Security challenges in centralized shared data processing systems

Achieving Confidentiality, Integrity and Availability

Achieving Integrity, Confidentiality and Availability

Shared Centralized Data Processing Environment

In a contemporary business environment, shared centralized data procession has become a critical requirement for the modern day data processing. The centralized shared processing environment allows multiple companies to process large quantity of data remotely within a short period. In other word, the centralized data processing system is the strategy where a data processing is performed by a single computer or cluster of coupled computer, and all data processing operations are performed through a central computer system. Klausm et al. (2007) argue that centralized processing operations started in 1950s. Beginning from1960s, many companies has use the centralized computer systems to connect their headquarters, and branch offices computer systems. Between 1980s and 1990s, there was a proliferation of LAN (Local Area Network) and personal computer assisting organizations to share data with their employees within a location. The rapid development of information technology has led to the development of high volume of data that gives business agents the opportunity to process their data real time and having access to a shared repository of information systems.

In essence, business organizations with similar services have taken the advantages of the internet and development of information systems to implement centralized shared data processing. Some of the transaction processing facility systems that have taken the advantages of the centralized shared data processing systems include Hotel Reservation, Credit Verification and Authorization,. Electronic Fund Transfer, Communication Transaction Router and Loan Payment Processing, In essence, the centralized shared data processing system is able to provide a responsive to data processing solutions for many organizations. The complexity of information requirement within a contemporary business environment makes increasing number of organizations to develop a strategy to implement a shared and centralized data processing. Typically, distributing information over the network system requires the interconnection of multiple sites. In the centralized data processing environment, one machine controls access to files and update, and centralized systems responds to the organizational needs with reference to program and data. In a purely centralized data process model, all organizational data reside in a centralized Datacenter. These include Share Files, Domain Authentication Services, Applications, and Email. The benefits of centralized shared data processing are the lower operational costs and capital. Moreover, the centralized shared data processing model provides less administrative overhead and less backup complexity. A centralized model also provides an efficient processing environment. Despite the benefits that organizations can derive from a centralized shared data processing system, a major concern is security. Typically, achieving the CIA (Confidentiality, Integrity and Availability) is becoming a challenging for organizations within a shared centralized data processing environment. Moreover, it is a big challenge to design an information security system that can safeguard organizational data. Dongarra, (2012) points that a centralized shared computer system is a high performing machine with a shared-memory systems having multiple CPU (central processing unit).

Choi, Chun, Kim et al. (2013) argue that forgery is the major security concern of the centralized shared data processing. Since all the data are in a digital form, data can be created, manipulated and modified in many form. Moreover, a sophisticated hacker can easily modify and forge data in transit making the data to face serious threat. Ernst & Young (2014) support this argument by pointing out that a centralized shared data processing approach provides both opportunities and risks. Typically, the centralized shared data processing service can provide more data processing efficiency at lower costs, however, organizations face the risks of losing their data if effective data security is not implemented. Olivier, .(2010) support this argument by pointing out that the implementation of an effective data privacy is one of the major challenges within a shared centralized data processing environment. However, an effective security system can be achieved by balancing the privacy with confidentiality, integrity and availability. In other word, organizations are required to design effective information security to enhance confidentiality, integrity and availability of data.

Security Challenges of the Shared Centralized Data Processing

In the contemporary IT environment, a centralized shared data processing environment carries some risks despite the benefits that organizations derive from implementing such approach. Typically, information systems are inherently characterized with series of vulnerabilities. The vulnerabilities can be accidental or deliberate with attempt to jeopardize the information system capabilities. For example, hardware vulnerability can be shared among the consoles, communication facilities, and computer systems. On the other hand, software vulnerabilities can be found in all level of the operating systems, which can be vulnerable to the information system and the user authentication, identification and access control. The seriousness of the vulnerability of the information systems depends on the operating system environment, strategy the system designer employs in designing the information systems as well as capabilities of potential attackers.

