Department of CSE Cloud Computing 21CS72
1.a) Explain the key risks associated with cloud security.
Answer:
Cloud security risks are potential dangers that can affect data, privacy, and the operations
of cloud services. When data is stored or processed in the cloud, several risks arise. Let's
discuss some of the key risks:
1. Data Breaches: This occurs when unauthorized users access sensitive data. For
example, imagine a hacker gaining access to a company's customer database
stored in the cloud. If this data is exposed, it can lead to identity theft or financial
fraud.
2. Data Loss: Data could be lost due to various reasons, like accidental deletion or
cloud service outages. For example, if a cloud provider's servers crash and they don't
have a backup of your data, all your important files could be lost forever.
3. Insecure APIs: APIs (Application Programming Interfaces) are used to interact with
cloud services. If the APIs are poorly designed or insecure, attackers could exploit
them. For instance, an insecure API could allow an attacker to access your files or
send malicious commands to the cloud system.
4. Account Hijacking: This happens when attackers steal your login credentials, like
your password or multi-factor authentication code. For example, an attacker might
gain access to your cloud storage account and steal all your documents and data.
5. Insider Threats: Employees or contractors with access to cloud services may
misuse their permissions. For example, a disgruntled employee might steal or delete
sensitive company data from the cloud.
6. Denial of Service (DoS) Attacks: Attackers can flood the cloud infrastructure with
excessive requests, making it slow or unavailable. For instance, if a company’s
website is hosted on the cloud, an attacker might overload the servers to crash the
site, causing downtime.
7. Shared Technology Vulnerabilities: Cloud environments often host multiple
customers on shared physical hardware (e.g., shared servers). A vulnerability in one
tenant’s environment might be exploited to compromise others. For example, one
poorly secured VM (Virtual Machine) might allow attackers to access the data of
others on the same server.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 1
Department of CSE Cloud Computing 21CS72
1.b) Discuss the top concerns for cloud users and suggest solutions to
mitigate these concerns.
Answer:
Cloud users face several concerns that could impact the security and privacy of their data.
Let's take a look at the most common concerns and how to address them:
1. Data Security and Privacy: Cloud users worry about unauthorized access to their
sensitive data.
a. Solution: Encrypt sensitive data before uploading it to the cloud and ensure
encryption is enabled for data in transit. Use secure protocols such as HTTPS
for data transmission and implement strong authentication mechanisms like
multi-factor authentication (MFA).
2. Compliance and Legal Issues: Users must comply with laws such as GDPR
(General Data Protection Regulation) or HIPAA (Health Insurance Portability and
Accountability Act).
a. Solution: Ensure the cloud provider is certified and compliant with relevant
laws. Choose providers with privacy certifications and conduct regular audits
to confirm compliance.
3. Service Downtime: Cloud services may go offline due to technical issues, impacting
businesses.
a. Solution: Opt for cloud providers with high uptime guarantees (e.g., 99.9%)
and ensure you have a disaster recovery plan in place to restore services
quickly in case of downtime.
4. Vendor Lock-in: When businesses rely heavily on a single cloud provider, migrating
to another provider can become difficult.
a. Solution: Design applications to be portable by using open standards,
ensuring that data can be easily transferred to another provider if needed.
2.a) What is privacy impact assessment in cloud security? Illustrate its
importance with an example.
Answer:
A Privacy Impact Assessment (PIA) is a process for assessing how a particular project or
system affects individuals' privacy. It is important in cloud security to evaluate the potential
privacy risks and mitigate them.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 2
Department of CSE Cloud Computing 21CS72
Importance of PIA:
Example: Imagine a healthcare company decides to move its patient records to the cloud.
A PIA will help assess whether any sensitive information, such as medical history, could be
exposed in the cloud environment. The assessment might lead to recommendations like
encrypting patient data before storing it or limiting access to the data to specific authorized
personnel only.
A PIA helps ensure:
1. Privacy risks are identified early.
2. Measures are put in place to protect sensitive information.
3. Compliance with privacy regulations (like GDPR) is maintained.
2.b) Describe how trust can be established between cloud providers and
users.
Answer:
Trust between cloud providers and users is essential for the secure use of cloud services.
Here’s how it can be built:
1. Transparency: Cloud providers should provide clear information about their data
protection practices. For example, if a provider offers encryption for data storage,
they should explain how the encryption is implemented.
2. Third-party Audits and Certifications: Cloud providers should undergo audits by
trusted independent organizations. For example, a provider may have a SOC 2 Type
II certification, which assures that the provider has controls in place to protect user
data.
3. Service Level Agreements (SLAs): The cloud provider and user should agree on the
expected performance levels, such as uptime guarantees (e.g., 99.9%) and security
responsibilities. For example, if a cloud provider promises 99.99% uptime in their SLA,
they will be penalized if they fail to meet that guarantee.
4. Data Ownership: Users should retain full ownership of their data. This means that
even though the data is stored in the cloud, the provider cannot access or use it
without the user's consent.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 3
Department of CSE Cloud Computing 21CS72
3.a) How does operating system (OS) security contribute to the overall
security of cloud platforms?
