Module 2

Standards Security and Licencing

in Cloud
 Introduction
• The standards assure that users can work well with the vendors.
• Small organizations show great interest in open standards for Cloud
computing since it provides numerous opportunities for them.
• Large Cloud providers, like Google and Amazon might show little
interest to develop open standards for fear of losing their lock on
many of their existing customers.
• Cloud standards come in three aspects, which are standards for
security that help in providing a secured environment for the most
important information in the Cloud, standards for end-users/
application developers which enables them to understand the new
code very quickly and easily, and standards for messaging which
prescribes the format for defining and sending messages.
 Standards for Security
• The main purpose of security standards is to ensure a secure
environment which provides security and privacy of secret
information in Cloud.
• The following are protocols which are not exclusively specific
for Cloud security and needed merit coverage too.
 Security Assertion Mark-up Language
• SAML mainly specifies three components, namely, protocol, assertions
and binding.
• A SAML protocol can be considered as a simple request-response protocol.
• SAML works with several protocols, like File Transfer Protocol (FTP), Simple
Mail Transfer Protocol (SMTP), Hypertext Transfer Protocol (HTTP), and
also supports Electronic Business XML (ebXML), BizTalk and SOAP.
• Assertions are statements which are referred by the service providers to
make access control decisions.
• SAML Assertions are transferred from identity providers to service
providers.
• There exist three types of assertions, namely authentication assertion,
attribute assertion and authorization assertion.
• Authentication assertion is for validating the identity of the user, Attribute
assertion consists of specific information regarding the user; and
Authorization assertion mainly identifies what a particular user is
authorized to do.
 Security Assertion Mark-up Language
• A SAML binding defines how SAML requests and responses are
mapped to standard messaging protocols.
• The main concept of SAML is that it helps in passing security
information between secure web domains through assertions.
• SAML protocol describes only what is transmitted. It is that the
binding defines how the information is transmitted.
 Open Authentication (Oauth)
• OAuth is an open authentication protocol, which allows applications
to obtain user's data in a protected way.
• It's a simple open standard for secure API authentication. OAuth is
a way for publishing and interacting with secured data.
• This offers a mechanism for users to permit access to private data
while protecting private credentials.
• The main advantage for users in this is that they are completely in
control of what the applications can do or what cannot do and also
they need not share their passwords with any third party
applications like Facebook or Twitter.
• OAuth itself offers no privacy at all, but are based on other protocols, like
SSL to implement that.
• OAuth is token-based Authentication, that is, the logged-in user has a
unique token which is used to access data from the site.
 Open Authentication (Oauth)
• OAuth offers the following major improvements when compared to
traditional models like basic auth:

1. OAuth includes working with abstract access tokens which do not share
any of the users passwords.
2. Users can observe the tokens which are active, which means that
applications are able to access their data on the provider site.
3. The tokens that are issued from a provider site can be revoked at any
given time giving more control to the user.
 OpenID
• An OpenID provides the user the flexibility to use an already existing identity
to login to several websites, without creating new passwords.
• In this way, users are able to control the amount of information that they want
to share with the websites they have visited.
• With OpenID, the password and account registration will be given only to the
identity provider and the task of validating the identity to the participating
websites will be taken care of by the provider.
• Users can create accounts with their choice of OpenID identity providers and
will be able to use those created accounts as the basis for logging on to any
website that accepts OpenID authentication.
• It is a Single-Sign-On (SSO) procedure of access control.
• With this, the users can login once and gain access to resources across various
participating systems.
• Only standard HTTP requests and responses are used by OpenID
authentication.
• The only thing that is needed is that the user should have an authenticated
account at any OpenID provider like Google, my OpenID or LiveJournal.
 OpenID
• After the verification of the OpenID identifier, OpenID authentication is
confirmed successful, and the user is considered to login into any relying
party website.
• OpenID will not provide its own authentication methods; in fact if an
identity provider uses strong authentication, it may be used for secured
transactions.
• The OpenID works as follows: A user visits a website which displays an
OpenID loginform that contains only one field for the OpenID identifier.
• The user has to type the previously registered 'OpenID identifier'
 Secure Sockets Layer/Transport Layer Security
• Both Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are
cryptographically secure protocols which are designed to provide data
integrity and security for communications over TCP/IP (Transmission
Control Protocol/Internet Protocol).
• Transport Layer Security is the successor to SSL.
• The TLS offers end point authentication and data confidentiality with the
help of cryptography.
• Whenever client and server applications communicate across a network,
TLS protocol gives assurance that no other third party may tamper or
eavesdrop with any message.
