categories:
i Secure Service Aggregation: The multiple services are combined, form-
ing one or more service platforms. The secure movement of data and its
integration is also the responsibility of the broker. The various key sub
functions are: secure configuration and provisioning and secure interoper-
ability and portability.
ii Secure Management of Cloud Service: Various security functions which are
required for the secure management of various services are included here.
Sub components derived from the activities of this component includes
secure portability for supporting secure transportation of services, secure
provisioning of resources, tools, etc. and secure business support.
iii Secure Service Intermediation: It addresses the brokers responsibilities for
ensuring the capabilities added to existing cloud services.
 Introduction to Cloud Security 45

iv Secure Service Arbitrage: The secure service aggregation and service arbi-
trage are very similar in various aspects. However, in later, the combined
services by broker are not fixed and are flexible. They can be assigned
to multiple vendors dynamically. All the functionalities of the broker has
been specified and explained above. Broker is supposed to perform all its
functions, considering in mind the security requirements specified in SLA.

2.5.4 Architectural components of carrier

The transport and connectivity of the services is provided by the actor. The
secure management of services is also performed by the cloud carrier in order
to ensure that customer satisfaction about the service delivery is maintained.
The cloud carrier provides the way via which cloud customer can directly
contact the broker or provider. The complex details in order to maintain
the connectivity is concealed from the consumer. Although carrier plays an
vital role and makes it possible to have a transportation of services between
provider and consumer without having a cloud carrier. Cloud service provider
ensures that a secure channel should be provided to cloud customers to meet
the SLA requirements which are signed between them. In addition, service
management functions are also performed by the cloud carrier to ensure the
effective service delivery to the customers.

2.5.5 Architectural components of auditor

Cloud auditor is responsible for performing the independent assessments of the
services. It ensures that system operations, security policies, privacy functions,
etc. are properly functioning without compromising any service quality. The
secure auditing environment includes various mechanisms such as security
controls, secure archival, secure storage, data location, metering, SLAs and
privacy, etc. It requires the following security mechanisms in place
• Secure Archival: The archival of all the audit records for the business
and legal processes should be secure. The requirements for archival and
its implementations should be available to auditors.
• Security Component and Related Control: The detailed information
about the various security controls and security components should also
be available to auditors.
• Secure Storage: The evidences can be collected from concerned authori-
ties and stored in cloud safely for future purpose. Therefore, the secure
mechanisms such as obfuscation and encryption information should be
provided to the auditors.
• Data Location: Some jurisdictional rules might be required to be applied
in data during the process of assessment. It requires the availability of
information about data location to auditors.
46 Cloud Security: Attacks, Techniques, Tools, and Challenges

• Metering: The metering/billing information need to be given to audi-

tors for the performance audit. The access should be granted in secure
manner.
• SLAs: Auditors are also required to have a secure access to the all the
agreements which are implemented between the parties.
• Privacy: The privacy assessment by auditors also requires the secure
access to the information about the configuration information and sys-
tem security which are implemented by organization for protecting the
client’s data.
The security controls along with the security components are independent
of the cloud service model and available to all the cloud auditors.

2.6 Conclusion
Cloud Security plays an important role in building a trust between cloud
service provider and cloud consumers. It provides tools and technologies to
protect the infrastructure, applications and data. Various security aspects for
cloud are same as the on premise organization. However, the addition of vir-
tualization layer has opened the doors for attackers and hence requirement
for specialized security techniques to deal with cloud specific threats. Various
cloud security concepts have been discussed such as multi-tenancy, virtualiza-
tion, data outsourcing, trust management and meta security, etc. Afterward
standards for cloud security have been described such as Information Technol-
ogy Infrastructure Library (ITIL), ISO/IEC 20000, Statement on Standards
for Attestation Engagement (SSAE), Cloud Controls Matrix and Cloud Secu-
rity Alliance (CSA), etc. A cloud service provider has to follow the security
standards in order to maintain the security of organization and customer’
data. At the end, some of the important cloud security reference architec-
ture (such as NIST, CSA) have been discussed to provide an overview about
security architectures in cloud.

2.7 Questions
Fill in the blanks
1. Which of the followings are cloud security standards
i ITIL