CC_ SECURITY ISSUES by a_khoshnoudi @IUST

Cloud Security. a_khosnoodi@alumni.iust.ac.ir 1

What is Cloud Computing ?
What are the benefits of cloud computing ?

CLOUD?
CLOUD:
Common implies multi-
tenancy, not single or
isolated tenancy
Location-
independent
Online
Utility implies
pay-for-use
pricing
Demand implies
,infinite, immediate,
invisible scalability
Cloud Security. a_khosnoodi@alumni.iust.ac.ir

Big Data
Challenges
Of As 2012, About 2.5 Exabytes Of Data
Are Created Each Day!
This Number Doubling Every 40
Months
WALMART Collects More than 2.5
Petabyte Of Data Every Hour From Its
Customer Transactions…
https://hbr.org
Analysis
Capture
CurationData
Search
Sharing
Storage
Transfer
Visualization
Information privacy
Cloud Security.
a_khosnoodi@alumni.iust.ac.ir
4

“Computing May Someday Be Organized
As A Public Utility, Just As The Telephone
System Is Organized As A Public Utility”
(John McCarthy, 1961)
McCarthy
And
His “BIG”
Wishes
Cloud Security.
5

Cloud Security.
6

Cloud Benefits
On-demand Access Reduce Costs
Cloud Security.
7
renting instead of buying
Pay-as-you-go
EC2: a few cents to a few $ per
CPU hour
S3: a few cents to a few $ per GB-
month
Unlimited
Storage
Capacity
Ease of
Use
QOS

Cloud security
Cloud Security.
7cloud computing
Currently there is an increasing trend in outsourcing data
to remote cloud…
Offers huge storage space with low cost
Reduce the maintenance and burden of local data storage

FRONT BACK
Cloud Security.
9

Physical Servers
Some highly secure inside
Cloud Security.
10

COOLING
Cloud Security.
11

POWER / [PUE=Total Facility Power/ IT Equipment Power]
site-off&site-on
Cloud Security.
12

Cloud bases
CLOUD COMPONENTS CLOUD FUNDEMENTALES
Cloud Security.
13
SOA
Web 2.0
UTILITY
Computing
C
L
O
U
D

VIRTUALIZATION
Cloud Security.
14

XaaS
Cloud Security.
15

Cloud services
IaaS, PaaS, and SaaS Comparison
•
Cloud Security.
16

Software as a Service:SaaS
SAAS_ SECURITY ISSUES CONCEPT
Cloud Security.
17
1.The capability provided to the
consumer is to use the
provider’s applications running
on a cloud infrastructure.
2. SaaS provides application
services on demand such as
email, conferencing software,
and business applications such
as ERP, CRM, and SCM[3]

in SaaS, it’s your data
Cloud Security.
18

1_Application security : SaaS app are typically delivered via the Internet through a Web browser[33,34].  flaws
in web app may create vulnerabilities for the SaaS app. Ex : Steal Sensitive Users Data[4].
OWASP(Open Web Application Security Project) : The Top10 Critical Web Applications Security Threats in [5].
2.MULTI-TENANCY: SaaS app can be grouped into models that _determined by the following characteristics: Scalability,
Configurability Via Metadata, and Multi-tenancy[3,6]::
2_A) First model :each customer has his own customized instance of the software( no bad security)
2_B) Second model, the vendor also provides different instances of the applications for each customer(all instances
use the same application code AND customers can change some configuration options.
2_C) In the Third model MULTI-TENANCY is added so a single instance serves all customers [7]. risk of “Data Leakage”
between Tenants thus ensure that customer’s data are kept separate from other customers [8].
3. Data security::Data security is a common concern for any technology, but it becomes a major challenge when SaaS users have to rely on their providers for
proper security [27,33,,9]. In SaaS, data is often processed in plaintext( not encrypted) and stored in the cloud. [responsible for SaaS provider ] [3]
Also cloud providers can subcontract (outsourcing) other services such as backup from third-party service providers, which may raise risk.
4. Accessibility::Accessing applications over the internet via web browser and including Public Computers and Mobile Devices
( High Risk Accessibility). The Cloud Security Alliance describes the current state & the top Threats of mobile computing[3]
Information Stealing Mobile, malware, insecure networks (WiFi), VULNERABILITIES found, in the device OS, insecure marketplaces..
19
Cloud Security.