• The difference between TLS and SSL is that TLS uses the Hashing for
Message Authentication Code (HMAC) algorithm over SSL Message
Authentication Code (MAC) algorithm.
 Secure Sockets Layer/Transport Layer Security
• The TLS protocol mainly includes two layers:
1. TLS Record Protocol: This protocol offers connection security with the
help of symmetric data encryption and assures that the connection is
reliable.
2. TLS Handshake Protocol: It provides both the server and client to
authenticate each other and negotiate regarding encryption algorithm
and cryptographic keys before the selected application protocol starts
transmitting or receiving any data.
• The TLS is performed in the following phases:
1. The client and server negotiate on an appropriate algorithm;
2. A key is exchanged using public-key encryption and authentication based
on certification:
3. A symmetric cipher is used during data exchange.
 Standards for Application Developers
• Programming standards are very much important to programmers for
different types of reasons.
• Programming standards allow the developers to understand new codes
more easily and quickly, and also help in improving the readability of the
software.
• In general, it is stated that 80 per cent of the lifetime cost of a software
goes to maintenance.
• The following are the application standards which are commonly used in
browsers for the purpose of transferring and protecting data.
 Browsers (Ajax)
• Ajax is Asynchronous JavaScript and XML which uses different existing
technologies together, including HTML or XHTML, JavaScript, XSLT, XML,
Cascading Style Sheets.
• Document Object Model and XMLHttpRequest object for creating
interactive web applications.
• The main purpose of Ajax is to improve the web page's interactivity,
usability and speed. It is a web browser technology, which is independent
of web server software.
• XMLHttpRequest object and JavaScript provide a way for exchanging data
asynchronously between the server and browser to prevent full page
loads.
• With Ajax, web applications can send or retrieve data from a server
asynchronously without interfering with the behaviour and display of the
existing browser page.
 Browsers (Ajax)
• The following points describe the purpose of each technology that has
been used in Ajax.
1. For presentation purpose the technologies HTML or XHTML and CSS are
used.
2. The Document Object Model (DOM) is used for dynamic display and
interaction with the content.
3. For the purpose of exchanging data, XML is used, and for its manipulation
XSLT is used.
4. The XMLHttpRequest object is used for asynchronous communication.
5. To work out all technologies together, JavaScript is used.
 Browsers (Ajax)
• The famous web applications which use Ajax are Google Suggest, Google
Maps, Yahoo Maps and Gmail. In a traditional web application, there exist
multiple customers waiting for server response.
• In standard web applications, the interaction between the server and the
customer will be in a synchronous way, that is, one happens after the
other.
• In the case of Ajax, web browser consists of the Ajax engine which renders
the web application and handles the requests that the customer makes to
the web server.
• The important thing to note here is that the Ajax engine handles the
requests, and the engine itself holds almost all information while
supporting the interaction with the application and the user to happen
asynchronously without any interaction with the server
 Data (XML, JSON)
• XML is an Extensible Markup Language which is a specification developed
by the W3C.
• Its main purpose is to carry data, but not to display data. It was mainly
designed to transport and store data having a focus on what data is.
• It is human and machine readable and offers the users to choose their
own XML tags.
• Various XML-based protocols are there to represent data structures for
the purpose of data interchange.
• XML, with other standards, leads to the possibility of defining the
document content separately from its formatting.
 Data (XML, JSON)
• The advantage here is that it gives the chance to reuse that content in any
other applications or for any other presentation environments.
• XML offers a standard syntax which can be used to share information over
different kinds of computers.
• different organizations, and various applications without any need to
convert from one to another.
• XML documents include a variety of rules and naming conventions.
 JavaScript Object Notation (JSON)
• JavaScript Object Notation (JSON) is a lightweight data-interchange
format.
• It is language independent and easy for humans to understand.
• It is built on two structures, namely a collection of names or values, or
both; one which is based on an object, dictionary, record, struct, keyed
list, hash table or associative array in various languages and ordered list of
values, Or one which contains a vector, list, array or sequence in most
languages.
• It is sometimes used for transmitting structured data through a network
connection in a process known as serialization.
• It is basically considered as a language independent data format. It is
often used in Ajax where it works as an alternative to XML format.
• Using JSON is simple when compared to XML.
 Linux, Apache, MySql and PHP
• LAMP is derived from Linux, Apache, MySql and PHP (Python or Perl).
• The combination of all these technologies is mainly used to define a web
server infrastructure or to create a programming environment for
developing software.
• LAMP has the capability to serve tens of thousands of requests
simultaneously.
• The LAMP combination became very popular due to its open source
nature, the wide distribution of its components, and low cost.
