Cloud Security

Chapter (5)

Dr. Amani AbuRumman

 Cloud Computing Security
Risks
Security is among a top concern with cloud computing...

People and Application and process

Help keep applications secure,
identity
protected from malicious or
Mitigate the risks
fraudulent use, and hardened
associated with user
against failure
access to corporate
resources Network, server and end
point
Data and Optimize service availability by
information mitigating risks to network
Understand, deploy components
and properly test
controls for access to Physical infrastructure
and usage of sensitive Provide actionable intelligence on
data the desired state of physical
infrastructure security and make
improvements
 Introduction
What is Security in
Cloud?
"Cloud security is a series of principles,
methodologies, and technologies designed to
control and secure the cloud environment. By
implementing strict access controls, system
audits, and other measures, cloud security can
reduce the risks associated with moving to a
cloud environment."
With the rapid adoption of cloud technologies, it is
essential for businesses to understand and
implement best practices to protect their valuable
data, ensuring the integrity and privacy of their
systems.
 Security Issues in Cloud Computing

Cloud security is an evolving sub-domain

of computer security, network security,
and, more broadly, information security.

It refers to a broad set of policies,

technologies, and controls deployed to
protect data, applications, and the
associated infrastructure of cloud
computing.
 Security issue in Cloud Computing
Important security and privacy issues :

• Data Protection: To be considered protected, data from one customer

must be properly segregated from that of another.

• Identity Management: Every enterprise will have its own identity

management system to control access to information and computing
resources.

• Application Security: Cloud providers should ensure that applications

available as a service via the cloud are secure.

• Privacy: Providers ensure that all critical data are masked and that only
authorized users have access to data in its entirety.
Benefits of Cloud Security for
Business

In today's digital world, businesses use cloud services a lot to store,

process, and manage their data. Cloud technology has many
advantages like being able to easily scale, saving costs, and offering
flexibility. However, it also brings new security risks. Without proper
security measures, businesses can be targets for cyberattacks, data
leaks, and other security problems. These issues can lead to serious
consequences such as financial loss, damage to reputation, and legal
troubles.
Protection Flexible
against DDoS Features
attack

Benefits

Data Security & Analyse Risks

Data Integrity
Benefits of Cloud Security for
Business

DDoS Attack means "Distributed Denial-of-Service (DDoS) Attack" and

it is a cybercrime in which the attacker floods a server with internet
traffic to prevent users from accessing connected online services and
sites.
 The Importance of Cloud Security
With so many business activities now being conducted in the cloud and with
cyberthreats on the rise, cloud security becomes critically important.
A cyber or cybersecurity threat is a malicious act that seeks to damage data,
steal data, or disrupt digital life in general. Cyber-attacks include threats like
computer viruses, data breaches, and Denial of Service (DoS) attacks.
• Common types of cyber attacks:
 Malware: Malware is a term used to describe malicious software, including spyware,
ransomware, viruses, and worms.
 Phishing.
 Man-in-the-middle attack.
 Denial-of-service attack.
 SQL injection.
 Zero-day exploit.
 DNS Tunneling.
 Shared Responsibility
Model

• The shared responsibility model outlines the division of security

responsibilities between the cloud provider and the customer.
• Cloud providers typically handle security "of" the cloud, while
customers are responsible for security "in" the cloud.
• It is essential to understand the specific security responsibilities
when working with cloud services.
Identity and Access Management (IAM)

• Implement strong identity and access management controls to

ensure only authorized users can access cloud resources.
• Use strong authentication mechanisms such as multi-factor
authentication (MFA) to add an extra layer of security.
• Review and update user access privileges to prevent unauthorized
access.
 Data Encryption

Data encryption plays a key role in maintaining the confidentiality and

integrity of sensitive information stored in the cloud.

Encryption is the process of converting plaintext data

into ciphertext, making it unreadable to unauthorized
individuals. When it comes to cloud security, data
encryption can be implemented in two primary forms:
encryption at rest and encryption in transit.