Platform as a Service
(PaaS)
PaaS Security Issue CONCEPTS
Cloud Security.
20
PaaS facilitates Deployment of Cloud-
based Applications WITHOUT the
cost of buying and maintaining the
underlying Hardware And Software
Layers [32].
PaaS security depend on 2 software
layers:: 1.Security of the PaaS platform
itself (i.e., runtime engine) 2.Security of
customer applications deployed on a
PaaS platform
1.The capability provided to the consumer is to
deploy onto the Cloud Infrastructure his own
applications WITHOUT installing any
platform or tools on their local machines.
2. PaaS, refers to Providing Platform Layer
Resources ,including “Operating System Support
“and “SOFTWARE Development Frameworks “that
can be used to build Higher-level Services [32,1,2]

In PaaS ,It’s is your application
Cloud Security.
21

PaaS Providers are responsible for securing the
platform software.(runtime engine security : that runs
the customer applications)[25]
•Third-party relationships : PaaS does not only provide Traditional
programming languages, but also does it offer third-party web
services components such as Mash up [25,10]. PaaS clients security
depend on both the1- security of web-hosted development tools and
2-third-party services[11].
•Development Life Cycle : the App’s Upgrade Speed in the cloud will
affect both the System Development Life Cycle (SDLC) and Security .
PaaS applications should be upgraded frequently but any changes in
PaaS components can compromise the security of their applications!
Cloud Security.
22

3.Data Legal Issues : DATA should not stored in appropriate
locations. Data may be stored on different places with
different legal regimes that can compromise its Privacy And
Security.[30]
4.Underlying infrastructure security :In PaaS, developers do not have access to
the underlying layers, So providers are responsible for securing the
underlying infrastructure as well as the applications services [12].
Development Environment Tools provided by PaaS provider thus
::Even when developers are in control of the security of their applications, they
do not have the Assurance that the development environment tools are secure
![33]
Cloud Security.
23

Mash-up App
Cloud Security.
24
A mash-up is a Web page or application
that integrates complementary elements
from two or more sources. Mash-ups are
often created by using a development
approach called AJAX :
1.PANORAMIO: a mash-up
of Google Maps and Geo-positioned
photographs of locations
2.Hiking Outpost : a mash-
up of Amazon and online hiking
information resources
Mash-ups combine more than
one source element into a single
integrated unit
.

Consequence Of ISP Deep Dependencies,
Cloud Security.
25
1.any attack to any cloud service layer can
compromise the upper layers.
2.A SaaS provider may rent a development
environment from a PaaS provider, which
might also rent an infrastructure from an IaaS
provider.
3. Each provider is responsible for securing
his own services .
4. It also creates confusion over which,
service provider is responsible once an
attack happens.
1.The capability provided to the consumer is to
Provision Processing, Storage, Networks,
And Other Fundamental Computing
Resources. where the consumer is able to
deploy and run arbitrary software( include OS
or App).
2. IaaS provides a Pool Of Resources such
as servers, storage, networks, and other
computing resources in the form of
virtualized systems, which are accessed
through the Internet [34].

In IaaS, It’s a lot of things!!
Cloud Security.
26

Cloud Security.
27
 Users are allowed to run any software with
full control and management on the
resources allocated to them [29].
 With IaaS, cloud users have better control
over the security compared to the other
models until there is no security hole in the
virtual machine monitor [33].
 IaaS clients control the software running in
their VM’s, and they are responsible to
configure security Policies Correctly[13]
 Underlying (compute, network, and storage
infrastructure) is controlled by cloud providers
Virtualization
VM’s monitor [VMM or Hypervisor]
Shared resource
Public VM image Warehouse
VM’s rollback
VM’s life cycle
Virtual networks

Virtualization
Security Issues Concept
Cloud Security.
28
 Virtualized environments are vulnerable to all
types of attacks for Normal infrastructures;
however, security is a greater challenge as
virtualization adds more points of entry and more
interconnection complexity [17].
 Unlike physical servers, VMs have two
boundaries: physical and virtual [34].
 Virtualization allows users to create, copy, share,
migrate, and roll back virtual machines, which may
allow them to run a variety of applications
[15,16].
 ☻New Opportunities for ATTACKERS
because of the extra layer that must be secured
[4]
 VM’s security becomes as important as
physical machine security, and any flaw in
either one may affect the other [30].

Virtual Machine Monitor (VMM) or Hypervisor
Hypervisor is a low-level software
that controls and monitors its VM’s
Concepts & Sec Issues
Cloud Security.
29
1.Hypervisor is responsible for virtual machines
isolation!
Thus:: if the VMM is compromised( Hacked), its
VM’s may potentially be compromised as well.
2.VMM is a low-level software so as any traditional
software it entails security flaws .[17]
3. virtualization introduces the ability to migrate VM’s
between physical servers for fault tolerance, load
balancing or maintenance [28,18].
This useful feature can also raise security problems
[24,15,19]
4.Victim VM’s: attacker can compromise the
migration module in the VMM and transfer a “Victim
VM” to a malicious Server!.

VM’s Shared resource
Concepts and Treats
Cloud Security.
30
VMs located on the same server can share CPU,
memory, I/O, and others.
Sharing Resources between VMs may decrease the
security of each VM.
Ex: a “Malicious VM” can infer some information about
other VMs through shared memory (other shared
resources) without need of Hacking the hypervisor [18]
Using covert (secret) channels, two VMs can
communicate bypassing all the rules defined by the
security module of the VMM [20].
a malicious VM’s
can monitor shared
resources without being noticed
by its VMM, so
“The Attacker” can infer some
information about other virtual
machines.

