Mitigating the Cloud Computing Security Threats - Report Example

? Cloud Computing Insert Insert Grade Insert Insert Table of Contents Table of Contents 2 Cloud Computing 3 0 Introduction 3 1.1 Opportunities 3 1.1.1 Time to market products and services can be reduced 3 1.1.2 Reduction in cost of IT investment 3 1.1.3 Reduction of barrier of entrance 4 1.1.4 Pay as you go 4 1.1.5 Business opportunity 4 1.1.6 New Markets 5 1.1.7 On Demand Self Service 5 1.1.8 Opportunity to enhance IT systems 5 1.1.9 Rapid elasticity 5 1.1.10 Availability 5 1.2 Security Concerns 6 1.2.1 Privileged User Access 6 1.2.2 Regulatory compliance 6 1.2.3 Data location 7 1.2.4 Data segregation 7 1.2.5 Data Recovery 7 1.2.6 Investigative support 7 1.2.7 Long term viability 7 1.3 Mitigating the cloud computing security threats 8 1.3.1 Data encryption 8 1.3.2 Preventing Network Intrusion 8 1.3.3 Spam filtering, phishing detection and black lists 8 1.4 Conclusion 9 Cloud Computing 1.0 Introduction Cloud computing is a new information technology system where the business IT technology services are hosted by an external virtual server. Cloud computing greatly scales down the business resources, this is because you do not have to own these resources but you can get them through the web. These resources include software and business applications, development and runtime platforms and infrastructure (Hauck et al 2010). Hayes (2010) describes this phenomenon as programs and data being transferred from personal computers and corporate server rooms and being installed in constellations or clouds. He cites an example of making an excel spreadsheet using Google docs. In this case you may not have the software installed in your computer but you can access it over the web services and web APIs. Cloud computing has come with several opportunities especially for the business people but there has also been several security concerns over this innovation. This paper discusses the opportunities availed by cloud computing and also the security concerns. 1.1 Opportunities 1.1.1 Time to market products and services can be reduced Cloud computing provides businesses with an opportunity to market their products via the services available on the internet. The old method was that one had to use the computer software to publish posters to advertise their products and services. These posters had then to be distributed to the potential consumers. However, businesses can now use cloud based systems such as emails, Facebook and Twitter to market their products and services. I think this is a good opportunity for businesses that have embraced technology. 1.1.2 Reduction in cost of IT investment Cloud computing offer businesses and organizations an opportunity to reduce on their cost of investing in information and technology. Traditionally, businesses, individuals or organizations had to install the software they required and maintain them. This software comes with a price and they may need regular updates. The software may also crash and lead to lose of all your data. The introduction of cloud marketing has reduced the risks and costs in information technology. The software or programs are available over the internet and you only pay on demand. You do not need to pay for the maintenance cost and the risk of data loss is greatly reduced. However, I think cloud computing also needs some investment in IT. 1.1.3 Reduction of barrier of entrance The introduction of cloud computing is a game changer for rules of competition in the business sector. Traditionally, only large business could manage to own and use computer services and programs in their business activities because of the cost of installation and maintenance. Cloud avails the infrastructure to all business on rent. This offers small and medium enterprises an opportunity to efficiently use the infrastructure and enjoy the benefits as large firms. With that, the platform of competition will be levelled. This might be true, but it is my view that it is the already established companies that can better utilize the opportunity of cloud computing, SME’s may not have the necessary infrastructure to invest in cloud computing. 1.1.4 Pay as you go A business or an organization may require a program or software once in several months. Initially, in such a circumstance, you had to install the program and keep on maintaining the infrastructure. Everybody longed for the opportunity to pay for only what is actually used, this was brought by cloud computing. The businesses can now only pay for what is actually used. You can access the web based programs use them and then only pay for that particular usage time (Bakhai 2011). However, I think it is more convenient to have your own software installed in your organization to carry out your activities. This encourages capacity building among workers. 1.1.5 Business opportunity Cloud computing has offered a business opportunity to companies that sell software and IT services. Businesses would like to continue to innovate in their business services without increasing their budgets. Companies would not prefer to install the computer infrastructure and maintain it because this will be an additional cost hence they have resorted to companies that offer IT services. One such example is Nissan, which has an intention of collaborating with Microsoft to develop a cloud based dealer management system that will assist Nissan to connect to its customers better (Dasgupta and Kejriwal 2012). In so doing the business organization can have an opportunity to concentrate on other issues. 