Security in Cloud Computing (Detailed Notes – 15 Marks)
Introduction
Security is one of the most important aspects of cloud computing. Since cloud services store data,
applications, and computing resources on remote servers connected through the Internet, protecting
them from unauthorized access, cyberattacks, data breaches, and system failures is essential.
Cloud security consists of technologies, policies, processes, and controls designed to protect cloud-
based systems, data, and infrastructure. Both the cloud service provider and the customer share the
responsibility for maintaining security.
Objectives of Cloud Security
The major objectives are:
Confidentiality
● Ensures that sensitive information is accessible only to authorized userAchieved using
encryption and authentication.
Integrity
● Ensures that data is accurate and cannot be modified without [Link] using
digital signatures, hashing, and access controls.
Availability
● Ensures cloud services are always available when [Link] through backups,
redundancy, and disaster recovery.
Authentication
● Verifies the identity of users before granting access.
Authorization
● Determines what resources an authenticated user can access.
Accountability
● Records all activities through logs and audit trails.
Security Challenges in Cloud Computing Major security threats include:
● Data leakage
● Data breaches
● Insider attacks
● Malware and ransomware
● Account hijacking
● Denial-of-Service (DoS/DDoS) attacks
● Weak passwords
● Insecure APIs
● Misconfigured cloud storage
● Loss of encryption keys
1. Data Leakage
Definition
● Data leakage is the accidental or intentional exposure of confidential information to
unauthorized persons.
● Examples include customer records, financial information, passwords, medical records, and
business documents.
Causes
● Weak authentication
● Poor password management
● Insider threats
● Malware attacks
● Unencrypted data
● Misconfigured cloud storage
● Third-party application vulnerabilities
Types
Internal Leakage
● Occurs when employees intentionally or accidentally expose sensitive information.
External Leakage
● Occurs due to hackers or cybercriminals accessing cloud data.
Effects
● Financial loss
● Reputation damage
● Legal penalties
● Loss of customer trust
● Business interruption
● Prevention
● Encrypt data
● Use Multi-Factor Authentication (MFA)
● Implement Role-Based Access Control (RBAC)
● Perform regular backups
● Monitor user activities
● Conduct periodic security audits
● Use Data Loss Prevention (DLP) software
2. Offloading Work
Offloading work refers to transferring storage, processing, and applications from local computers to
cloud servers.
Advantages
● Reduces hardware investment
● Faster processing
● Better scalability
● Automatic software updates
● Lower maintenance costs
● Improved collaboration
● Easy remote access
● Security Requirements
● VPN connections
● SSL/TLS encryption
● Identity management
● Firewalls
● Endpoint security
● Secure APIs
● Risks
● Data interception
● Unauthorized access
● Service outages
● Data privacy issues
3. Logging
● Logging is the process of recording all events and activities occurring in cloud systems.
● Logs help administrators monitor security and detect suspicious activities.
Types of Logs
Access Logs
● Record login and logout information.
System Logs
● Record operating system activities.
Application Logs
● Record software events and errors.
Network Logs
● Monitor network traffic.
Security Logs
● Record authentication failures, attacks, and policy violations.
Audit Logs
● Maintain records for compliance and investigations.
4. Forensics
● Cloud forensics is the scientific investigation of cybercrimes committed in cloud environments.
● It involves collecting, preserving, analyzing, and presenting digital evidence.
Investigation Process
● Identification
● Locate evidence.
● Preservation
● Protect evidence from modification.
● Collection
● Gather logs, files, and metadata.
Examination
● Recover deleted or hidden information.
Analysis
● Determine the attack method and source.
Reporting
● Prepare investigation reports.
5. Development Security
Definition
● Development security integrates security practices throughout the Software Development Life
Cycle (SDLC)
● It is often called Secure SDLC (SSDLC).
Secure Development Practices
● Secure coding standards
● Code review
● Static code analysis
● Dynamic testing
● Vulnerability assessment
● Penetration testing
● Patch management
● Continuous monitoring
Benefits
● Reduces vulnerabilities
● Protects applications
● Improves software quality
● Prevents cyberattacks
● Reduces maintenance cost
6. Auditing
Auditing is the systematic examination of cloud resources, security policies, and operations to ensure
compliance and security.
Objectives
● Verify security controls
● Detect vulnerabilities
● Ensure compliance
● Improve performance
● Reduce risks
Types
Internal Audit
● Performed by the organization.
External Audit
● Performed by independent auditors.
Security Audit
● Focuses on security controls.
Compliance Audit
● Checks compliance with standards such as ISO 27001, HIPAA, or GDPR.
Audit Process
● Planning
● Data collection
● Risk assessment
● Evaluation
● Reporting
● Follow-up
Benefits
● Improves cloud security
● Ensures legal compliance
● Detects weaknesses
● Enhances customer trust
● Supports continuous improvement
Best Security Practices
● Use strong passwords.
● Enable Multi-Factor Authentication (MFA).
● Encrypt sensitive data at rest and in transit.
● Apply the principle of least privilege.
● Keep systems and software updated.
● Use firewalls and intrusion detection systems.
● Regularly monitor logs.
● Perform vulnerability assessments and penetration testing.
● Maintain regular backups and disaster recovery plans.
● Train employees on cybersecurity awareness.
● Implement endpoint security.
● Review access permissions periodically.
● Advantages of Cloud Security
● Protects sensitive information
● Prevents unauthorized access
● Supports secure remote work
● Reduces cyberattack risks
● Ensures business continuity
● Improves compliance with regulations
● Builds customer confidence
● Enables secure cloud adoption