VM’s Images
Cloud Security.
31
1. Malicious users can store images
containing malicious code into public
repositories( ex Amazon) and compromising
other users or even the cloud system
[31,34,35].
2. VM replication[31]: Some critical information
such as passwords or cryptographic keys can be
recorded while an image is being created, If the
image is not “cleaned”, this sensitive
information can be exposed to other users.
3. VM images are dormant artifacts( in default)
that are hard to patch while they are offline [50].
a VM image is a prepackaged software
template containing the configurations files
that are used to Create VMs.(In IaaS
environments) . Thus::
These IMAGES are fundamental for the
overall security of the cloud [18,21].
Amazon offers a public image repository where
authorized users can download or upload a
VM image.
.

Virtual machine Rollback
Rolling back! Security Issues
Cloud Security.
32
IF an Error Happens, virtual
machines are able to be rolled
back to their previous states! .
Snapshot : a Copy of VM,
when Rolling back is
happened.
1. Rolling back virtual machines can re-expose
them to security vulnerabilities that were
patched or re-enable previously disabled
accounts or passwords
2. To Provide Rollbacks, we need to make a
“copy” of the virtual machine (snapshot)
, which can result in the propagation of
configuration errors and other
vulnerabilities [27,16]

Virtual machine life cycle
NO cloud without…
Cloud Security.
33
VMs can be on, off, or suspended (make it harder
to detect malware.)
Also, even when virtual machines are offline,
they can be vulnerable [34]
HOW? If a VM can be instantiated using an
image that may contain malicious code!
These malicious images can be the starting point
of the proliferation of malware by injecting malicious code
within other virtual machines in the creation process.

Virtual networks and security
Virtual networking ways to configure virtual networks2
Cloud Security.
34
Network components are shared by different
tenants due to “resource pooling.”
Sharing resources allows attackers to launch
“cross-tenant attacks”[31].
The most secure way is to hook each VM with
its host by using dedicated physical channels.(
tenant isolation)[23]
But most hypervisors use virtual networks to
link VMs to communicate more directly and
efficiently!!
most virtualization platforms [such as Xen]
provide 2 ways to configure virtual networks:
Bridged and Routed,
but these techniques increase the possibility to
perform some attacks such as sniffing and
spoofing virtual network [17, 24].
The virtual network model is composed of three
layers: 1-Routing layers, 2-Firewall, and 3-
Shared networks[ that prevent VMs from sniffing
and spoofing]. [51]***( in future)

Any breach in IaaS will impact the security of both
SaaS & PaaS Compare ISP model security
Cloud Security.
35
 With SaaS the burden of security lies with
the cloud provider. Why?
1-the degree of abstraction
2-SaaS model is based on a high degree of
integrated functionality with minimal customer
control or extensibility.
 PaaS model offers greater extensibility and
greater customer control. Largely because
of the relatively lower degree of abstraction
 IaaS offers greater “tenant or customer”
control over security than do PaaS or SaaS
[25].

Cloud Deployment
Cloud Security.
36
1Public/InternetCloud__OffPremise
2Private/InterpriseCloud__OnPremise
3Hybrid/Inter Cloud
4) (CommunityCloud

Cloud Deployment
Public / Internet Clouds:
Third-party,
multitenant cloud
infrastructure
and services
Available on a
subscription basis to all
:
Private/ Enterprise
Clouds:
A public cloud model
within a
company’s own
datacenter/infrastructure
for internal
and/or partners’ use
Hybrid/Inter Clouds:
Mixed use of
private and public
clouds; leasing public
cloud services
when private cloud
capacity is insufficien
Cloud Security.
37

Cloud Computing:: Services
and availability: ”on/off”
Cloud Security.
38

Cloud security
Cloud Security.
39
Cloud Vulnerability

Cloud vulnerability
Cloud Security.
40

LIST Of Vulnerability
Authentication(‫هویت‬ ‫احراز‬)،Authorization(‫ها‬ ‫دسترسی‬ ‫بودن‬ ‫مجاز‬ ‫تعیین‬)‫و‬Accounting(‫گزارش‬ ‫و‬ ‫حسابرسی‬)
provisioning vulnerabilities_‫تدارکاتی‬ ‫های‬ ‫آسیب‬
De-provisioning vulnerabilities_‫مشتریان‬ ‫تدارکات‬ ‫قطع‬ ‫از‬ ‫شده‬ ‫ایجاد‬ ‫های‬ ‫آسیب‬
__Remote Access to CDMI( Cloud Data Management Interface)‫ابر‬ ‫در‬ ‫مدیریتی‬ ‫واسط‬ ‫به‬ ‫دور‬ ‫راه‬ ‫از‬ ‫دسترسی‬
Vulnerabilities Hypervisor ‫ی‬ ‫الیه‬ ‫های‬ ‫آسیب‬"‫ناظر‬ ‫فوق‬"
‫منابع‬ ‫جداسازی‬ ‫عدم‬_Lack Of Resource Isolation‫در‬IAAS
LACK OF REPUTATIONAL ISOLATION
Cloud Security.
41