Answer: The operating system (OS) is a critical part of any cloud environment. It manages
hardware and software resources, including virtual machines (VMs), containers, and
applications running on the cloud. Here’s how OS security contributes to overall cloud
security:
1. Access Control: The OS enforces who can access the system and what actions they
can perform. For example, Linux and Windows have mechanisms to set user
permissions (e.g., "read", "write", "execute") to control who can modify files or run
programs.
2. Isolation: The OS ensures that different users or applications are isolated from each
other. For example, in a virtualized cloud environment, each VM operates as though
it’s on a separate physical machine, preventing one compromised VM from affecting
others.
3. Patching and Updates: The OS regularly releases security updates and patches.
These updates fix vulnerabilities that attackers could exploit. For example, an update
might fix a bug that would otherwise allow hackers to gain unauthorized access to
the system.
3.b) Explain virtualization concepts and their role in ensuring virtual
machine (VM) security.
Answer: Virtualization refers to the process of creating virtual (rather than physical)
versions of computer resources such as servers, storage, or networks. This is done through
Hypervisors, which manage multiple virtual machines (VMs) on a single physical server.
• VM Security: Each VM runs its own operating system and applications, making them
isolated from each other. This isolation ensures that if one VM is compromised,
others are not affected.
o For example, if an attacker hacks into one VM running a web server, the
attacker cannot easily gain access to other VMs running databases or other
services on the same physical host.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 4
Department of CSE Cloud Computing 21CS72
1. Encryption: VMs can be encrypted to protect data. For example, if a VM containing
sensitive information is stolen, the attacker will not be able to access the data
without the decryption key.
2. Access Control: Only authorized users should be able to create, manage, or access
VMs. Using secure authentication mechanisms and limiting access based on roles
helps prevent unauthorized access.
3. Patch Management: Regularly updating the OS and applications running on VMs
helps mitigate security risks by fixing known vulnerabilities.
4.a) Analyze the security risks posed by shared images in cloud
environments.
Answer: Shared images are pre-configured virtual machine (VM) templates that can be
used to launch new VMs quickly. However, there are security risks associated with using
shared images:
1. Malicious Software: Shared images may contain malware if they haven’t been
properly verified by the cloud provider. For example, a VM image shared by another
user could secretly contain a virus that infects your cloud environment when you use
it.
2. Data Leakage: A shared image could still contain residual data from previous users.
For instance, sensitive files or credentials left behind in the image could be accessed
by others who use the image later.
3. Outdated Software: If the shared image includes outdated or unpatched software,
attackers could exploit known vulnerabilities. For example, if the image is based on
an old version of a web server with security holes, attackers could hack into your
application.
4.b) What are the challenges in securing management OS in cloud
platforms?
Answer: The management OS is responsible for managing the entire cloud infrastructure,
which makes it a high-value target for attackers. Some key challenges in securing it include:
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 5
Department of CSE Cloud Computing 21CS72
1. Privileged Access: Administrators have full control over the cloud environment,
which makes it a target for attackers. If an attacker gains access to the management
OS, they can potentially access and manipulate the entire cloud infrastructure.
2. Complex Configuration: The management OS is complex and includes multiple
components like databases, networking, and storage management. Ensuring that
each component is securely configured can be challenging.
3. Security Patching: Keeping the management OS up to date with the latest security
patches is critical. Delaying patches could lead to known vulnerabilities being
exploited by attackers.
4. Separation of Duties: In cloud environments, management OS often needs to be
accessed by multiple administrators or automated processes. Ensuring proper
access control and minimizing human error is difficult.
5.a) Describe the compute services offered by Amazon Web Services
(AWS) with suitable examples.
Amazon Web Services (AWS) offers various compute services that help you run
applications in the cloud without worrying about maintaining physical servers. These
services allow you to scale your applications easily as your needs grow. Let's take a closer
look at some of the key compute services AWS provides:
1. Amazon EC2 (Elastic Compute Cloud)
• What it is: EC2 lets you create virtual servers (called instances) that run on the cloud.
You can choose how powerful these servers are and scale them up or down based
on your needs.
• Example: Think of EC2 like renting a computer in the cloud. If you need a web server
for your website, you can create an EC2 instance and set it up to serve your website.
If you get more visitors, you can create more EC2 instances to handle the traffic.
2. AWS Lambda
• What it is: Lambda is a serverless service that runs your code automatically when
triggered by an event (like a new file being uploaded). You don’t need to worry about
setting up servers or managing them.
• Example: Imagine you have a cloud storage service where people upload images.
You can use Lambda to automatically resize those images after they are uploaded,
without needing to run a server all the time.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 6
Department of CSE Cloud Computing 21CS72
3. Amazon Elastic Beanstalk
• What it is: Elastic Beanstalk is a platform that automatically manages the
infrastructure for your web applications. You just upload your code, and AWS takes
care of the rest (like servers, databases, etc.).
• Example: You can upload a Python web application to Elastic Beanstalk, and it will
automatically handle scaling, monitoring, and load balancing for you, so you can
focus only on writing the application code.
4. Amazon EKS (Elastic Kubernetes Service)
• What it is: EKS helps you manage and run containerized applications (applications
packaged in small units called containers) using Kubernetes, a tool for automating
the deployment of containers.
• Example: Suppose you have a complex application made up of several
microservices (small independent services). You can use EKS to manage and scale
those services using containers, making it easier to run them in the cloud.
5. AWS Fargate
• What it is: Fargate is another service for running containers. With Fargate, you don’t
need to manage the servers that run your containers, as AWS handles that for you.
• Example: If you have an application that runs in a Docker container, AWS Fargate
allows you to run it without managing the infrastructure. You only need to specify how
much computing power you need for your containers, and AWS takes care of the rest.
5.b) Explain the core architecture of Google App Engine and how it supports
application development.
Google App Engine (GAE) is a platform that allows you to build and deploy web
applications without worrying about the underlying infrastructure. GAE manages all the
infrastructure tasks for you, such as scaling and load balancing, so you can focus on
developing your application. Here’s how it works:
Core Architecture of Google App Engine:
1. App Engine Environments:
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 7
Department of CSE Cloud Computing 21CS72
a. Standard Environment: This environment is for simpler applications that
don’t need too many customizations. Google offers pre-configured runtimes
like Python, Java, and Go. It is fast and scalable but has limited flexibility.
b. Flexible Environment: This is for more complex applications. You can use
your custom code, Docker containers, and more resources. It offers more
flexibility but may require more management compared to the standard
environment.
c. Example: If you have a simple web app, you can use the Standard
Environment. But if you have an app that uses a custom backend or a specific
technology, you can choose the Flexible Environment.
2. Scaling:
a. App Engine automatically scales your application based on the amount of
traffic it gets. If your app gets more visitors, App Engine will add more
resources (servers). When traffic decreases, it reduces resources
automatically, saving you costs.
b. Example: Let’s say you run a news website. When you release a big news story,
your website might experience a lot of visitors. Google App Engine will
automatically increase resources to handle the traffic and scale back down
once the traffic reduces.
3. Services:
a. App Engine allows you to split your application into services. Each service can
be developed, deployed, and scaled independently.
b. Example: For an online store, you might have one service for handling user
accounts, another for processing orders, and another for showing product
details. Each of these services can be scaled independently depending on
how much load they are getting.
4. Storage:
a. Google App Engine integrates with Google’s storage services like Cloud
Datastore (NoSQL database), Cloud SQL (relational database), and Cloud
Storage (for storing large files like images or videos).
b. Example: You could store user data in Cloud Datastore and user-uploaded
files (like images) in Cloud Storage. This makes managing your app's data
efficient.
5. Developer Tools:
a. App Engine provides tools like the Cloud SDK to help developers deploy and
manage their apps easily. The Google Cloud Console allows real-time
monitoring of your application’s performance and health.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 8
Department of CSE Cloud Computing 21CS72
b. Example: When you’re developing your app, you can test it locally, and once
you’re ready, you can deploy it with just a few commands using the gcloud
CLI.
How Google App Engine Supports Application Development:
1. Simplified Deployment:
a. Developers can upload their code directly to App Engine, and it will
automatically handle the environment and server management. You don’t
need to worry about hardware or configuration details.
b. Example: If you have a Python web app, you can simply upload it to App
Engine, and Google will take care of provisioning the servers, load balancing,
and scaling it based on the demand.
2. Managed Infrastructure:
a. With App Engine, Google handles everything related to servers, networking,
and storage. You don’t need to worry about provisioning servers, installing
software, or configuring networking.
b. Example: If you want to build a mobile app with a backend, you can use
Google App Engine to host the backend, and it will handle all server-side tasks
automatically.
3. Automatic Scaling:
a. App Engine automatically scales your application based on traffic. It can add
more instances when traffic spikes and scale back down when traffic
decreases, ensuring your app runs smoothly without requiring manual
intervention.
b. Example: If your app gets a lot of users during a special event (like a flash sale
or concert), App Engine will automatically create more resources to handle
the increased traffic.
4. Integration with Google Cloud Services:
a. Google App Engine easily integrates with other Google Cloud services like
Cloud Pub/Sub, Cloud Firestore, and Google Cloud Storage. This makes it
easy to extend your app and add features like messaging, notifications, or
storing large files.
b. Example: Your app can use Cloud Pub/Sub to send real-time messages or
notifications to users when new content is available.
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 9
Department of CSE Cloud Computing 21CS72
Example: Suppose you're developing an online store. You can host the front-end of the store
on Google App Engine, which will handle the scaling of your web pages based on the number
of visitors. When customers upload product images, App Engine can integrate with Cloud
Storage to store the images and Cloud Datastore to manage the product data. By using App
Engine’s automatic scaling, your store will be ready for high traffic during peak shopping
hours
Department of CSE Proudhadevaraya Institute of Technology, Hosapete 10