Scribd Logo
Upload

Welcome to Scribd!

  • 9 views

    Lecture 3 Spring 2024

    Uploaded by

    LAEVO Life
    Cloud computing introduces new security challenges. The document discusses key security terms like confidentiality, integrity, and availability. It describes common threat agents like anonymous attackers and malicious insiders. Specific cloud security threats are examined, such as traffic eavesdropping, denial of service attacks, and virtualization attacks. The document emphasizes the importance of security controls, policies, risk assessment, and collaboration between cloud providers and consumers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Lecture 3 Spring 2024

    Uploaded by

    LAEVO Life
    9 views19 pages
    Cloud computing introduces new security challenges. The document discusses key security terms like confidentiality, integrity, and availability. It describes common threat agents like anonymous attackers and malicious insiders. Specific cloud security threats are examined, such as traffic eavesdropping, denial of service attacks, and virtualization attacks. The document emphasizes the importance of security controls, policies, risk assessment, and collaboration between cloud providers and consumers.

    Original Title

    Lecture_3_spring_2024

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Cloud computing introduces new security challenges. The document discusses key security terms like confidentiality, integrity, and availability. It describes common threat agents like anonymous attackers and malicious insiders. Specific cloud security threats are examined, such as traffic eavesdropping, denial of service attacks, and virtualization attacks. The document emphasizes the importance of security controls, policies, risk assessment, and collaboration between cloud providers and consumers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    9 views19 pages

    Lecture 3 Spring 2024

    Uploaded by

    LAEVO Life
    Cloud computing introduces new security challenges. The document discusses key security terms like confidentiality, integrity, and availability. It describes common threat agents like anonymous attackers and malicious insiders. Specific cloud security threats are examined, such as traffic eavesdropping, denial of service attacks, and virtualization attacks. The document emphasizes the importance of security controls, policies, risk assessment, and collaboration between cloud providers and consumers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 19

    Course Title: Cloud Computing

    Course Code: CSE- 472 , Spring 2022

    SECTION 1: (S) 4PM - 6 PM, (T) 4PM - 5 PM

    Presented by
    Dr. Rubaiyat Islam
    Crypto-economist Consultant
    Sifchain Finance, USA.
    Adjunct Faculty, IUB.
    Cloud Security Fundamentals

    Ref: Chapter – 6 , from the book ”cloud-computing-


    concepts-technology-architecture-by-thomas-erl”

    2
    Security Terms and concepts

    1. Confidentiality :

    - Accessible to only authorized


    people.
    - A financial institution store and
    process sensible customer
    data.
    - It can use encryption to
    protect the confidentiality and
    store the keys to the FI and
    cloud provider can not access it
    even if data is stored in their
    physical server.
    - FI can use access control to
    restrict

    3
    Security Terms and concepts

    2. Integrity:
    - Data can not be manipulated
    or altered by unauthorized party.
    - A healthcare provider may use
    cloud storage to store patient
    medical records and other critical
    data. To ensure the integrity of
    this data, the provider can use
    cryptographic hashes to verify
    the integrity of the data at
    different stages of the data
    lifecycle, such as when the data
    is uploaded to the cloud and
    when it is retrieved from the
    cloud.

    4
    Security Terms and concepts

    3. Authenticity :
    - The concept relates to nonrepudiation, meaning the
    person committed something can not deny or challenge
    the authenticity of interaction .
    - A law firm can use a cloud-based document
    management system and authentication can be done by
    digital signature.
    4. Availability :
    - accessible and usable during a specified time period.

    5
    Lack of Security Representing Terms

    1. Threat :
    - Potential security violation.
    - Can challenge the defenses of a system.
    - Data breaches, insider threats, DDoS(Distributed Denial of
    Service), misconfiguration, malware, viruses, social engineering
    such as phishing and spear phishing, .
    2. Vulnerability:
    - Insufficient security.
    - In 2017, a misconfigured Amazon S3 bucket led to a data breach
    affecting millions of customer records from a financial services
    company called Dow Jones. The Amazon S3 bucket was set to
    allow public access, and it contained sensitive information such as
    names, addresses, and account details.
    3. Risk:
    - possibility of loss or harm arising from performing an activity
    , for example data protection law, performance risk, data loss risk
    etc.

    6
    Counter measures :

    - Security Controls: To assess the risks.


    - Security Mechanisms: Defensive
    measurement.
    - Security Policies : Policies are the
    implementation of security controls and
    mechanisms.

    7
    Threat Agents:

    • A threat agent is an entity


    that poses a threat because
    it is capable of carrying out
    an attack.
    Agent based Model:
    - Strong Access Control
    - Encryption
    - Security Assessments.
    - Compliance.
    - Disaster Recovery.

