Cloud Computing and Cybersecurity, (Ahmed, A., Latif, R., Latif, S.,…
Cloud Computing and Cybersecurity
public cloud is a higher risk
than private cloud because infrastructure
owned by cloud provider. Private cloud is
behind a firewall.
(Fernandes et al 2013)
Employees inside a data centre can be disgruntled and be an internal threat. Hackers on the internet can scan for vulnerabilities. Employees who are customers can give away their security details by accident.
Failover means that if a server
fails on one site the clients data is
accessible on another data centre
server on another site.
proposed security solution is a snapshot of VM sent regularly to a trusted center server
Some people from the USA will store their data in Europe
to avoid being caught for crimes they committed in the USA.
So much for the idea of data being in the cloud as if its real
location from a marketing point of view is immaterial.
YOU CAN HIRE EXPERTISE OF
EXTERNAL COMPANIES IN THE
CLOUD TECHNOLOGIES YOU
NEED BUT YOUR DATA IS OFF
SITE AND YOU HAVE TO TRUST
YOUR VALUABLE DATA TO OTHERS
Hackers can use virtualised infrastructure as launching pad for new attacks.
(Jan Čapek 2012 )
Flaws in cryptographic coding
and brute force attacks can compromise
large server centres have to have good physical security. meaning access control, cameras, higher security areas, cages on servers with padlocks.
ISO27000 security may require hashing entire data sets . This may not be possible because it requires large amounts of processing power.
Vulnerability gap in coding or infrastructure. Combined with individual who will take advantage of the gap.
Important to have trustworthy people
and a trustworthy company.
The bigger the cloud center the more resources they have for security and hacker detection but the more interdependencies they have and the more points of failure there are with more people who could go rogue .
Co location, co residency , co residence
Security information and event management
solutions are mandatory (SIEM) to have a
high level view of security situation.
Cloud computing centres have ISEs and IPSes to
catch malicious attackers as well as Honeypots
to distract them and learn their movements.
cloud deployments need 6 security requirements; authentication, authorisation, confidentiality, integrity, non repudiation and availability.
Cloud computing frees up space and provides greater computer power for hospitals and Internet of things. (Ahmed 2017)
malicious insider threat is
possible inside hospital or
in the data centre. Can lead
to patient data compromised.
Virtual machine can be placed
next to another VM for a side
Channel attack.( Ahmed 2017)
man in the middle attack when the
hacker places himself in a communication
track between a patient and the server.
session hijacking attack by
obtaining the key to a valid
session and accessing patient
2016 cyber insurance intelligence
index says 60 % of all attacks are
malicious insider attacks.
watermarking and auditing technique allows doctors to see alterations in documents but it is vulnerable to being altered by noise , compression and interpolation and only works in the hospital and not in the cloud.
the point of the cloud is to make data available fast for hospital patients for their own safety. However that makes it more accessible to attacks. Cryptography would make it harder to access data quickly.
Data could be stored on one data center server and the encrypted key
on another but managing the key is
difficult and could compromise patient care.
The cloud gives an opportunity for malicious users to imitate honest clients to get access to their data.
Defence industry standards say
public cloud security is not good enough.
Clients wonder if computer center
employees look at their data and
request an access log record .
Clients need to be aware if data is
migrated to another location for any
reason. Clients want to do data checks
for data integrity.
Cloud computing provides
massive computing power and
services that are scalable and˚
elastic for convenience .
malicious client can set up a virtual machine in the cloud next to honest client. He can hack honest client machine and if in collusion with a cloud service provider can leave not trace to the attack.
security experts can study user behaviour in cloud environments to identify attackers.
Given the value of what
is stored in the cloud it is
hardly surprising if cloud centre
employees are the target of
criminal gangs or turn rogue
COMPANIES WHO WANT TO COMPLY WITH GDPR DON'T WANT THEIR DATA STORED OUTSIDE OF EUROPE.
CLOUD COMPUTING GIVES
COMPANIES THE OPTION TO
PAY FOR COMPUTING POWER
WHEN THEY USE IT.
some VM ware is designed for security measures but its scanning capabilities could be used for hacking .
It is all very well having good technology for cybersecurity provided the company has the diligence to use it properly .
Ahmed, A., Latif, R., Latif, S., Haider Abbas & Farrukh Aslam Khan (2018) Malicious insiders attack in IoT based multi-cloud e-healthcare environment: A systematic literature review. Multimedia Tools and Applications, 77 (17), 21947-219
Blumenthal, M. S. (2011) Is security lost in the clouds? (*). Communications & Strategies, (81), 69-86.
Chakraborty, R., Ramireddy, S., Raghu, T. S. & Rao, H. R. (2010) The information assurance practices of cloud computing vendors. IT Professional Magazine, 12 (4), 29-37.
Fernandes, D. A., B., Soares, L. F., B., Gomes, J. V., Freire, M. M., Inácio, P. R. & M. (2014) Security issues in cloud environments: A survey. International Journal of Information Security, 13 (2), 113-170.
Hemdan Ezz El-Din & Manjaiah, D. H. (2021) An efficient digital forensic model for cybercrimes investigation in cloud computing. Multimedia Tools and Applications, 80 (9), 14255-14282.
Vieira, K., Schulter, A., Westphall, C. & Westphall, C. (2010) Intrusion detection for grid and cloud computing. IT Professional Magazine, 12 (4), 38-43.
Čapek, J. (2012) Cloud computing and information security. Scientific Papers of the University of Pardubice.Series D.Faculty of Economics and Administration, (24), 23-30.