Whitman, and Mattord, (2011) identifie six component of centralized shared data processing systems. They include hardware, software,, data, networks, people and procedures. All these components make information systems available for business organizations. Moreover, these components assist organizations to process, input, store and output data. However, all these components have their strengths and weakness, and each of these components has its security requirements. The software component consists of operating systems, applications, and utilities and it is the most challenging part of the information system to secure. For example, errors in exploitation during the software programming accounts for the largest portion of information attacks. In the information technology industry, there is a series of computer risk reports on the computer software problems. For example, many software applications are created under the cost, time and manpower constraints, and the information security is often an afterthought after the development of the application is completed . By consequence, these application are characterized with various security loopholes since the information security does not included an integral part of the software development. Consequently, the software applications become an easy target of the intentional and accidental attacks. (Oppenheimer, 2011). Despite the security problems associated with software, the software are the lifeblood of an organizational information systems.

Hardware is the other components of the shared centralized data processing systems that executes and house the software. The hardware stores, transports data as well as providing interface for the removal and entry of data into the information systems. Physical security policies are the strategy to offer security for the hardware in order to prevent theft or physical damage. Traditional physical security tools include locks and keys as well as restricting access to the hardware components. In essence, implementing physical security for the hardware components are very critical because a breach of hardware physical security can lead to a loss of data and information. However, most organizational physical security cannot guarantee any level of security. For example, laptop stolen is very common in many organizations. Although, the costs of laptop are only few thousand dollars, however, data stored, processed and transmitted within the laptop can worth several million of dollars. Whitman, and Mattord, (2011) argue that data are the part of the most valuable assets that organizations possess, and these assets are the main target of attack. While security of the database is very critical, the use of centralized shared data processing system can relegate system security capabilities.

Lack of implementation of effective procedures is another security problem within the centralized shared data processing environment . A procedure is a written instruction to accomplish specific tasks. While many organizations provide procedures that employee must follow within a data processing environment, however, these organization do not provide effective training and education for the employees in order to carry out the procedures effectively.

Network is also a components for the shared centralized data processing system. Network system is very critical to share and process data, and the LAN (Local Area Network) and WAN (Wide Area Network) are very essential to achieve centralized shared data processing goals. Typically, both LAN and WAN are connected with internet to assist different organizations to share and process data. Despite the benefits that can be derived from the network systems, the network connectivity is inherently characterized with security challenges. Applying physical and traditional security to the network system is not enough, sophisticated modern security system is very critical to enhance security of the data transmitted across the network. Some of the inherent security problems that can occur across of the network include eavesdropping, sniffing, DoS (Denial-of-Service), brute force attack and password cracking.

Florian (2013) contributes to the argument by pointing out a vulnerability continues to increase in the contemporary IT environment. The data from the NVD (National Vulnerability Database) reveal that the security vulnerability in 2013 surpassed the IT vulnerabilities of 2012. The author reveals that the there were reported average of 13 new vulnerability per day. A total of 4,494 recorded vulnerabilities, which was the highest between 2009 and 2013. Analysis of these vulnerability reveals that one-third are categorized as "high severity" indicating that the vulnerabilities have a high negative impact on the information systems. The intriguing part of it is that vulnerabilities are being discovered in the software produced by some vendors. In the United States, different vulnerabilities are discovered in the software applications produced by 760 vendors. In 2013, 514 security vulnerabilities were discovered in the software produced by the Oracle revealing a significant increase between 2012 (424) and 2013 (514 ).

Moreover, Java recorded 193 vulnerabilities and 100 of them are critical. The third party applications are also major sources of vulnerabilities where there are has been a significant increase in the vulnerabilities identified in the hardware devises and operating systems. For example, Cisco is number 2 top 10 vendor that produces hardware with vulnerabilities. There has also been an increase in the number of vulnerability found in the operating systems irrespective of brands and Linux or Microsoft top the list in 2013.

Ware,(1979) points that increasing widespread of resources sharing computer systems has lead to an increase of security issues. Although, resources sharing computer systems have some advantages, however the systems have some inherent security problems. Ware,(1979) provides a comprehensive report on the security vulnerabilities of the centralized shared data processing system. For example, an accidental disclosure is one of the vulnerability to the shared resources. An accidental disclosure of data may occur from the failure of hardware or software, and such security vulnerabilities can render program or file unusable. An accidental disclosure may also occur through an improper action of maintenance or machine operating without a deliberate intent. Deliberate penetration of information systems is another security problem to centralized shared data processing systems. For example an unauthorized individual may use a covert and deliberate attempt to obtain sensitive information from the information systems. Moreover, there can be a deliberate attempt to manipulate information systems to make the systems unusable and unreliable for the legitimate user.

"A deliberate and covert attempt to obtain information contained in the system, cause the system to operate to the advantage of the threatening party, or manipulate the system so as to render it unreliable or unusable to the legitimate operator. Deliberate efforts to penetrate secure systems can either be active or passive. Passive methods include wire tapping and monitoring of electromagnetic emanations. Active infiltration is an attempt to enter the system so as to obtain data from the files or to interfere with data files or the system." (Ware, 1979).

More importantly, an unauthorized individual can use active or passive technique to tap information from the information systems. The passive methods include monitoring and wire tapping of information. The active infiltration is the act of penetrating the information systems through the indentified system loopholes. Typically, an active penetration can be employed by individuals having knowledge of access control mechanisms and security loopholes in the information systems and using the loopholes to his own advantages.

Kaur, & Vashisht,.(2013) identify cloud as one of the information systems that assists in data sharing over the internet. In essence, the cloud computing include the system software and hardware that assist in developing the data centers. However, users are required to seek for the service of a cloud service provider in order to enjoy the data sharing services. Some providers charge "follows pay-as-you-go paradigm." (Kaur, & Vashisht 2013 p 26).One of the benefits of cloud shared resources is its economic of scale advantages, which assist in lower the costs of operations. Despite the benefits associated with the cloud computing, the security challenges are major problems facing the cloud computing systems. It is essential to realize that as organizations move into the cloud technology, they lose operational flexibility as well as direct control over the security. While Iaas (Infrastructure as a Service) has higher control over the configuration, however, SaaS customers only have a lesser control over its configuration. In the configuration of cloud services, the service provider is responsible for the design of the cloud technology, which assist the organizations switching to the new business model. To deliver the trust and CIA (Confidentiality, Integrity and Availability) in the cloud, the service providers are required to separate data. Moreover, the service providers secure the data through encryption using the SSL (Secure Sockets Layer ) technology. Despite the strategy that the cloud service provider in employing enhancing security protocol, there are still some security challenges. Part of the security challenges include challenges in enhancing availability and reliability of infrastructures. Moreover, challenges in data management, governance and software management.

Major security challenges of the centralized shared data processing is problem of securing data transfer. For example, organizations using the cloud technologies are able to access the cloud services using the internet technology. However, internet is inherently characterized with security issues such as stealing or modification of data. The problem is that an unauthorized individual may hack data through unsecure channel.

Kuyoro Ibikunle & Awodele (2011) also support the argument that cloud computing offers innovative and technology model without upfront incurring upfront investments. Moreover, cloud computing offers innovative services of allowing organization to enjoy a centralized shared data processing. More importantly, cloud computing offers resilience, scalability, efficiency and flexibility of data processing for organizations. Despite the benefits that organizations can enjoy from the cloud computing, there are still some security challenges using cloud computing for data processing. Since the third party providers offer the cloud computing service, there could be high possibilities of data breach.

Kuyoro Ibikunle & Awodele (2011) identify Iaas (Infrastructure as a Service) as the major technology that provides the centralized shared data processing environment for organizations. The IaaS is the type of cloud data processing data where the dedicated resources are shared by the contracted clients usually at "a pay-per-user fee." (Kuyoro Ibikunle & Awodele, 2011 p 250). The strategy assists organizations to minimize the initial IT investments of computer hardware such as server, processing power, and networking devices.

Active infiltration is another type of security threats to the centralized computer systems that involves illegally design a terminal with attempt to steal data from the information systems. Such terminal can flow between central processor and legitimate terminal with the attempt to manipulate the systems and intercept information that flows between the legitimate central processor and terminal. For example, an illegal terminal, controlled by an unauthorized individual, can take over the interaction with the computer processors when a legitimate user signs off from the systems. On the other hand, an unauthorized user can maintain activity when a legitimate user is inactive with the attempt to drain off the data from the information systems. Moreover, an employee can collude with illegal agent to penetrate the organizational information systems in order to steal data. The strategy is take advantages of inadequacies in the information systems protection to commit an act that can be destructive to the organizational information systems. Another extreme active infiltration is the strategy by which an agent actively creates a trap door, which can be exploited at later date.

