Chapter 5: Security in the Cloud
Risks of Virtualization: Attacks on the Hypervisor
Attempts to compromise the service hosting the virtualization (know as a hypervisor) could lead to massive data loss as each instance is now readily accessible
Risks of Public Cloud Operation: Escalation of Privilege
Authorized users may try to acquire unauthorized permissions
Risks of Private Cloud Operation: Regulatory Noncompliance
Breaking of national or industrial standards/litigation
Cloud-Specific Business Impact Analysis Concerns: New Dependencies
Customers have to depend on the cloud provider to meet their organization's needs, but all the downstream and upstream dependencies associated with the provider as well, including the provider's vendors, suppliers, utilities, personnel, and so on
Risks of Public Cloud Operation: Legal Activity
Data and devices within a datacenter may be subpoenaed or seized as evidence in a criminal investigation or as part of discovery for litigation purposes
Risks of Public Cloud Operation: Information Bleed
Data belonging to one customer will be read or received by another
Risks of Virtualization: Information Bleed
Data belonging to one customer will be read or received by another
Risks of Public Cloud Operation: Avoid Proprietary Formats
Data should be usuable in other environments, not just that of the original cloud provider
PAAS Hybrid Cloud Risks: Persistent Backdoors
Development tools functioning as attack vectors if discovered and exploited by malicious parties
Loss of Physical Control
Distributed ownership means not only a decrease in expenses, but a decreased amount of control as well
Risks of Public Cloud Operation: Multi-tenant Environments
Environments in which multiple customers are storing data with the same provider
Risks of Public Cloud Operation: Ensure Favorable Contract Terms for Portability
Have an exit strategy outlined and ready to execute
Risks of Private Cloud Operation:
Malware Infection internally or externally by a virus
Risks of Public Cloud Operation: Check for Regulatory Constraints
Not all cloud providers adhere or are compliant with all legal guidelines
Risks of Community Cloud Operations: Shared Costs
Overhead and cost of the infrastructure is shared among the members of the community, but so is access and control
Loss of Policy Control
Ownership is distributed in a community cloud, centralized policy promulgation and enforcement is not usually an option
SAAS Hybrid Cloud Risks: Web Application Security
Potential weaknesses within web apps used for access pose a wide variety of risks and threats
Cloud-Specific Business Impact Analysis Concerns: Data Breach/Inadvertent Disclosure
Public disclosure of deleterious internal communication and reporting; loss of competitive advantage; negative effect on customer, supplier, and vendor goodwill; and contractual violations
Customer/Provider Shared BC/DR Responsibilities: Cloud Operations, Third-Party Cloud Backup Provider
Regular operations are hosted by the cloud provider, but contingency operations require failover to another cloud provider
Community Cloud
Resources are shared and dispersed among a group, with joint ownership
Cloud Customer Key Concern
Security of their data
Cloud Provider Key Concern
Security of their datacenter
Risks of Public Cloud Operation: Core Competency
The ability of a provider to meet the needs of the customer
Risks of Virtualization: Guest Escape
The ability of a user to leave the confines of their own virtualized instance
Risks of Public Cloud Operation: Vendor Lock-Out
The cloud provider goes out of business, is acquired by another interest, or ceases operation for any reason, making it impossible to recover stored data
PAAS Hybrid Cloud Risks: Interoperability Issues
The customer's software may or may not function properly with each new adjustment to the environment
Risks of Public Cloud Operation: Legislative Environment
The effect of upcoming legal and regulatory guidelines on the customer and provider
Risks of Community Cloud Operations: Resiliency Through Shared Ownership
The environment is more likely to survive the loss of a significant number of nodes without affecting the others because the network ownership and operation is scattered among users
PAAS Hybrid Cloud Risks: Virtualization
The generic threats and risks associated with virtualization
SAAS Hybrid Cloud Risks: Virtualization
The generic threats and risks associated with virtualization
Risks of Public Cloud Operation: Physical Limitations to Moving Data
The inability to move data based on lack of ability by the provider
Risks of Public Cloud Operation: Jurisdictional Suitability
The location of the datacenter and its ability to comply with regional standards and regulations
Social Engineering
The manipulation of human resources to gain access to a system
Private Cloud
The organization controls the entire environment/infrastructure
PAAS Hybrid Cloud Risks: Resource Sharing
The possibility of information bleed and side-channel attacks
SAAS Hybrid Cloud Risks: Proprietary Formats
The provider may be collecting, storing, and displaying data in a format owned by and unique to that provider
Cloud-Specific Business Impact Analysis Concerns: Regulatory Failure
The provider might be unable or unwilling to adhere to the policies of a customer's organization
Risks of Public Cloud Operation: Supply Chain Dependencies
The provider's ability to function independently without excessive reliance on other entities
Risks of Public Cloud Operation: Conflict of Interest
The provider's employees should not be assigned to manage the data or two organizations that are in competition
Cloud-Specific Business Impact Analysis Concerns: Vendor Lock-In/Out
The reliability of the provider to store customer data in an easily accessable fashion, as well as continuing to exist as an entity
IAAS Hybrid Cloud Risks: Lack of Specific Skillsets
The significant burden on the customer's administrators and staff to provide both operational and security functions
Customer/Provider Shared BC/DR Responsibilities: Private Architecture, Cloud Service as Backup
The use of a cloud provider as the backup
IAAS Hybrid Cloud Risks: External Attacks
Unauthorized access, eavesdropping, DOS/DDoS, and so on
Risks of Private Cloud Operation: External Attacks
Unauthorized access, eavesdropping, DOS/DDoS, and so on
Brewer-Nash Model
Users are instead given permission to access datasets based on which datasets the user had previously seen, but it also takes into consideration the user's free will and ability to choose the initial sets to access
Customer/Provider Shared BC/DR Responsibilities: Cloud Operations, Cloud Provider as Backup
A backup located at another datacenter owned by the provider in case of disaster-level events
Public Cloud
A company offers cloud services to any entity that wants to become a cloud customer, be it an individual, company, government agency, or other organization
Customer/Provider Shared BC/DR Responsibilities: Declaration
A formal notice of emergency, usually initiated by one trusted member of the customer organization that results in unique business constraints or requirements being put into place
Risks of Public Cloud Operation: Provider Longevity
A history of successful operations reduces the likelihood of breaches/shutdowns
Risks of Private Cloud Operation: Natural Diasters
Acts of nature, such as fires, tornadoes, or floods
Customer/Provider Shared BC/DR Responsibilities: Testing
An interruption in normal service to practice failover or emergency procedures
Man-In-The-Middle Attack
Any attack where the attacker inserts themselves between the sender and receiver
IAAS Hybrid Cloud Risks: Personnel Threats
Inadvertent and malicious threats by employees
Risks of Private Cloud Operation: Personnel Threats
Inadvertent and malicious threats by employees
Loss of Audit Access
It may be impractical or impossible to conduct audits in a distributed environment
Risks of Virtualization: Data Seizure
Legal activity might result in a host machine being confiscated or inspected by law enforcement or plaintiffs' attorneys, and the host machine might include virtualized instances belonging to another organization
Risks of Community Cloud Operations: No Need for Centralized Administration for Performance and Monitoring
Loss of the reliability of centralized and homogenized standards for performance and security monitoring