    8
    Types of Threat Agents:

    - Anonymous Attacker - Malicious Service Agent


    (Non-trusted threat agent (intercepting network
    tries outside from cloud
    boundary) communication )

    - Trusted
    Attacker(with - Malicious
    legitimate Insider(someone
    credentials ) attempts to access
    previlage)
    9
    Cloud Security Threats:

    (1) Traffic Eavesdropping :


    • Passively intercepted by a malicious
    service agent for illegitimate
    information gathering purposes
    • Compromise the confidentiality of the
    data and, possibly, the confidentiality of
    the relationship between the cloud
    consumer and cloud provider.
    • "CloudBleed" vulnerability that
    affected the content delivery
    network provider Cloudflare in 2017.
    caused by a flaw in Cloudflare's edge
    servers that enabled a buffer
    overrun, which in turn caused private
    data to be included in the server's
    HTTP responses. The data was then
    cached by search engines and other
    intermediaries, making it vulnerable
    to eavesdropping and data theft.

    10
    Cloud Security Threats:

    (2) Malicious Intermediary :


    • The malicious intermediary threat
    arises when messages are intercepted
    and altered by a malicious service
    agent
    • Several ways like Man-in-the-middle,
    DNS Hijacking, Rouge Access point,
    Malware infected routers and
    gateways.
    • One real world example is "Darkhotel"
    APT (Advanced Persistent Threat) group
    that targeted hotels and other
    hospitality businesses to steal sensitive
    data from business executives and
    government officials. The attackers
    compromised the Wi-Fi networks of
    the hotels and intercepted traffic from
    guests' devices as they connected to
    the hotel Wi-Fi and accessed cloud
    resources.

    11
    Cloud Security Threats:

    (3) Denial of Services:


    • Objective of this attack is to overload IT
    resources to the point where they cannot
    function properly.
    • How it is done?
    - The workload on cloud services is artificially
    increased
    - network is overloaded with traffic to reduce its
    responsiveness and cripple its performance.
    - Multiple cloud service requests are sent, each
    of which is designed to consume excessive
    memory and processing resources.
    - One example is 2019 attack on Amazon Web
    Services (AWS) that affected numerous
    companies that relied on AWS for their web
    services. The attack was reportedly carried out
    using a technique called "Connection Flood",
    which flooded the network with a massive
    number of connection requests, overwhelming
    the server and causing it to become
    unresponsive.

    12
    Cloud Security Threats:

    (4) Insufficient Authorization :


    • when access is granted to an
    attacker erroneously or too
    broadly
    • this attack, known as weak
    authentication, can result when
    weak passwords or shared
    accounts are used to protect IT
    resources.

    13
    Cloud Security Threats:

    (5) Virtualization Attack :


    • "Venom" vulnerability that was
    discovered in 2015. Venom
    (Virtualized Environment
    Neglected Operations
    Manipulation) is a security
    vulnerability that affects the
    virtualization platforms used by
    cloud providers, including Xen,
    and VirtualBox.
    • attackers can exploit
    vulnerabilities in the virtualization
    layer to gain access to sensitive
    data and systems.

    14
    Cloud Security Threats:

    (5) Overlapping Trust Boundaries :


    • If physical IT resources within a cloud are
    shared by different cloud service consumers,
    these cloud service consumers have
    overlapping trust boundaries.
    • One real-world example of overlapping trust
    boundaries in cloud computing is the 2011
    attack on Sony's PlayStation Network.
    • The attack was made possible by the fact
    that the PlayStation Network had
    overlapping trust boundaries with other
    Sony networks, including the Sony Online
    Entertainment network. The attacker was
    able to exploit a vulnerability in the
    authentication system of the Sony Online
    Entertainment network to gain access to the
    PlayStation Network, which shared the same
    authentication system.

    15
    Additional Considerations

    • Flawed Implementations
    - The figure depicts a poorly
    implemented cloud service
    that results in a server
    shutdown. Although in this
    scenario the flaw is exposed
    accidentally by a legitimate
    cloud service consumer, it
    could have easily been
    discovered and exploited by
    an attacker.

    16
    Additional Considerations

    • SLA or Contracts
    - Cloud consumers need to examine carefully the Service Level
    Agreemet(SLA) or contracts of Cloud providers before starting to use it.
    - A cloud consumer that deploys its own solution upon infrastructure
    supplied by the cloud provider will produce a technology architecture
    comprised of artifacts owned by both the cloud consumer and cloud
    provider.
    - Good collaboration and communication are needed for reaching a
    common ground on solving the conflicts on issues like security policies
    to ensure the data and infrastructure are secured.
    - it is important for the cloud consumer and cloud provider to work
    together to find a solution that meets the needs of both parties while
    maintaining the necessary security controls.

    17
    Additional Considerations

    • Risk Management:
    cloud consumers are encouraged to perform
    a formal risk assessment as part of a risk
    management strategy.
    - Risk Assessment: To identify potential
    vulnerabilities and shortcomings that
    threats can exploit.
    - Risk Treatment: Some can be eliminated
    others can be mitigated. And rest can be
    carried out by the cloud provider as a
    contractual responsibilities.
    - Risk control : This is basically monitoring of
    the three stage like surveying related
    events, reviewing the previous risks,
    treatments and policy adjustment needs.

    18
    Summary

    • Basic Terms and Concepts


    •Threat Agents
    •Cloud Security Threats
    • Additional Considerations

    19

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy