Cloud Computing Security: Controls, Compliance, and Privacy

Introduction

This paper discusses the identified shortcomings in cloud computing services and the established opportunities for growth regarding security. The security of services is regarded as the primary obstacle. One opportunity for growth lies in combining multiple service-providing resources and mechanisms to mitigate the effects of vulnerabilities. The research further elaborates on the dimensions of security in shared-resource environments and the strategic placement of computing resources at multiple locations — an approach central to cloud computing. Legal and regulatory issues are also addressed in detail.

Improvement in the security of services is also a responsibility shared by cloud service users and the enterprises that choose to store data in the cloud. Service providers can establish storage at multiple locations using different networks and internet service providers to minimize service disruptions. In such cases, users should classify their data and store the least sensitive information on cloud computing resources.

Security Issues Associated with the Cloud

Scott Case, CEO of the Startup America Partnership, narrates a story in favor of cloud computing while setting aside the significant security issues it poses for larger organizations. Priceline.com, a company he co-founded, had to invest $3 million in IT infrastructure, platforms, and software development when the company launched in 1997. Comparatively, equivalent IT capability can now be acquired using cloud services from well-known vendors such as Amazon, Intuit, Dell, or IBM (Shread, 2012). The costs of acquiring IaaS, PaaS, and SaaS are relatively negligible for new startups, allowing capital to be redirected toward marketing and product development. Inventories can be managed at a fraction of the cost incurred through self-owned infrastructure. The flexibility and cost reduction associated with cloud-based IT acquisition often outweigh the potential security threats for smaller organizations.

Cloud Security Controls

The security controls enabled in computing systems, including cloud computing environments, are targeted at reducing vulnerabilities and providing an adequate level of security for users' data and key information. Users of cloud computing should also assess their own risk tolerance and determine the extent to which they are willing to compromise on information security. Security issues associated with the shared infrastructure and resources of cloud computing are primarily related to the loss of sensitive information, financial crimes, reputational harm, and destruction of resources.

The controls established to counter these issues fall into four major categories: deterrent controls, preventive controls, corrective controls, and detective controls. While each category addresses a different area of information security, together they form a coherent and integrated system for providing uninterrupted services to clients. The information security issues in cloud computing also arise from its service-oriented, shared-resource business model. Each category is elaborated below.

Deterrence-oriented controls are established to reduce the number of vulnerabilities in cloud services and to address deliberate attacks from hackers and other cybercriminals. Deterrence against likely attacks is achieved through updated programs and firewalls maintained at the premises of cloud service providers. Cloud users risk losing valuable data through well-planned security breaches targeting a provider's infrastructure. Attackers exploit the latest technology to penetrate and disable the security mechanisms of cloud service providers (Krutz & Vines, 2010).

Deterrent control measures are described in client security manuals and in the assurances provided through service level agreements (SLAs). These measures are significant because the threat of attack is constant. Threat perceptions and levels must be defined as assessed risks in order to maintain a high level of security. Cybercrimes can also occur through shared systems, with criminals gaining access to stored information by obtaining an account. Cloud service providers must therefore implement adequate identity checks for their clients and enhance monitoring of cloud account activity using multiple techniques.

Krutz et al. (2010) notes that preventive measures are also taken to reduce vulnerabilities in cloud services — vulnerabilities that may arise through violations of security policy. Numerous preventive measures can be taken to protect cloud services from potential threats, including both physical and virtual (network) security violations. Notable preventive controls include applications developed for integration with the systems development life cycle (SDLC) approach. The system restricts users from accessing high-level privileges, granting only the minimum level of access necessary to prevent policy violations (Mather, Kumaraswamy, & Latif, 2009).

According to Mather et al. (2009), significant preventive controls are also implemented through user authentication techniques, access control measures, and account management policies. Browser-handled and endpoint security measures further ensure that preventive attacks are handled effectively to reduce threat levels. The use of anti-virus software, host-based intrusion detection systems (IDS), host firewalls, and virtual private networks (VPNs) are standard policy-driven security measures in cloud computing. Applicable preventive actions for cloud computing security should be documented in a comprehensive list that defines all possible states where controls are required (Ackermann, 2013).

The rapid evolution of cloud computing as a model for reduced infrastructure and lower upfront costs has raised several security concerns. The growth in the number of users has also heightened concerns about data that may be classified as vulnerable within cloud resources. Prior to these developments, cloud computing customers were largely left to manage the risk of data theft as their own decision (ISACA, 2011). However, later developments — including government initiatives to use cloud resources — raised additional concerns.

These developments prompted corrective measures aimed at securing cloud services through the implementation of information and data security improvements. The response from various communities, governments, and cloud service providers has shifted from a reactive to a proactive approach. According to Prodan and Ostermann (2009), the assessment procedures adopted by federal and state governments to perform vulnerability scanning represent a cost-effective method of initiating corrective actions. The systems development life cycle approach is also regarded as significant in the expanding use of corrective measures for cloud computing security.

According to Krutz et al. (2010), detective controls are essential for effective cloud computing security. These controls are designed to discover attempts at security breaches and to activate the appropriate corrective and preventive controls in response. They are associated with intelligent systems capable of interpreting intrusion attempts and function as coordinated intrusion detection systems that can identify violations of security policy, organizational policy, and physical attempts to breach security apparatus.

Detective controls implemented in cloud computing environments primarily include event logging and event correlation. Application vulnerability scanning and monitoring also fall under this category (Mather et al., 2009). These measures represent a preemptive effort to ensure the data and information security of cloud computing services. Cloud resources are further protected through the automatic activation of corrective and preventive measures triggered by detective controls. Learn more about intrusion detection systems and their role in modern network security.

Conclusion

The issues related to the security of cloud computing services also present opportunities to develop solutions to counter those concerns. Numerous research works and academic scholarly literature provide insight and clear directions for enhancing security in cloud computing. These works offer models, frameworks, techniques, and tools for achieving improved security outcomes. Applicability remains a matter of customization, with implications and advantages that vary according to particular use cases and organizational contexts.

References

Ackermann, T. (2013). IT security risk management: Perceived IT security risks in the context of cloud computing. Springer Gabler.

Aluru, S., Bandyopadhyay, S., Catalyurek, U. V., Dubhashi, D., Jones, P. H., Parashar, M., & Schmidt, B. (Eds.). (2011). Contemporary computing: 4th International Conference, IC3 2011, Noida, India, August 8–10, 2011. Proceedings (Vol. 168). Springer.

Buyya, R., Broberg, J., & Goscinski, A. M. (Eds.). (2010). Cloud computing: Principles and paradigms (Vol. 87). John Wiley & Sons.

ISACA. (2011). IT control objectives for cloud computing: Controls and assurance in the cloud. ISACA.

Krutz, R. L., & Vines, R. D. (2010). Cloud security: A comprehensive guide to secure cloud computing. John Wiley & Sons.

Mahmood, Z. (2013). Cloud computing: Methods and practical approaches. Springer.

Mather, T., Kumaraswamy, S., & Latif, S. (2009). Cloud security and privacy: An enterprise perspective on risks and compliance. O'Reilly.

Prodan, R., & Ostermann, S. (2009, October). A survey and taxonomy of infrastructure as a service and web hosting cloud providers. In Grid Computing, 2009 10th IEEE/ACM International Conference on (pp. 17–25). IEEE.

Shread, P. (2012). Get your head in the cloud. TIME Business & Money. Retrieved from

Wang, C., Wang, Q., Ren, K., & Lou, W. (2010, March). Privacy-preserving public auditing for data storage security in cloud computing. In INFOCOM, 2010 Proceedings IEEE (pp. 1–9). IEEE.