• The LAMP can be sometimes used in combination with any free and open-
source software packages like RRD tool for diagrams.
 Standards for Messaging
• A message is a piece of information that is transferred from one place to
another place.
Simple Message Transfer Protocol
• Simple Message Transfer Protocol (SMTP) is a standard network protocol
for transferring messages to an e-mail server over the internet.
• It was first defined by RFC 821 in 1982 and modifications happened over
the years, and it was finally updated in 2008 with extended SMTP
additions by RFC 5321.
• RFC – Request For Comments (Technical Document defines SMTP).
• Earlier, e-mail messages were sent with the help of File Transfer Protocol
(FTP), but now SMTP is in use for messaging.
• The FTP protocol is for transmitting files, but not messages; thereby it
does not provide any source for receivers to recognize the sender or for
the sender to designate an intended receiver.
• It is the duty of the administrator to open or print when some message is
showed up on the FTP server.
 Simple Message Transfer Protocol
• SMTP was designed in which the sender and receiver information can be
transmitted with the message.
• Most e-mail systems which send mail through the internet use SMTP to
transfer messages from one server to another server, and the messages
that are retrieved with an e-mail client may use either POP (Post Office
Protocol) or IMAP (Internet Message Access Protocol).
• Since SMTP is used to transfer messages from a mail client to a server, it is
necessary to specify both the IMAP or POP server and the SMTP server
while configuring the e-mail application.
• The major strengths of SMTP are simplicity and reliability.
• Most of the servers these days are using the updated version of SMTP,
that is, Extended Simple Message Transfer protocol (ESMTP, which
supports transmission of multimedia through e-mail.
 Post Office Protocol
• The Post Office Protocol (POP) is a light weight protocol which enables a
server to store messages till a client connects and requests for those
messages.
• Whenever the client connects, the POP servers start downloading the
messages and then delete all those downloaded messages from the
server, thereby creating space to store more messages.
• This protocol is defined by RFC 1939 and generally functions on TCP port
110.
• The two versions of POP are POP2 were used in the mid-1980s and
required SMTP to send messages, while the POP3 version may be used
with or without SMTP.
• The POP treats the mailbox as a single store without the concept of
folders.
 Internet Messaging Access Protocol
• Internet Messaging Access Protocol (IMAP) is a protocol for retrieving e-
mail and storage.
• Once the messages in the mail are downloaded with POP, they
automatically get deleted from the server after the download process has
completed.
• Thus, POP users need to store their messages locally, if they are important
and useful.
• However, problem occurs when users move from one system to another
system or if they use mobile networking, because their messages do not
move wherever they go.
• So IMAP is created to overcome these problems, which allows messages
to be stored on the server, but allows viewing and manipulation through
the browser as if they were stored locally.
Internet Messaging Access Protocol
 Legal and Regulatory Issues
• The legal and regulatory issues will vary and the new laws will come into
existence, which can change the responsibilities of users and providers.
• The cloud model, either Community, Hybrid or Public, employed by Cloud
computing include the presence of third party, namely the Cloud provider.
• The two things to be considered here are how laws are applicable to
different parties under various situations and also for different kinds of
information management situations.
• Whatever computing model the users choose to use, it is necessary to
consider the legal issues that surround the data which may be gathered,
stored and processed.
• If the Cloud customer operates in Canada, European Union (EU) or United
States, then the user may have been subjected to numerous regulatory
requirements involving Safe Harbor and Control Objectives for information
and related technology.
 Legal and Regulatory Issues
• These laws are related to where the information is transferred to or
stored, and also to what extent security is provided to that information.
• Some organizations store health-related data regarding individual
employees, where the organization must comply with Health Insurance
Portability and Accountability Act (HIPAA) even if they don't work in that
market.
• The following laws are for the United States and the European Economic
Union (EEU), but similar laws will sometimes be in effect in other countries
as well.
 Third Parties
• It is the responsibility of the users to check out that all the legal
requirements which are applied to the organization are being implied to
the provider as well if they are going to use the Cloud infrastructure
sourced from that provider.
• Since the usage of Cloud infrastructure becomes popular, there is a chance
of illegal data access by the third party.
• Even if the user performs encryption with the data, the third party may
get access to keys by any means and thereby getting access to the data.
• The risks may increase since it may involve a number of third parties, like
the Cloud provider, Cloud support, management teams, etc.
• The organization must evaluate its particular needs and requirements
before beginning towork with a Cloud provider.
• It is necessary to define the scope of the services the users are expecting
along with any regulations or compliance issues which are to be satisfied.
 Third Parties
• Before going to negotiate a contract, it is essential to ensure that that the
provider agrees and understands the requirements of the user.