Stalling, (1999) points out that the active attacks are in four categories, which include modification of messages, masquerade, replay, and denial of service. A masquerading can take place when an entity impersonates an unauthorized entity to capture a sensitive data. On the other hand, replay involves the retransmission of data in order to produce an unauthorized effect. Modification is the altering of a legitimate message to deliver an unauthorized effect. The denial of service attack is the strategy or inhibiting or preventing management to achieve normal of communications facilities. An attacker can also disrupt the entire network facilities using the network overloading or network disabling strategies.

Passive Subversion is another information system security challenge to the centralized shared data processing systems. The passive subversion is the strategy of manipulating or interfere with the system. For example, an unauthorized individual can carry out the passive subversion through the wire tapping between the central processor and remote terminals. Based on the different security threats identified with the centralized shared data processing systems, the literatures are reviewed to provide the strategy that can be employed in integrating an effective security procedures to assist organizations in enhancing confidentiality, integrity and availability within the centralized shared data processing environment.

Security Protocols for the Shared Centralized Data Processing Environment

Stallings, (2011) reveals that the information security systems has undergone major changes in the last few decades. Before the introduction of the data processing equipment, the security of information systems were implemented using the administrative and physical methods. For example, security procedures were carried out by storing the sensitive information in the file cabinet. However, with the introduction of computer systems and centralized shared data processing devises, the automated tools are very necessary to enhance effective security systems. The generic tools and system design used to protect sensitive data and thwart hackers is referred as information and computer security.

Stallings, (2011) further points out that the use of shared and distributed systems "for carrying data between terminal user and computer and between computer and computer" (Stallings, 2011 p 2) has also altered the information security landscape. In essence network security measures are very critical to protect data during the data transmission. In the contemporary business environment, virtually all businesses, academic and government organizations interconnect their data processing equipment using interconnection of network systems. With the interconnection of a shared data, an attacker can introduce into the network to collect data from the information systems.

Organizations are required to implement different strategies to enhance protection of information systems. Ware (1979) discusses different strategies that organizations should implement in integrating security within the shared information systems. The author identifies the system designer an important stakeholders that must enhance effective security systems in the organizational system. Typically, the system designer must aware of points of vulnerability before designing the information systems and must integrate effective and adequate mechanisms to counteract both deliberate and accidental events that can lead to a loss of data. The potential leakage points include hardware, software, physical surroundings, organizational (personnel and procedures) and communication links. The overall strategy to safeguard information within the organization computer systems is to ensure that effective procedures are employed to protect different linkages that could lead to vulnerabilities.

However, Whitman, & Mattord, (2011) in their argument point out that organizations are required to carry out the security analysis before integrating effective security design in the information systems. For example, the information security analysts should perform a risk analysis in to understand the current state of the security systems implemented by an organization . The analysis will assist in understanding the formal information security mechanism and policies that an organization is currently implementing. The security assessment will also assist in prioritizing the assets and threats that need to be effectively protected and type of security mechanisms that should be employed for the information system protection.

Swanson, (2001) contributes to the argument by pointing out that "adequate security of information and the systems that process it is a fundamental management responsibility." (p iv). The author points out after the system design, organizations are required to carry out the self-assessment of information systems regularly to identify potential vulnerability in the information systems. The essence of the risk assessment is to identify the areas in the information systems where the management should focus its attention. Moreover, the risk assessment will assist organization to carry out the contingent plan for the protection of information systems.

Swanson, (2001) further identifies physical security as one the strategy to enhance security of information systems to enhance data integrity. Typically, the physical security procedure is the strategy of safeguarding the physical equipment such as the magnetic tapes, printouts, magnetic disc packs, and punchcards. In essence, organizations must ensure physical security measures of these items using the following guidelines:

First, organizations must provide the physical protection to location of the central computing complex and associated computer such as operational area and machine room. These equipment must be secured effectively and security systems provided must commensurate with the security provided to the most highly sensitive and classified materials. More importantly, organizations must carry out the continuous physical protection of the storage and computer devices because some unauthorized individuals understand that organizations are likely to store sensitive and classified information in the computer system . Thus, it is very critical to ensure that businesses offer continuous physical security to their information systems to enhance effective protection of datasets.