1.1.6 New Markets Cloud computing enables business to reach customers in new markets, companies can now use programs or software available on the internet to reach more customers around the world. This opportunity will be enhanced as more people acquire tablets, smart phones and the improvement of internet speed. It would have been quite expense for a business to own a program that is used for advertising but cloud computing do offer such services on rent. 1.1.7 On Demand Self Service With cloud computing, one do not need to interact with individual service providers, you only need to choose the service you require, use it, and pay for the costs (Piers 2011). This also enables one to use as many services as possible. This I think might also be a disadvantage, especially when the providers violate the rules of engagement, it will be very hard to sue them. 1.1.8 Opportunity to enhance IT systems Cloud computing offers an opportunity to enhance the IT systems without waiting for the organization to allocate funds for such infrastructure. Business can move their operations to the next level of information technology without allocating funds for IT. This is achieved by using programs or software that is available on the web (IT industry Innovation Council 2011). 1.1.9 Rapid elasticity Cloud computing enables organizations to rapidly shift their computing and storage power as need arises. There are times when an organization may require much computing and data storage and there comes times when this need may greatly reduce. This flexibility is achieved through cloud computing. 1.1.10 Availability Cloud computing has availed computer services and programs to organization. Availability in this case means that they can be accessed when need arises. This has been enabled though replication of servers and storage. Cloud computing services are rarely unavailable and if it happens it is for a short period of time. Let us take for example you have stored your data in your desktop and there is a technical problem, you will not be able to easily access the data. On the other hand, if you have stored your data on a cloud based system you can easily access it at any time anywhere (Abbadi and Martin 2011). Cloud computing from the above may seem very beneficial, but before any company makes a decision to invest in cloud computing they must also look at the security concerns. 1.2 Security Concerns 1.2.1 Privileged User Access The cloud computing platform faces a challenge of privileged user access. Your data is subjected to unknown personnel at unknown sites. The data that is stored in the cloud system faces the risk of unauthorized access by other users (Leite and Dorey 2011). Many companies fear to store their sensitive information in the cloud computing system. This is because this information is handled by administrators who can leak the information to competitors. Cloud computing companies should vet administrators who handle sensitive data to ensure that they are trustworthy. The cloud computing companies have also tried to defeat this security concerns by ensuring that the activities of the privileged data administrators is monitored by the concerned companies. 1.2.2 Regulatory compliance There are laws and regulations that govern the cyberspace. Cloud computing companies need to abide by the laid down certifications and audits (Chandrashekar, Morrell and Hat 2011). Failure of the company to meet the laid rules and regulations amounts to a security threat. Compliance with regulations enhances the data security. It promotes certification of the framework under which the companies operate. There are also other laws and regulations that rest the responsibility with the users. For example, when transmitting sensitive data the regulation requires that this information is encrypted because it is disseminated over the internet. Regulations also require background screening and non-disclosure agreements for employees that access sensitive information. Ignorance about this rules and regulations may subject the company to a security threat. The company’s data may be lost or accessed by unauthorized persons or competitors. Google in a report could not precisely state where one’s data was stored or if that particular information is restricted to certain regions. The cloud computing companies are not even aware of the data stored in their infrastructure and therefore may not be able to know the legal requirements pertaining to the data. 1.2.3 Data location The location of corporate and sensitive data is a concern in public clouds. This data should be done on contractual understanding. The location should be such that it cannot be accessed easily by other users. 1.2.4 Data segregation Since cloud computing is a shared technology, it should be set such that the data is separated in such a way that that the customer accesses only the information that affect him without affecting other clients’ data. This concern can be solved by using data segregation methods such as digital data signatures and encryption. Cloud companies must also reassure their clients that their encryption process was executed and verified by certified security analysts (Teneyuca 2011). 1.2.5 Data Recovery Loss of data is a major concern in cloud computing. Cloud computing companies must ensure that data recovery strategies are put in place. The clients must be made aware of the fate of their data incase a disaster occurs. Reliability of storage media and data replication are some of the measures put in place to avoid data loss. Forensic techniques and data restoration technology must be employed to ensure that the clients’ data is recovered (Graham 2008). 