Cloud computing environment and it's security issues

Posted Date: 09-Jun-2012	Category: Computer & Technology
Author: Geetha	Member Level: Bronze	Points: 35

There are several benefits in shifting to the cloud computing environment. But these benefits are drowned by the security related issues in the cloud computing environment. In this article, I will give a brief introduction to cloud computing environment and the security issues.

What is cloud computing?

Cloud computing is a model that enables access to several computing resources such as networks, servers, storage, applications, services etc via the network. Organizations and individuals requiring these resources can easily deploy and release the provided services with little interaction with the service provider. Based on the type of resources provided by the cloud , there are three services. They are Infrastructure-as-a-Service (IaaS),platform as a service(PaaS) and Software as a service (SaaS). There are several benefits in shifting to the cloud. Some of the benefits include: reductions in cost, advanced and highly reliable services, flexibility in adding infrastructure and services.

Security is of great concern in a cloud computing environment

The data stored in the cloud has to be protected from malicious users and programs. The system must be protected from its users as they cannot be trusted. The organizations must supervise its employees. Appropriate authentication and authorization mechanisms are necessary to control the data available to each employee. Data encryption can be done for protecting data. Data has to be stored in more than one location for protection from disasters. Although the cloud provider claims to provide secure systems, the security can be compromised. examples include SQL injection at cloud platform level, phishing of the cloud provider.

Attacks in cloud computing environment

Attack may be carried out in protocols using XML signature

XML signature is used for authentication or integrity protection. The attacker eavesdropping for messages move the body to a newly inserted wrapping element to create a new body. The malicious code is inserted to the body. Since the user's signature is present, the service executes the modied request. Amazon EC2 had been attacked by this method in 2008.

Utilizing the browser redirects for attacking

The services of the cloud are accessed using browsers. But the browser does not directly support XML signatures. Therefore users must be redirected to another page for secure authentication. Attacks such as phishing can be easily carried out.

Cloud Integrity and Binding Issues

Attackers may create their own malicious implementation module (SaaS or PaaS) or virtual machine instance (IaaS), and add it to the cloud system. It then tricks the cloud system into believing its a valid instance of some service provided through cloud. Then the cloud system would automatically redirect user request to the malicious service implementation. Thus running the malicious code in the user's system. This attack is called cloud malware injection attack. The attacker also can re-engineer the metadata description. For example, the malicious user could change the metadata of the setAdminRights operation to describe it as a deleteUser operation. Thus, the administrator is fooled into believing that he is deleting a user while he is giving them super user privileges. This attack is called Metadata spoofing attack.

Flooding attacks

In a cloud system, the high computation power is provided by allotting multople instances of virtual servers. Attackers misuse this system by sending bulk requests to a certain service. This causes workload to the server and thus cause denial of service. This attack becomes more severe as the level of sophistication increases.

Post Comment:

Notify me by email when others post comments to this article.

Do not include your name, "with regards" etc in the comment. Write detailed comment, relevant to the topic.

No HTML formatting and links to other web sites are allowed.

This is a strictly moderated site. Absolutely no spam allowed.

Name:	Sign In to fill automatically.
Email:	(Will not be published, but required to validate comment)
	Type the numbers and letters shown on the left.