• At the end of the contract, either full term or abnormal termination
situations-are-to be considered carefully since the data may be at the
highest risk during this time.
• Factors such as bankruptcy, breach of contract by one party, and Cloud
provider ceasing activities are the causes of abnormal termination. During
this type of critical situations, it is better to replace a vendor instead of
spending time with the previous provider.
• Its required to check whether all the data is removed and cleansed on the
rejected provider's systems based upon its confidentiality.
• The Cloud provider may show less interest in removing data since the
contract is terminated.
 Third Parties
• If the user clearly defines the required tasks to do at the termination time
in the original contract, then the data is assured to be deleted as per the
user's requirement according to legal basis.
• If the user wishes to transfer the services from one provider to another
provider during the contract or at the time of contract termination, he or
she has to clearly define the legal issues at the beginning of the contract.
• A contract is required to move the data securely between providers.
• It is up to the user to move the data directly to the new provider or to
transfer the data back to the organization and then again transfer the data
to the new provider.
• The data should be securely transferred irrespective ofthe method used
while it is in transit.
 Data Privacy
• Data privacy is an important need in every area.
• Every company must have a legal obligation to assure that the privacy of
their clients and employees is protected. In the area of Cloud computing,
the third party operates and manages the infrastructure, thereby there is
a chance of data insecurity.
• If the organization is gathering and storing data in Cloud, that must be
subjected to legal issues of one or more regulations (either GLBA or
HIPAA), and then it is required to assure that the Cloud provider secures
the data in a proper way.
• GLBA - Gramm-Leach-Bliley Act.
• HIPAA - Health Insurance Portability and Accountability Act.
• The data gathered in the Cloud, as well as in the organization must be
used only for the purpose for what it is collected.
• The data will be stored somewhere whether some information is posted
on Facebook or business links on LinkedIn, etc.
 Data Privacy
• Since businesses are moving towards the use of Cloud providers, data
location is an important issue due to its privacy or legal requirements.
• Global companies are required to assure that whatever services they
deploy on Cloud are used with respective to the laws and regulations that
are in place for third parties, foreign subsidiaries or employees who may
wish to use it.
• The laws of United States will be marked differently when compared to
other countries, so the laws that are subjected to the employees must act
based upon their location.
 Data Privacy
• The data protection laws regarding EU member states and also other
countries are very complex and include some specific requirements.
• The personal data transfer outside these countries must be handled in a
proper way.
• The EU needs that the controller of the data or the collector of the data
should inform individuals that the data is to be transferred and processed
in a country which is outside the EU.
• The end processor and the data controller need to maintain the contract
which is approved by the Data Protection Authority before the beginning
of the task.
• This involves different levels of complexity based on the country which is
going to process the data.
 Data Privacy
• Whatever the Cloud provider the user deploys, it is essential to check out
whether the jurisdiction includes enough security measures in place, that
is, primary and backup locations and also intermediate locations, and the
provider will detect any unauthorized data access.
• While working with the third party the server may be a Cloud provider, it is
quite essential to check out whether the security of the data meets all
legal and regulatory requirements.
• The provider must also agree with the laws related to a particular country
where the server is located.
• Proper care should be taken if the server resides in another country other
than the user's location, because the user needs to go through that
particular country jurisdiction to get back the data and would experience
totally different access rules to what are generally being used.
 CLOUD SECURITY CHALLENGES
• The Cloud security challenges are broadly classified into three categories:
1. User authentication: which restricts data access.
2. Data protection: protecting the data in rest and also in transit
3. Disaster and data breach: Fix includes contingency plan.
[Link] authentication:
• Only authorized persons are allowed to access the data which rests in the
Cloud.
• To ensure the integrity of user authentication, the organizations are
required to verify data access logs and audit trails to confirm that only the
authenticated users are accessing the data.
• All these access logs and audit trails are also needed to be protected for
organizational needs and also for legal purposes.
• It's the customer's responsibility to make sure that the Cloud provider is
following all the necessary security measures to secure the customer's
data.
 CLOUD SECURITY CHALLENGES
2. Data protection:
• Cloud computing involves placing data in the control of the third party, so
protecting the data is to be considered in two aspects, that is, data at rest
and in transit.
• Data must be encrypted every time with clearly defined roles regarding
the management of encryption keys.
3. Contingency planning:
• Organizations are required to know the way the data is being secured and
also the measures the Cloud Service Provider (CSP) is implementing to
assure the integrity and availability of the data.
• Organizations should also maintain contingency plans if their CSP fails.
 CLOUD DATA SECURITY
• Security should be provided to the data at all levels while using Cloud
computing.