• Encrypt sensitive data at rest and in transit to prevent

unauthorized access.
• Use strong encryption algorithms and key
management practices to ensure data confidentiality.
• Implement encryption for both storage and
communication channels.
 Cont…

Encryption at rest

• Encryption at rest refers to the process of

encrypting data when it is stored in persistent
storage, such as databases or files.
• It ensures that even if an unauthorized party Encryption
gains access to the physical storage media, they at rest
won't be able to decipher the encrypted data.
• Strong encryption algorithms and robust key
management practices should be employed to
ensure the effectiveness of encryption at rest.
Cont…
Best Practices for Cloud Security
1. Strong Authentication and Access
Control
Implementing strong authentication mechanisms, such as multi-factor
authentication (MFA), helps ensure that only authorized individuals can
access sensitive data and systems.
Additionally, businesses should regularly review and update access controls
to align with their evolving security requirements and employee roles.

2. Data Encryption and Privacy

Implementing strong authentication mechanisms, such as multi-factor
authentication (MFA), helps ensure that only authorized individuals can
access sensitive data and systems.
Additionally, businesses should regularly review and update access
controls to align with their evolving security requirements and employee
roles.
 Best Practices for Cloud Security
3. Regular Data Backups
Encrypting sensitive data both in transit and at rest provides an extra layer of
protection against unauthorized access. Utilizing encryption technologies,
such as SSL/TLS protocols for data in transit and robust encryption algorithms
for data at rest, helps safeguard data confidentiality and integrity.
Secure Sockets Layer (SSL)
Transport Layer Security (TLS)
Both SSL and TLS are communication protocols that encrypt data between servers, applications, users, and systems.
They authenticate two parties connected over a network so they can exchange data securely.
4. Monitoring and Auditing
Implementing strong authentication mechanisms, such as multi-factor
authentication (MFA), helps ensure that only authorized individuals can
access sensitive data and systems. Additionally, businesses should regularly
review and update access controls to align with their evolving security
requirements and employee roles.
Best Practices for Cloud Security
5. Employee Training and Awareness
Employees play a significant role in maintaining cloud security. It is
important to provide comprehensive training and awareness programs to
educate employees about security best practices, the importance of data
protection, and how to recognize and report potential security threats.

6. Incident Response and

Recovery
Having a well-defined incident response plan is essential for minimizing the
impact of security incidents. This plan should include clear procedures for
reporting, containment, and recovery. Regularly testing the incident
response plan through simulations and tabletop exercises ensures its
effectiveness during real incidents.
Cloud Security Challenges

Authentication
Authentication refers to digitally confirming the identity of the entity requesting access to some
protected information.
In a traditional in-house IT environment authentication polices are under the control of the
organization. However, in cloud computing environments, where applications and data are accessed
over the internet, the complexity of digital authentication mechanisms increases rapidly.
Authorization
Authorization refers to digitally specifying the access rights to the protected resources using access
policies.
In a traditional in-house IT environment, the access policies are controlled by the organization and
can be altered at their convenience.
Authorization in a cloud computing environment requires the use of the cloud service providers
services for specifying the access policies.
Security of data at rest
Due to the multi-tenant environments used in the cloud, the application and database servers of
different applications belonging to different organizations can be provisioned side-by-side increasing
the complexity of securing the data.
Appropriate separation mechanisms are required to ensure the isolation between applications and
data from different organizations.
Cloud Security Challenges

Security of data in motion

In traditional in-house IT environments all the data exchanged between the applications and users
remains within the organization’s control and geographical boundaries.
With the adoption of the cloud model, the applications and the data are moved out of the in-house
IT infrastructure to the cloud provider.
Therefore, appropriate security mechanisms are required to ensure the security of data in, and
while in, motion.
Data Integrity
Data integrity ensures that the data is not altered in an unauthorized manner after it is created,
transmitted or stored. Due to the outsourcing of data storage in cloud computing environments,
ensuring integrity of data is important.
Auditing
Auditing is very important for applications deployed in cloud computing environments.
In traditional in-house IT environments, organizations have complete visibility of their applications
and accesses to the protected information.
For cloud applications appropriate auditing mechanisms are required to get visibility into the
application, data accesses and actions performed by the application users, including mobile users
and devices such as wireless laptops and smartphones.
 Authentication
Authentication refers to confirming the digital identity of the entity requesting
access to some protected information.
The process of authentication involves, but is not limited to, validating the at
least one factor of identification of the entity to be authenticated.