1.2.6 Investigative support Cloud computing is a very complex platform for enforcement of compliance aspects and legal investigations. This is because data logging is done by several servers in different locations. The putting of blame on a single cloud company may not be possible since this data is co-hosted. However, utilizing the e-discovery applications can aid address investigative support problem. Customers should request investigation in case they feel there have been computing violations by cloud companies. 1.2.7 Long term viability This security concern comes about incase of collapse of the cloud computing company. Customers who store their data on public or private clouds should be convinced that the collapse of the concerned company will not affect their data (Coles-Kemp, Reddington and Williams 2011). Data transfer should be possible in case of collapse. Efforts should be made to store data in importable formats. The service providers must also be vetted to ascertain their viability. 1.3 Mitigating the cloud computing security threats 1.3.1 Data encryption This ensures privacy and confidentiality of data is enhanced. This process can be backed up by additional data signatures that allow consensual handing of data that is being transmitted. Encryption involves providing an access key to specific data. The use of advanced encryption standards has aided in ensuring the security of data in transit. In this method, two access keys are provided; one for the sender and the other for the recipient. RSA is popularly used in digital signature generation. This process involves appropriate decryption of data from cipher text by use of signature verification. RSA encryption is majorly used by Apple and Microsoft Azure and it is reported to have enhanced the security of data transmission in electronic payment cards (Jordan and Bruno 2011). 1.3.2 Preventing Network Intrusion Network intrusion or hacking is one of the greatest security concerns in cloud computing. This leads to malicious activities being carried out on the clients’ data. This can range from alteration of customers data to leakage. Virtual local area networks, multiprotocol label switching and virtual private networks are some of the mechanisms of preventing network intrusion. These technologies ensure that devices can only access virtually secure networks that cannot be intruded into. 1.3.3 Spam filtering, phishing detection and black lists There has been an increase of security threat to mobile e-commerce. This has compelled companies in this sector to employ additional security measures such as blacklisting and filtering of suspicious data. Spam filtering is used to make sms and emails more secure. In China, web contents have been made more secure by content filtering and blocking. Phishing detection is employed by Google, aids in preventing phishing attacks that are aimed at hacking the accounts of users. Through the use anti-phishing tools, Google can detect counterfeit websites. Fraudulent activities that were normally carried out on the accounts of Google users have greatly reduced since the inception of anti-phishing detection process. Creation of a central blacklist can help blocking or grounding of websites that are intended at extortion of online shoppers. This can greatly help cloud computing because the customers are assured of the security of their transactions with sellers. Security concerns of cloud computing to me are very real, take for instance hacking; despite efforts to end this vice, there have been several reported cases of hacking even of famous cloud vending companies like Google. I cloud advice companies who would want to try their hand in cloud computing not to provide sensitive data to the public cloud. 1.4 Conclusion Cloud computing is a very cost effective phenomenon especially in the business world. Businesses can save a lot of cost on infrastructure and software or IT programs. However, before an organization chooses this option it must also look at the security concerns involved and only engage with reliable and secure vendors. This will ensure the organization’s data security. Bibliography Abbadi, IM and Martin, A 2011, Trust in the Cloud, Department of Computer Science, University of Oxford, United Kingdom Bakhai, H 2011, Cloud Computing- Opportunities and Challenges, Symbiosis Institute of Operations Management, Nashik Chandrashekar, A Morrell, R and Hat, R 2011, Cloud computing: new challenges and opportunities, Network Security Feature Coles-Kemp, L, Reddington J, and Williams, PA 2011, Looking at clouds from both sides: The advantages and disadvantages of placing personal narratives in the cloud, Information Security Technical Report 1 6 (2011) 115-1 22 Graham D T 2008, Negotiating contracts that will keep our cloud afloat, you’re going to put that in a cloud? Retrieved April 19, 2013 from: http://itm.iit.edu/netsecure11/DanielGraham_ CloudPresentation.pdf; Hauck, M et al 2010, Challenges and Opportunities of Cloud Computing, Karlsruhe Institute of Technology Hayes, B 2008, Cloud Computing, Communications of the ACM; Jul2008, Vol. 51 Issue 7, p9-11 IT Industry Innovation Council 2011, Cloud Computing-Opportunities and Challenges Jordan S, Bruno A 2011, CCDA 640-864 official cert guide. Indianapolis: Cisco Press. Kejriwal, S and I Dasgupta, M 2012, Opportunities from Cloud Computing, Citigroup Leite, A and Dorey, PG 2011, Commentary: Cloud computing -A security problem or solution? Information Security Technical Report 1 6 (2011) 89-96 Piers, W 2011, Positive perspectives on cloud security, United Kingdom: PricewaterhouseCoopers LLP Teneyuca, D 2011, Internet cloud security: The illusion of inclusion, University of Texas at San Antonio, USA. Read More