• In today's world, security is provided by different means, like authentication,
authorization, establishing security to data in transit and at rest, accounting
procedures, locking down networks, and hardening Operating Systems (OSs),
application software, and middleware.
• The different aspects of data security are explained as follows:
1. Data-in-transit
• Data that is going to be transmitted can be encrypted to provide security
when it It is quite essential to choose a protocol which provides
confidentiality, as well as integrity.
• Protocols like Hypertext Transfer Protocol Secure (HTTPS), FTP over SSL (FTPS)
and Secure Copy Program (SCP) can be used for secured transmission of data
through internet.
• Using non-secured protocols and encryption algorithms which use symmetric
streaming ciphers can provide confidentiality, but may not assure the integrity
of the data.
 CLOUD DATA SECURITY
2 . Data-at-rest
• The data in storage, whether it is on a server, employee's computer or on
off-site tape backup, can be referred as data-at-rest. The process of
securing data either in the Cloud or outside the Cloud is similar.
• Data at rest in a Cloud is preferably not encrypted because it may avoid
searching or indexing of that particular data.
• The data either processed or stored for use by a Cloud based application
will combine with any other user's data, thereby unauthorized access may
still be possible by any means.
• Data in transit must be encrypted to provide security, but data at rest
might also be encrypted and provided for simply storage purpose.
• The data must be stored in an unencrypted way if the data in the Cloud is
to be processed by any application, since any application can process the
data which is in unencrypted form only.
 CLOUD DATA SECURITY
3 . Data Lineage
• Whether the data in the Cloud is in an encrypted form or not, it is often
required to have information regarding the location of data with
respective to time within the Cloud.
• This term describes what happens to data when it passes through
different stages.
• The main use of data lineage, as expressed by business experts, is to
protect data and reduce risk. On gathering huge amount of data,
organizations are exposed to legal or business liabilities.
• These may relate to possible security violations and exposure of
confidential data.
• Data lineage techniques will support data managers in the best way of
handling data and prevent some of the liabilities related with not knowing
the location of the data at a given stage.
 CLOUD DATA SECURITY
4 . Data Remanence
• It is the residual data which remains on a storage device, like hard drive or
floppy disk, after the task of deleting or erasing data.
• The causes of this residue may be the data being left by normal deletion or
due to the physical properties of the storage medium.
• Due to this, there may be a chance of unintentional disclosure of sensitive
information, as the storage media might be in an uncontrolled environment.
• The risk of this data remanence in the area of Cloud is that the organization's
data may be accidentally revealed to an unauthorized party, regardless of the
Cloud service it preferred to use.
• When the data is deleted from the hard drive, it is not typically deleted from
it; rather the OS removes the particular entry related to the location of that
data from its directory or database.
• This indicates that data which is deleted will still remain on the hard drive, till
that location is again used by the OS for storing new data.
• Sometimes this overwritten data may not completely be removed.
 CLOUD DATA SECURITY
Data Remanence
• There exist three methods which help in destroying data remanence and
making sure that deleted data in not possible to retrieve by any means.
• Clearing method is a process of overwriting in the location of deleted data
with some strings.
• The second method of purging cannot give a chance of accessing the
residue data or using any recovery software to find it on the disk.
• In this method a device is used which degausses the physical media, there
by affecting the magnetic field on the disk.
• The third method, destruction, involves the physical destruction of the
hard disk.
 NETWORK SECURITY
• The three areas in which network architecture is prominent to Cloud
computing are Data Centre Network. Data Centre Interconnect Network,
and Public internet.
• The network which interconnects the infrastructure resources, like
servers, storage devices, etc., within a Cloud is called Data Centre
Network.
• The network which connects multiple data centres in any type of Cloud to
support Cloud services is known as Data Centre Interconnect Network.
• Lastly, Public internet connects end users to the Public Cloud data centre.
• The following are some of the approaches to network security.
1. Security domains should be used to group virtual machines together,
thereby controlling the access to the domain with the help of the Cloud
provider's port filtering capabilities.
2. Traffic should be controlled using the Cloud provider's port-based
filtering or by utilizing more Stateful packet filtering by interposing
content switches or firewall places where appropriate.
 NETWORK SECURITY
• Network security risks related to Cloud are mobile device attacks and
increased risk of hacking and intrusion.
• Amazon's EC2 offers security groups which define a firewall that
determines what traffic can reach virtual servers in a particular group.
• Even though the user may understand that the security groups are virtual
network segments secured by a firewall, they most definitely not because
of the following reasons.
1. Servers belonging to the same security group cannot be able to
communicate with each other at all.