Communication Encryption Vulnerabilities
Communication Encryption Vulnerabilities And Lack Of
(Weak )Encryption
‫ابر‬ ‫در‬ ‫شده‬ ‫رمز‬ ‫های‬ ‫داده‬ ‫پردازش‬ ‫امکان‬ ‫عدم‬
PROCEDURES_‫های‬ ‫روش‬
‫کلید‬ ‫مدیریت‬ ‫در‬ ‫ناکارآمد‬
Low Entropy for "Random NUM"
Generation_ key-Generation
Cloud Security.
42
Weak Encrypt

Lack of Human Resources
Lack of employee screening and poor hiring practices [16]::some cloud
providers may not perform background screening of their employees or provider
Privileged users such as cloud administrators usually have unlimited access to
the cloud data.
.
:
Lack of customer background checks :: most cloud providers do not check their
customer’s background , and almost anyone can open an account with a valid
credit card and email. Un-authentically accounts can let attackers perform
any malicious activity without being identified [16].
Cloud Security.
43

Lack OF Standard Technologies
and Solutions
A LACK OF… LOCKED_IN TO VENDORS
Cloud Security.
44
•…
A lack of standards means
that data may be ‘locked-
in’ to a provider…

Source Vulnerability
NO Source Escrow Agreement
_‫اجرائی‬ ‫توافق‬ ‫وجود‬ ‫عدم‬(‫منبع‬ ‫برای‬)
‫یا‬ ‫منبع‬ ‫از‬ ‫استفاده‬ ‫برای‬ ‫نادقیق‬ ‫و‬ ‫مبهم‬ ‫های‬ ‫مدل‬
Inaccurate Modeling of Resource
Usage::
•‫های‬ ‫مدل‬ ‫از‬ ‫استفاده‬ ‫عدم‬"‫دقیق‬"‫تخصیص‬ ‫جهت‬ ، ‫شفاف‬ ‫و‬
‫منبع‬
•‫اتفاقات‬ ‫بعلت‬ ‫منابع‬ ‫تخصیص‬ ‫های‬ ‫الگوریتم‬ ‫خرابی‬
‫غیرعادی‬
•‫بندی‬ ‫دسته‬ ‫از‬ ‫که‬ ‫منابع‬ ‫تخصیص‬ ‫های‬ ‫الگوریتم‬ ‫خرابی‬
‫منابع‬ ‫مناسب‬ ‫بندی‬ ‫دسته‬ ‫عدم‬ ‫خاطر‬ ‫به‬ ‫کنند‬ ‫می‬ ‫استفاده‬ ‫کارها‬
Cloud Security.
45

SLA Vulnerability
‫جمالت‬ ‫صراحت‬ ‫و‬ ‫شفافیت‬ ‫عدم‬
‫سرویس‬ ‫سطح‬ ‫نامه‬ ‫توافق‬_SLA
Clauses With
Conflicting Promises To
Different Stakeholders
‫توافقنامه‬ ‫جمالت‬ ‫باالی‬ ‫ریسک‬
_SLA Clauses
Containing Excessive
Business Risk
Cloud Security.
46