Whitman, & Mattord, (2011) also suggest that organizations are required to offer effective physical security for the remote terminal devises. In essence, the terminal protection is very critical to prevent tampering with the intelligent sensors and terminal. Moreover, the hardware that contain sensitive information should be physical isolated and kept in remote place during the maintenance procedures. Ware,(1979) also suggests that hardware leakage points are the essential areas that organizations must offer effective security. For example, malfunction of the hardware can lead to the leakage of sensitive information . Thus, malfunctioning of the hardware such as circuits, privileged mode operation, bounds registers, can affect the security control. Typically, both active and passive penetrators can take the advantages of the hardware leakage points to penetrate organizational information systems. In the active mode, a penetrator may take the advantage of the leakages point to tap information, and one of the strategies that can be employed to prevent the hardware leakages is to install covert monitoring devises within the central processor to identify potential hardware leakages that can lead to vulnerability of the company data.

Prevention of software leakage point is another strategy that organization can employ to prevent loss of data. Software leakage points are directly related to vulnerability of the software systems. For example, leakages can emanate from improper design of software systems. There is a need to understand that the operating systems are very complex and large, and malfunction of the software system may lead to the leakages of sensitive information. For example, a clever attacker may deliberately induce software malfunction to be able to tap file or other sensitive information. The normal security safeguard integrated in the operating system software include user identification, memory bounds control, and user control. Typically, these security safeguards can stop working due to the hardware and software malfunctions. Thus, organizations are required to carry out the internal checks of both hardware and software systems to prevent malfunctioning of both the hardware and software to reduce the probability of information leakages.

More importantly, effective monitoring of the organizational communication points is very essential to prevent leakages. For example, an attacker can employ wire tapping to steal sensitive information from the information systems through the land lines as well as using the radio intercept equipment. The tampering technique can also be employed against the central processor and terminal equipment. (Stallings, 2011).

Reference

Andress, J. (2011). The Basics of Information Security: Understanding the Fundamentals of InfoSec in Theory and Practice. Elsevier.

Ballad, B. Ballad, T. & Banks, T. (2010). Access Control, Authentication, and Public Key Infrastructure.

Burr, W. Ferraiolo, H. & Waltermire, D. (2014). NIST and Computer Security. IEEE.

Choi, J. Chun, S.A. Kim, DH et al.(2013). SecureGov: Secure Data Sharing for Government Services. ACM. 978(1): 4503-2057.

Dongarra, J.J. (2012). High Performance Computing Systems: Status and Outlook. UK. Cambridge University Press.

Ernst & Young (2014).Centralized operations The future of operating models for Risk, Control and Compliance functions. EYGM

Limited.

Florian, G.(2013). Report: Most vulnerable operating systems and applications in 2013. GFI Software Paper.

Haughn, M . & Gibilisco, S. (2014). confidentiality, integrity, and availability (CIA triad). TechTarget.

Infosec Insitute (2014). Guiding Principles in Information Security. Infosec Insitute . USA.

Kaur, K. & Vashisht, S.(2013). Data Separation Issues in Cloud Computing. International Journal for Advanced Research Engineering and Technology. 1(X): 26- 29.

Klaus, L.P.Egeler, K. Naveen, E.P. et al. (2007). Using z/VM for Test and Development Environments: A Roundup. IBM Redbooks.

Kuyoro S.O., Ibikunle F. & Awodele O.(2011). Cloud Computing Security Issues and Challenges. International Journal of Computer Networks (IJCN). 3 (5): 248-255.

Swanson, M. (2001). Security Self-Assessment Guide for Information Technology Systems. NIST Special Publication 800-26.

Olivier, M.S.(2010). Database Privacy Balancing Confidentiality, Integrity and Availability. ACM. 4(2):20-27.