2. Two servers existing in two different EC2 availability zones may operate in
the same security group.
3. The server can relate to more than one security group.
 HOST SECURITY
• Host security mainly explains how the server is setup to react to the following things:
1. How it will respond to attacks;
2. To prevent attacks;
3. To minimize the effect of a successful attack on the whole system.
[Link] as a Service and Platform, as well as a Service Host Security
• Cloud service providers will not risk sharing the information regarding their host
operating systems, host platforms, and the processes which are in place to protect the
hosts, because hackers can make use of the information which may lead to insecurity of
the Cloud.
• It is the responsibility of the CSP to secure the hosts in the cases of Software as a
Service (SaaS) (Workday. com, [Link], etc.) and Platform as a Service (PaaS)
([Link]'s [Link],Google App Engine, etc.) Cloud services.
• To get a guarantee from the CSP regarding the security of the hosts, it is the user's task
to ask the vendor to share the information under Non-Disclosure Agreement (NDA)) or
to demand that the CSP shares the information through the controls assessment
framework (SysTrust or ISO 27002).
• The CSPs make use of virtualization platforms like VMware hypervisors and Xen in
theirhost platform architecture, since virtualization enhances the host hardware
utilization among all other benefits.
 HOST SECURITY
• The users need to understand the provider's way of using virtualization
and its process in protecting the virtualization layer. The SaaS and PaaS
platforms hide the host OS from end-users through the host abstraction
layer.
• The main difference between the SaaS and PaaS platforms is regarding the
accessibility of the host abstraction layer. In SaaS, this abstraction layer is
accessible to the developers and the CSP's staff.
• In other words, the host abstraction layer is not accessible to users in the
case of SaaS.
• In the case of PaaS, the users will be given indirect access to this layer
with the help of PaaS Application Programming Interface (API).
 HOST SECURITY
[Link] as a Service Host Security
• In this the users are mainly responsible to protect the hosts, which is not
in the case of SaaS and PaaS.
• Almost all the Infrastructure as a Service (laaS) services that have been
available today use virtualization at the host layer.
• The laaS host security is classified as virtual server security and
virtualization software security.
Virtual server security (customer guest OS)
• Users are given complete access to virtual servers. The users have the
whole responsibility to protect the guest VM (Virtual Machine).
• Public laaS, like Amazon's EC2 (Elastic Compute Cloud) provides web
services API to accomplish some management functions like replication,
provisioning and decommissioning of virtual servers on this platform.
• When these functions are orchestrated, it may lead to the elasticity of
resources either to increase or decrease in line according to workload
demand.
 HOST SECURITY
The following are some of the threats related to host security in public laaS:
1. Attacking systems which are not that much protected by host firewalls.
2. Stealing keys which may be used to manage hosts (for example SSH private
keys).
3. Hijacking accounts which are not secured.
Virtualization software security
• Virtualization at the host level is carried out by using OS-level virtualization,
hardware-based virtualization or paravirtualization.
• Cloud service providers manage this layer and the users are not permitted to
access this layer in public laas.
• Operating System-level virtualization or hardware-based virtualization enable
hardware resource sharing over multiple guest VMs by not interfering with
each other, thereby running multiple OSs and applications on a single system
at the same time.
• It is the duty of the laas customers to understand the technology and all the
security process controls employed by CSP to secure the hypervisor.
• Thus, this will assist the user to figure out the compliance and any existing
gaps with reference to host security standard and regulatory compliances and
policies.
 CLOUD DATA CENTRE
• A data centre is a service used for residential computer systems, as well as
its associated elements such as storage systems and telecommunications.
• It usually comprises backup power supplies, environmental controlling
factors, like fire suppression and air conditioning, and different security
devices.
• Data centres used for Cloud computing are known as Cloud Data Centres
(CDCs).
• Requirements for a Cloud Data Centre
1. Self-service on need
2. Resource pooling
3. Quick elasticity
4. Broad Network Access
5. Precise usage
 Comparing Traditional and Cloud Data Centres
• Cloud data centres are frequently one of the primary business areas that
companies has to consider while switching into Cloud service because of
high cost of infrastructure as well as administration.
• The initial step is to discover a Cloud service provider, then know the cost
for the required services and evaluate it to the charges of your individual
data centre.
• Consequently you will know about the significance of Cloud data centre.
• The following are the comparisons between traditional and Cloud data
centres:
1. In case of traditional data centres, servers are co-located and dependent
on failure, whereas, Cloud servers are integrated and fault-tolerant .
2. Resources in traditional data centres are partitioned and performance
interrelated, but in Cloud they are unified and performance isolated.