Best practices
Cloud Security.
47

Checklists For Evaluating Cloud Security
‫شامل‬ ‫موارد‬ ‫این‬ ‫چیست؟‬ ‫دارند‬ ‫دسترسی‬ ‫سیستم‬ ‫به‬ ‫که‬ ‫افرادی‬ ‫و‬ ‫اطالعات‬ ‫فناوری‬ ‫مدیران‬ ‫استخدام‬ ‫در‬ ‫شما‬ ‫مشی‬ ‫خط‬ ‫و‬ ‫ها‬ ‫رویه‬:
o‫استخدام‬ ‫از‬ ‫قبل‬ ‫های‬ ‫بررسی‬)‫آنها‬ ‫مراجع‬ ‫و‬ ‫کاری‬ ‫تاریخچه‬ ،‫وضعیت‬ ‫و‬ ‫ملیت‬ ،‫هویت‬)‫میدانی‬ ‫بررسی‬ ‫و‬ ‫مجرمانه‬ ‫سابقه‬ ‫یا‬ ‫و‬)‫هستند‬ ‫باال‬ ‫ریسک‬ ‫دارای‬ ‫و‬ ‫مهم‬ ‫های‬ ‫نقش‬ ‫دارای‬ ‫که‬ ‫کارکنانی‬ ‫برای‬)
•‫شامل‬ ‫دارد؟‬ ‫وجود‬ ‫اجرا‬ ‫مورد‬ ‫کاربردی‬ ‫های‬ ‫برنامه‬ ‫و‬ ‫داده‬ ‫نگهداری‬ ‫محل‬ ‫به‬ ‫توجه‬ ‫با‬ ‫متفاوت‬ ‫های‬ ‫مشی‬ ‫خط‬ ‫آیا‬:
o‫باشد‬ ‫داشته‬ ‫تفاوت‬ ‫دیگر‬ ‫منطقه‬ ‫با‬ ‫است‬ ‫ممکن‬ ‫منطقه‬ ‫یک‬ ‫استخدام‬ ‫مشی‬ ‫خط‬ ‫مثال‬
o‫باشد‬ ‫شده‬ ‫ذخیره‬ ‫خاص‬ ‫پرسنل‬ ‫با‬ ‫خاصی‬ ‫بخش‬ ‫در‬ ‫حساسی‬ ‫داده‬ ‫است‬ ‫ممکن‬.
‫چیست؟‬ ‫کارمندان‬ ‫برای‬ ‫شما‬ ‫امنیت‬ ‫آموزش‬ ‫برنامه‬
‫شامل‬ ‫دارد؟‬ ‫وجود‬ ‫مداوم‬ ‫ارزیابی‬ ‫پروسه‬ ‫آیا‬:
o‫شود؟‬ ‫می‬ ‫انجام‬ ‫وقت‬ ‫هرچند‬
o‫دوباره‬ ‫مرورهای‬
o‫سیاستها‬ ‫و‬ ‫ها‬ ‫مشی‬ ‫خط‬ ‫بازبینی‬ ‫و‬ ‫اولویت‬ ‫سطوح‬ ‫و‬ ‫ها‬ ‫دسترسی‬ ‫های‬ ‫بازبینی‬
Cloud Security.
48

Supply-Chain Assurance
‫را‬ ‫ارتباطند‬ ‫در‬ ‫شما‬ ‫با‬ ‫و‬ ‫اند‬ ‫شده‬ ‫برونسپاری‬ ‫شما‬ ‫تامین‬ ‫زنجیره‬ ‫در‬ ‫که‬ ‫امنیتی‬ ‫کلیدی‬ ‫عملیات‬
‫نماییید؟‬ ‫تعریف‬
‫دهید‬ ‫شرح‬ ‫را‬ ‫هایتان‬ ‫ساخت‬ ‫زیر‬ ‫به‬ ‫ها‬ ‫ثالث‬ ‫شخص‬ ‫دسترسی‬ ‫تضمین‬ ‫های‬ ‫روند‬ ‫جزئیات‬.
o‫کنید؟‬ ‫می‬ ‫بازرسی‬ ‫و‬ ‫حسابرسی‬ ‫را‬ ‫آنها‬ ‫شما‬ ‫آیا‬
‫دارد؟‬ ‫وجود‬ ‫ثالث‬ ‫شخص‬ ‫سرویس‬ ‫سطح‬ ‫تضمین‬ ‫شدن‬ ‫مشخص‬ ‫برای‬ ‫معیاری‬ ‫چه‬
‫است؟‬ ‫موافق‬ ‫ثالث‬ ‫شخص‬ ‫توسط‬ ‫رفته‬ ‫بکار‬ ‫امنیتی‬ ‫مشی‬ ‫خط‬ ‫با‬ ‫ابر‬ ‫کننده‬ ‫تامین‬ ‫آیا‬
‫داده‬ ‫پیشنهاد‬ ‫مشتریانتان‬ ‫به‬ ‫آنچه‬ ‫به‬ ‫نسبت‬ ‫تر‬ ‫پایین‬ ‫سطح‬ ‫در‬ ‫سرویسی‬ ‫سطح‬ ‫های‬ ‫نامه‬ ‫توافق‬ ‫ایبا‬
‫شده؟‬ ‫گارانتی‬ ‫برونسپاران‬ ‫توسط‬ ‫اید‬
Cloud Security.
49