A factor can be something the entity or the user knows (password or pin),
something the user has (such as a smart card), or something that can uniquely
identify the user (such as fingerprints).
In multifactor authentication more than one of these factors are used for
authentication.

There are various mechanisms for authentication including:

•SSO
•SAML-Token
•OTP
 Single Sign-on (SSO)
Single Sign-on (SSO) enables users to access multiple systems or applications
after signing in only once, for the first time.

When a user signs in, the user identity is recognized and there is no need to sign
in again and again to access related systems or applications.

Since different systems or applications may be internally using different

authentication mechanisms, SSO upon receiving initial credential translates to
different credentials for different systems or applications.

The benefit of using SSO is that it reduces human error and saves time spent in
authenticating with different systems or applications for the same identity.

There are different implementation mechanisms:

•SAML-Token
•Kerberos
 SAML-Token
Security Assertion Markup Language (SAML) is an XML-
based open standard data format for exchanging security
information (authentication and authorization data)
between an identity provider and a service provider.

SAML-token based SSO authentication

When a user tries to access the cloud application, a SAML
request is generated and the user is redirected to the
identity provider.
The identity provider parses the SAML request and
authenticates the user. A SAML token is returned to the
user, who then accesses the cloud application with the
token.
SAML prevents man-in-the-middle and replay attacks by
requiring the use of SSL encryption when transmitting
assertions and messages.
SAML also provides a digital signature mechanism that
enables the assertion to have a validity time range to
prevent replay attacks.
 Kerberos

Kerberos is an open authentication

protocol that was developed At
MIT.
Kerberos uses tickets for
authenticating client to a service
that communicate over an un-
secure network.
Kerberos provides mutual
authentication, i.e. both the client
and the server authenticate with
each other.
 One Time Password (OTP)
One time password is another authentication mechanism that uses
passwords which are valid for single use only for a single transaction
or session.

Authentication mechanism based on OTP tokens are more secure

because they are not vulnerable to replay attacks.

Text messaging (SMS) is the most common delivery mode for OTP
tokens.

The most common approach for generating OTP tokens is time

synchronization.

Time-based OTP algorithm (TOTP) is a popular time synchronization

based algorithm for generating OTPs.
 Authorization
Authorization refers to specifying the access rights
to the protected resources using access policies.

OAuth
OAuth is an open standard for authorization that
allows resource owners to share their private
resources stored on one site with another site
without handing out the credentials.
In the OAuth model, an application (which is not the
resource owner) requests access to resources
controlled by the resource owner (but hosted by the
server).
The resource owner grants permission to access the
resources in the form of a token and matching
shared-secret.
Tokens make it unnecessary for the resource owner
to share its credentials with the application.
Tokens can be issued with a restricted scope and
limited lifetime, and revoked independently.
 Technologies for Cloud Security
Cloud Access Security Broker (CASB): A cloud access security
broker sits between cloud service providers and cloud users to monitor
activity and enforce security policies. A CASB combines multiple types
of security policy enforcement, such as authentication, authorization,
single sign-on, credential mapping, device profiling, encryption
tokenization, and logging.

Cloud Encryption: Cloud encryption involves using algorithms to

change data and information stored in the cloud to make it
indecipherable to anyone not possessing access to the encryption
keys. Encryption protects information from being accessed and read,
even if it is intercepted during a transfer from a device to the cloud or
between different cloud systems. Cloud Service Providers and cloud
vendors offer unique ways to provide encryption into an environment
with Key Management tools.
 Technologies for Cloud Security
Cloud Firewalls: A firewall is a type of security solution that blocks or
filters out malicious traffic. Cloud firewalls form virtual barriers
between corporate assets that exist in the cloud and untrusted,
external, internet-connected networks and traffic.
Cloud firewalls are also sometimes called a firewall-as-a-service
(FWaaS).

Cloud Security Posture Management: CSPM security solutions

continuously monitor the dynamic and ever-changing cloud
environments and identify gaps between security policy and security
posture. CSPM solutions comply with specific frameworks (e.g. SOC2,
CIS v1.1, HIPAA) and can be used to consolidate misconfigurations,
safeguard the flow of data between internal IT architecture and the
cloud, and broaden security policies to extend beyond in-house
infrastructure.