3. Management in traditional data centres is segregated and manual,
whereas, in case of Cloud the management has a fully centralized control
with automation.
 Comparing Traditional and Cloud Data Centres
4. Scheduling is planned ahead and over provisioning is done in traditional
data centres, but in case of Cloud it is flexible and scalable.
5. Renting in traditional data centres is based as per physical machine,
whereas, in case of Cloud renting is per logical usage.
6. Applications and services are fixed on designated servers in traditional
data centres, whereas, in case of Cloud, it executes and moves across all
Virtual Machines
 MOVING INTO THE CLOUD
• Technology demands focus for highest benefits such as process
improvement, change management, solid leadership, as well as best
practices expertise.
• In case of traditional IT delivery, business feels restricted by IT.
• But in case of Cloud focused IT delivery as well as IT craft value, both
associatively distributed focus, objectives as well as new business models.
 Comparison of Traditional Computing and Cloud
Computing
• The following are the comparisons between traditional and Cloud
computing:
1. In traditional computing, one can purchase assets and build technical
architecture, whereas, in Cloud computing, one can purchase service in
which architecture is included.
2. In traditional computing, payment can be done for assets and high admin
functions, whereas, in Cloud computing, payment is done for use and
decreased admin functions.
3. Single tenant, non-distributed, and a static environment is observed in
traditional computing, whereas, in Cloud computing multiple tenant,
scalable, elastic, and a dynamic environment is observed in Cloud
computing.
4. Deployments in traditional computing are costly and lengthy, whereas, in
Cloud computing reduced deployment time is found.
 Benefits of Cloud Computing
• The objective of Cloud computing is to facilitate users to utilize the
benefits from each and every technology.
• The following are the advantages of Cloud computing:
1. Cloud increases the focus on business issues and allows for scalable,
enterprise-class complexity.
2. Cloud computing offers a rich ecosystem of vendors and service
providers.
3. Cloud platforms are scalable, secure, and enterprises.
4. Cloud web services focus on creating powerful integrations.

• Since Cloud computing has the above advantages over traditional

computing, entire businesses are transforming to Cloud computing.
 ISSUES IN CLOUD COMPUTING
• Cloud computing is a technology which allows the user to access resources
by means of front end machines; there is no requirement to install any
software.
• There are several challenges related to Cloud computing, which are
discussed as follows:
1. Security issues.
2. Data issues.
3. Performance issues.
4. Energy related issues.
5. Fault tolerant.
 Security Issues
• Security is usually alleged to be a big issue for Cloud.
• There is a risk, where a malicious user can pierce the Cloud by imitating a
legitimate user, thereby contaminating the whole Cloud, thus affecting
several customers who are distributing the infected Cloud.
• Some of the security risks faced by Cloud computing are as follows:
1. Data integrity
2. Data theft
3. Security on vendor level
4. Security on user level
5. Information security
 Data Issues
• Some of the problems faced by data are as follows:
1. Data loss.
2. Data location.
3. Data lock-in.
4. Data segregation.
5. Data confidentiality and audit ability.
6. Data integrity and theft .
7. Data deletion.
8. Data restitution.
9. Service level agreements.
 Performance Issues
• Bad application and performance leads companies to deplete customers,
decreases employee productivity, as well as reduces the bottom line
profits.
• Applications clash due to bad performance.
• If the applications cannot perform effectively due to rise in traffic, then
the organization may ignore the customers.
• The following are the performance issues face in Cloud computing:
1. Poor application performance.
2. Slow access to applications and data.
3. Horizontal and vertical scalability.
4. Administrative and geographical scalability
 Energy Related Issues
• Cloud computing is rapidly increasing in significance as growing
numbers of enterprises, as well as individuals are moving their
workloads to Cloud service providers.
• Services presented by Cloud providers, for example, Microsoft,
Google and IBM, are executed on thousands of servers extend
across several geographically shared data centres.
• Overloading of the servers leads to a wastage of energy.
• Interestingly, more than data storage, the transmission of data
between servers and home computers consumes huge amounts of
energy.
 Fault Tolerance
• Fault tolerance is one of the significant challenges of Cloud
computing.
• Fault tolerance is related to all the techniques required to allow a
system to bear software defects.
• Fault tolerance in cloud computing refers to the system’s ability to
keep running even if a software or hardware malfunction occurs
and it enters a down state, critical to increase a system’s reliability
and maintain it helpful to the user in all circumstances.
• The entire system will continue to require monitoring of available
resources and probable breakdowns, as with any fault tolerance in
distributed systems.
 KNOW YOUR SOFTWARE LICENSES
• Software licensing is motivated by the vendors like Amazon.