Business Continuity Management
،‫جزئیات‬ ‫به‬ ‫آن‬ ‫در‬ ‫که‬ ‫مستندی‬ ‫های‬ ‫روش‬ ،‫سرویس‬ ‫کننده‬ ‫تامین‬ ‫آیا‬"‫سرویس‬ ‫قطع‬ ‫اثرات‬"‫دارد؟‬ ‫اختیار‬ ‫در‬ ‫کند‬ ‫می‬ ‫تحلیل‬ ‫و‬ ‫بررسی‬ ‫را‬
‫چه‬RPO‫و‬RTO‫ها‬ ‫سرویس‬ ‫برای‬ ‫هایی‬(‫سرویس‬ ‫قطع‬ ‫هنگام‬)‫است؟‬ ‫شده‬ ‫گرفته‬ ‫نظر‬ ‫در‬
oRTO_ Recovery Time Objective‫و‬RPO_ Recovery Point Objective
RPO‫اش‬ ‫عواقب‬ ‫و‬ ‫پیشبینی‬ ‫قابل‬ ‫غیر‬ ‫ی‬ ‫داده‬ ‫رخ‬ ‫اتفاق‬ ‫یک‬ ‫با‬ ‫را‬ ‫خود‬ ،‫شما‬ ‫کار‬ ‫و‬ ‫کسب‬ ‫تا‬ ‫کشد‬ ‫می‬ ‫طول‬ ‫که‬ ‫زمانی‬ ‫مدت‬ ‫یعنی‬"‫وفق‬"‫و‬ ‫گردد‬ ‫باز‬ ‫خود‬ ‫عادی‬ ‫شرایط‬ ‫به‬ ‫بتواند‬ ‫و‬ ‫دهد‬
‫پارامتر‬ ‫جا‬ ‫درین‬RPO‫مجاز‬ ‫اکثر‬ ‫حد‬ ‫به‬(maximum allowable)‫بودن‬ ‫تحمل‬ ‫قابل‬ ‫میزان‬ ‫اکثر‬ ‫حد‬ ‫یا‬(maximum tolerable)‫زمان‬"‫سرویس‬ ‫قطعی‬"‫دارد‬ ‫اشاره‬.‫و‬
‫فکتور‬RTO‫شود‬ ‫می‬ ‫اطالق‬ ‫بازرگردد‬ ‫خود‬ ‫عادی‬ ‫حالت‬ ‫به‬ ،‫قطعی‬ ‫وقوع‬ ‫صورت‬ ‫در‬ ،‫سیستم‬ ‫کشد‬ ‫می‬ ‫طول‬ ‫که‬ ‫زمانی‬ ‫مدت‬ ‫ماکزیمم‬ ‫به‬.
Cloud Security.
50

Cloud security
Cloud Security.
51
Threats in cloud data storage
The cloud service provider intentionally hide data loss.
The malicious cloud service provider might delete some
data or obtain all the information and sell it to others.
An attacker who intercepts can capture sensitive information such as
business secrets, client details etc.

Cloud security
Cloud Security.
52
Existing protocols
 Does not support both confidentiality and integrity
issues.
 Dynamic scalability of data is not possible –
Modification, Insertion and Deletion of data blocks.
 All the existing protocols are unable to provide strong
security assurance to users.

!!why NSA wants your
cloud data?
Cloud Security.
53
No cloud privacy or
security: If NSA wants
your cloud data

Summary & Predictions
.. We think everyone on the planet deserves to have their own
virtual data center in the cloud ..
- Lew Tucker
.. Cloud Computing Will Be As Influential As E-business ..
- Gartner
.. one of the most important transformations the federal
government will go through in the next decade ..
- Obama’s TIGR Team
.. Who knew that the concept of security in cloud computing was
even possible to imagine?..
- Scott Bradner
..And…I take some quote here:
- Cloud Computing is more and more popular but Cloud Computing Security is a very important problem everybody or
company going to use CC should be concern.
- A_khosnoodi@alumni.iust.ac.ir
Cloud Security.
54

Cloud Security.
55
‫اگر‬ ‫حتا‬ ،‫دارید‬ ‫کردن‬ ‫پنهان‬ ‫برای‬ ‫زیادی‬ ‫چیزهای‬ ‫شما‬
‫ندانید‬!
‫دیگران‬ ‫کنید‬ ‫تصور‬( !‫و‬ ‫حقوقی‬ ‫و‬ ‫حقیقی‬ ‫افراد‬ ،‫حقوقی،قضائی‬ ‫دستگاههای‬)..
‫بدانند‬ ‫شما‬ ‫مورد‬ ‫در‬ ‫را‬ ‫اطالعات‬ ‫این‬:
‫را؟‬ ‫اعتباریتان‬ ‫کارت‬ ‫مشکل‬
‫تان‬ ‫پزشکی‬ ‫ی‬ ‫پرونده‬ ‫و‬ ‫سالمتی‬ ‫احتمالی‬ ‫مشکل‬
‫را؟‬
could anyone possible know that about me without
searching through my mail, e-mail, or phone calls?
،‫بخشد‬ ‫می‬ ‫اعتبار‬ ‫آن‬ ‫به‬ ‫آنچه‬ ،‫رساله‬ ‫یا‬ ‫و‬ ‫نامه‬ ‫پایان‬ ،‫تحقیق‬ ‫هر‬ ‫پایان‬ ‫در‬
،‫است‬ ‫رساله‬ ‫و‬ ‫تحقیق‬ ‫نتایج‬
‫متادیتا‬_‫دیتا‬ ‫متا‬ ‫طریق‬ ‫از‬ ‫جاسوسی‬_‫در‬ ‫محرمانه‬ ‫کاو‬ ‫و‬ ‫کند‬ ‫یک‬ ‫آیا‬
‫شما‬ ‫زندگی‬_‫مرتکب‬ ‫را‬ ‫جرمی‬ ‫هیچ‬ ‫و‬ ‫باشید‬ ‫نرفته‬ ‫خطا‬ ‫براه‬ ‫هرگز‬ ‫اگر‬ ‫حتا‬
‫بنشاند؟‬ ‫سیاه‬ ‫بخاک‬ ‫را‬ ‫زندگیتان‬ ‫تواند‬ ‫می‬ ،‫باشید‬ ‫نشده‬
‫شما‬ ‫معتقدید‬ ‫یا‬ ‫دهید؟‬ ‫می‬ ‫کافی‬ ‫اهمیت‬ ‫مجازی‬ ‫فضای‬ ‫در‬ ‫تان‬ ‫امنیت‬ ‫به‬
‫باشید؟‬ ‫نگرانش‬ ‫که‬ ‫ندارید‬ ‫کردن‬ ‫پنهان‬ ‫برای‬ ‫چیزی‬
‫از‬ ‫بگویم‬ ‫باید‬ ،‫هستید‬ ‫دوم‬ ‫گروه‬ ‫از‬ ‫اگر‬»‫قوانین‬»‫مجازی‬ ‫فضای‬ ‫بر‬ ‫حاکم‬
‫اطالعید‬ ‫بی‬ ‫کامال‬!‫که‬ ‫نیست‬ ‫مهم‬ ‫چون‬«‫چیزی‬»‫یا‬ ‫دارید‬ ‫کردن‬ ‫پنهان‬ ‫برای‬
‫ندارید؟‬

