8.b) Explain the following associated with cloud computing:

Answer:

The Abusive Use of the Cloud: Cloud computing platforms can be abused to conduct nefarious activities. This involves using cloud resources, such as multiple instances or applications, to launch attacks like Distributed Denial-of-Service (DDoS) attacks, distribute malware, or send spam. The ability to scale resources quickly and efficiently in the cloud can be exploited for malicious purposes.
APIs that are not Fully Secure: Many cloud services rely on APIs (Application Programming Interfaces) to facilitate communication between users and cloud applications. However, if these APIs are insecure, they can expose vulnerabilities. Weak or improperly configured APIs can fail to properly authenticate users, control access, or monitor activities during runtime. This makes them an entry point for attackers looking to gain unauthorized access to cloud resources.

Malicious Insiders: Cloud service providers generally do not disclose the background checks or hiring policies they implement for their employees. This lack of transparency creates a risk of malicious insiders—individuals who have privileged access to cloud infrastructure and data. These insiders could intentionally misuse their access to compromise security, steal data, or sabotage services. As they have authorized access, detecting their activities is often more difficult.
Shared Technology: Cloud environments often involve shared technology, especially in Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) models. Multiple users and organizations share the same underlying infrastructure, such as virtual machines (VMs) or storage devices. A vulnerability in the shared technology, such as a flaw in the Virtual Machine Monitor (VMM), could allow attackers to access data or interfere with other users’ applications.
Account Hijacking: Account hijacking occurs when malicious actors steal a user’s login credentials, allowing them to take over their account. This threat can compromise not only the user’s data but also the security of the applications and services they use on the cloud. Once an attacker gains control, they could manipulate or misuse the account in harmful ways.

Data Loss or Leakage: Data loss is a critical risk in cloud environments. If an organization only stores its data in the cloud and experiences a failure in data replication (such as when a storage media failure occurs), the sensitive data could be permanently lost. Cloud providers often implement replication to prevent data loss, but if the replication fails and the data is stored in a single location, there’s no backup, which could lead to irrecoverable data loss.
Unknown Risk Profile: Many users and organizations underestimate the full range of risks involved in adopting cloud services. They may not be fully aware of the security threats or the potential consequences of those risks. This ignorance leads to poor risk assessment, inadequate security measures, and reliance on cloud providers without understanding their limitations and potential vulnerabilities.

The unauthorized access to confidential information and the data theft top the list of user concerns.

Data is more vulnerable in storage, as it is kept in storage for extended periods of time.
Threats during processing cannot be ignored; such threats can originate from flaws in the VMM, rogue VMs (unmanaged VM that’s connected to organizations network and can pose a threat).
There is the risk of unauthorized access and data theft posed by rogue employees of a Cloud Service Provider (CSP).

Lack of standardization is also a major concern.
Users are concerned about the legal framework for enforcing cloud computing security.
Multi-tenancy is the root cause of many user concerns. Nevertheless, multi-tenancy enables higher server utilization, thus lower costs.

The threats caused by multi-tenancy differ from one cloud delivery model to another.

Cloud security risks and Security: the top concern for cloud users.

Leave a ReplyCancel Reply