• Licensing models in Cloud are frequently pay-as-you-go, as well as
subscription-based licenses.
• A well-known case is that of [Link] which is licensed, based on
the number of users on a subscription point of view.
• This model proceeds well for a completely integrated service or when
restoring an existing software output.
• If the organization has shifted to a Cloud environment, then it must know
the applications and licensing models that are used in the Cloud
computing environment.
• Microsoft has built a committed software license model for Cloud service
providers depending on the Processor License (PL) or Subscription Access
License (SAL), depending on the number of end-users associated.
• Both PL and SAL are approved on a periodical basis to service providers.
IBM presents a long-term or an hourly payment billing plan.
 KNOW YOUR SOFTWARE LICENSES
• The following factors are considered when several licensing models
are offered in Cloud:
1. The number of users using the software.
2. The processor's count of the device hosting the application.
3. Products accessing rights are restricted to particular vendors for
Cloud computing platforms. For example, Oracle possesses its
specific set of rules.
 SERVICE LEVELS OF CLOUD APPLICATIONS
• A Service Level Agreement (SLA) is an element of a service
agreement in which a service is properly described.
• In general, the word SLA is used to denote the contracted delivery
period.
• A SLA is a contract between two or more parties, in which customer
and service providers are Included.
• This includes formal and informal contracts. Agreements between
service providers and other parties are frequently called SLAs
because the service level has been placed by the customer; there
can be no contract between third parties. These kinds of
agreements are simply known as 'contracts'.
 Common Metrics
• Metrics commonly arranged in these cases are as follows:
1. ABA (Abandonment Rate): proportion of calls discarded while
waiting to be responded.
2. ASA (Average Speed to Answer): Average time it takes for a call to
be replied by the service desk.
3. TSF (Time Service Factor): Fraction of calls answered within a
particular timeframe, for example, 90 per cent in 25 seconds.
4. FCR (First-Call Resolution): Fraction of incoming calls that can
result without the use of a call back to finish resolving the case.
5. TAT (Turn Around Time): Time taken to finish a particular task.
6. MTTR (Mean Time to Recover): Time taken to recuperate after an
outage of service.
 Service Levels of Cloud Computing
• The following are the service levels of Cloud computing:
SaaS:
• The highest level of software applications is only available in
Software as a Service (SaaS).
• E-mail is a simple example for SaaS.
• If a client has an Internet Provider (IP), then he or she will require a
desktop or mobile app to access the e-mail; if not, the consumer
can host it on individual servers.
• The client has a limited control of user specific application
configuration settings.
 Service Levels of Cloud Computing
PaaS:
• In between SaaS and Infrastructure as a Service (IaaS), Platform as a
Service (PaaS) is included.
• In this service level, the service provider takes responsibility of the
underlying infrastructure by providing the platform with which one
has to build and host the application.
• Some industries feel that PaaS service level is the most powerful
among the three levels.
• The client has the control over the deployed apps, as well as the
possible configuration settings for the application hosting platform.
 Service Levels of Cloud Computing
IaaS:
• On the contrary end of the spectrum, IaaS is present, where the
client can outsource the hardware.
• It is not just the machine power that is leased; it also possesses
power, networking, as well as cooling.
• In general, laaS is the blend of compute and Cloud storage. The
client has the power over Operating Systems (OSs), storage space,
deployed apps, as well as the possibly restricted power of select
networking elements.
 MAJOR PLAYERS IN CLOUD COMPUTING
• Cloud computing is being encouraged by several big companies.
• In Cloud computing, an application can be executed on various
computers.
• Cloud has become the vital technology to overcome the market
needs, which is the reason for many of the companies to shift
towards the Cloud.
• The following are the major players of the Cloud computing
environment
 MAJOR PLAYERS IN CLOUD COMPUTING
1. Google - Google cloud platform(GCP) is another set of solutions for users
to get the benefit of cloud services. If you are serious about latency to
build performance-oriented applications then Google cloud is the best
choice because it includes GCP & G Suite.
2. Microsoft - Microsoft Azure was launched in 2010 as Windows Azure, and
later in 2014, it was renamed, Microsoft Azure. It was launched years
after the release of AWS and Google cloud but still, it is the fastest-
growing cloud and giving tough competition to AWS and other cloud
service providers.
3. Amazon -Launched in 2006, AWS is the best cloud service provider
leading in the market. It becomes a major player in AI, database, machine
learning, 5G cloud, multi-cloud and serverless deployments. AWS
operates in 20 geographical regions across the world.
4. Apple
5. Adobe
6. Cisco
MAJOR PLAYERS IN CLOUD COMPUTING