Modeling and Simulation of Scalable Cloud
Computing Environment and the CloudSim Toolkit
‫و‬ ‫آنالیست‬ ‫کلود‬ ،‫کلودسیم‬ ‫افزارهای‬ ‫نرم‬ ‫با‬ ‫ابری‬ ‫های‬ ‫سناریو‬ ‫سازی‬ ‫شبیه‬ ‫پروژه‬ ‫تصاویر‬...‫به‬
‫پی‬ ‫فایل‬ ‫یک‬ ‫در‬ ‫پیوست‬.‫دی‬.‫گردد‬ ‫می‬ ‫تقدیم‬ ‫اف‬.
Cloud Security.
56

Cloud security
Cloud Security.
57

References and Bibliography
[1]. Mell P, Grance T (2011) The NIST definition of Cloud Computing. NIST,
Special Publication 800–145, Gaithersburg, MD
[2]. Zhang Q, Cheng L, Boutaba R (2010) Cloud Computing: state-of-the-art and
research challenges. Journal of Internet Services Applications 1(1):7–18
[3]. Ju J, Wang Y, Fu J, Wu J, Lin Z (2010) Research on Key Technology in SaaS.
In: International Conference on Intelligent Computing and Cognitive
Informatics (ICICCI), Hangzhou, China. IEEE Computer Society, Washington,
DC, USA, pp 384–387
[4]. Owens D (2010) Securing elasticity in the Cloud. Commun ACM 53(6):46–51
[5]. OWASP (2010) The Ten most critical Web application Security risks.
Available: https://www.owasp.org/index.php/Category:
OWASP_Top_Ten_Project
[6]. Zhang Y, Liu S, Meng X (2009) Towards high level SaaS maturity model:
methods and case study. In: Services Computing conference. APSCC, IEEE
Asia-Pacific, pp 273–278
[7]. Chong F, Carraro G, Wolter R (2006) Multi-tenant data architecture. Online.
Available: http://msdn.microsoft.com/en-us/library/aa479086.aspx. Accessed:
05-Jun-2011
Cloud Security.
58

[8]. Bezemer C-P, Zaidman A (2010) Multi-tenant SaaS applications:
maintenance dream or nightmare? In: Proceedings of the Joint ERCIM
Workshop on Software Evolution (EVOL) and International Workshop on
Principles of Software Evolution (IWPSE), Antwerp, Belgium. ACM New York,
NY, USA, pp 88–92
[9]. Viega J (2009) Cloud Computing and the common Man. Computer 42
(8):106–108
[ [10]. Keene C (2009) The Keene View on Cloud Computing. Online. Available:
http://www.keeneview.com/2009/03/what-is-platform-as-service-paas.html.
Accessed: 16-Jul-2011
[11]. Xu K, Zhang X, Song M, Song J (2009) Mobile Mashup: Architecture,
Challenges and Suggestions. In: International Conference on Management
and Service Science. MASS’09. IEEE Computer Society, Washington, DC, USA,
pp 1–4
[12]. Chandramouli R, Mell P (2010) State of Security readiness. Crossroads 16
(3):23–25
[13]. Jaeger T, Schiffman J (2010) Outlook: cloudy with a chance of Security
challenges and improvements. IEEE Security Privacy 8(1):77–80
[14]. Dawoud W, Takouna I, Meinel C (2010) Infrastructure as a service security:
Challenges and solutions. In: the 7th International Conference on
Informatics and Systems (INFOS), Potsdam, Germany. IEEE Computer
Society, Washington, DC, USA, pp 1–8
[15]. Jasti A, Shah P, Nagaraj R, Pendse R (2010) Security in multi-tenancy cloud.
In: IEEE International Carnahan Conference on Security Technology (ICCST), KS,
USA. IEEE Computer Society, Washington, DC, USA, pp 35–41
[16]. Garfinkel T, Rosenblum M (2005) When virtual is harder than real: Security
challenges in virtual machine based computing environments. In:
Proceedings of the 10th conference on Hot Topics in Operating Systems, Santa
Fe, NM. volume 10. USENIX Association Berkeley, CA, USA, pp 227–229
59
Cloud Security.

[17]. Reuben JS (2007) A survey on virtual machine Security. Seminar on Network
Security. http://www.tml.tkk.fi/Publications/C/25/papers/Reuben_final.pdf.
Technical report, Helsinki University of Technology, October 2007
[18]. Hashizume K, Yoshioka N, Fernandez EB (2013) Three misuse patterns for
Cloud Computing. In: Rosado DG, Mellado D, Fernandez-Medina E, Piattini
M (ed) Security engineering for Cloud Computing: approaches and Tools.
IGI Global, Pennsylvania, United States, pp 36–53
[19]. Venkatesha S, Sadhu S, Kintali S (2009) Survey of virtual machine migration
techniques., Technical report, Dept. of Computer Science, University of
California, Santa Barbara. http://www.academia.edu/760613/
Survey_of_Virtual_Machine_Migration_Techniques
[20]. Ranjith P, Chandran P, Kaleeswaran S (2012) On covert channels between
virtual machines. Journal in Computer Virology Springer 8:85–97
[21]. Wei J, Zhang X, Ammons G, Bala V, Ning P (2009) Managing Security of
virtual machine images in a Cloud environment. In: Proceedings of the 2009
ACM workshop on Cloud Computing Security. ACM New York, NY, USA, pp
91–96
[22]. Owens K Securing virtual compute infrastructure in the Cloud. SAVVIS.
Available: http://www.savvis.com/en-us/info_center/documents/hoswhitepaper-
securingvirutalcomputeinfrastructureinthecloud.pdf
[23]. Wu H, Ding Y, Winer C, Yao L (2010) Network Security for virtual machine in
Cloud Computing. In: 5th International conference on computer sciences
and convergence information technology (ICCIT). IEEE Computer Society
Washington, DC, USA, pp 18–21
[24]. Xiaopeng G, Sumei W, Xianqin C (2010) VNSS: a Network Security sandbox
for virtual Computing environment. In: IEEE youth conference on
information Computing and telecommunications (YC-ICT). IEEE Computer
Society, Washington DC, USA, pp 395–398 60
Cloud Security.

[25]. Mather T, Kumaraswamy S, Latif S (2009) Cloud Security and Privacy. O’Reilly
Media, Inc., Sebastopol, CA
[26]. Li W, Ping L (2009) Trust model to enhance Security and interoperability of
Cloud environment. In: Proceedings of the 1st International conference on
Cloud Computing. Springer Berlin Heidelberg, Beijing, China, pp 69–79
[27]. Rittinghouse JW, Ransome JF (2009) Security in the Cloud. In: Cloud
Computing. Implementation, Management, and Security, CRC Press
16. Cloud Security Alliance (2010) Top Threats to Cloud Computing V1.0.
Available: https://cloudsecurityalliance.org/research/top-threats
[28]. ENISA (2009) Cloud Computing: benefits, risks and recommendations for
information Security. Available: http://www.enisa.europa.eu/activities/riskmanagement/
files/deliverables/cloud-computing-risk-assessment
[29]. Dahbur K, Mohammad B, Tarakji AB (2011) A survey of risks, threats and
vulnerabilities in Cloud Computing. In: Proceedings of the 2011
International conference on intelligent semantic Web-services and
applications. Amman, Jordan, pp 1–6
[30]. Ertaul L, Singhal S, Gökay S (2010) Security challenges in Cloud Computing.
In: Proceedings of the 2010 International conference on Security and
Management SAM’10. CSREA Press, Las Vegas, US, pp 36–42
[31]. Grobauer B, Walloschek T, Stocker E (2011) Understanding Cloud
Computing vulnerabilities. IEEE Security Privacy 9(2):50–57
[32]. Subashini S, Kavitha V (2011) A survey on Security issues in service delivery
models of Cloud Computing. J Netw Comput Appl 34(1):1–11
[33]. Jensen M, Schwenk J, Gruschka N, Iacono LL (2009) On technical Security
61
Cloud Security.

Cloud security
Thank you all…

CC_ SECURITY ISSUES by a_khoshnoudi @IUST

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Viewers also liked

Viewers also liked (20)

Similar to CC_ SECURITY ISSUES by a_khoshnoudi @IUST

Similar to CC_ SECURITY ISSUES by a_khoshnoudi @IUST (20)

Recently uploaded

Recently uploaded (20)

CC_ SECURITY ISSUES by a_khoshnoudi @IUST