{
A Survey on Security Issues in Service
Delivery Models of Cloud Computing
S. Subashini and V. Kavitha (2011)
Ñ Introduction
Ó What is Cloud Computing Ó Pros/Cons of cloud computing Ó Different types of delivery models
Ñ Overview of security issues in delivery models Ñ Security issues in SaaS
Ñ Security issues in PaaS Ñ Security issues in IaaS
Ñ Current security solutions Ñ Conclusion
Ñ What is cloud computing?
Ó The practice of using a network of remote servers
hosted on the internet to store, manage, and process data, rather than a local server or personal computer
Ñ Cloud computing benefits
Ó Massively scalable
Ó Cheaper than non cloud based solutions Ó Less overhead for consumers
Ó Increased resiliency
Ó Real-‐‑time detection of system tampering Ó On-‐‑demand security controls
Ñ Cloud computing drawbacks
Ó Accessibility vulnerabilities Ó Virtualization vulnerabilities Ó Web application vulnerabilities Ó Physical access issues
Ó Privacy and control issues
Ó Identity and credential management
Ó Data verification, tampering, and integrity
Introduction
Ñ SaaS (Software as a Service)
Ó Provider licenses an application to the customer for use as
a service on demand.
Ó Salesforce.com Ó Focus of this paper
Ñ PaaS (Platform as a Service)
Ó Delivery of a computing platform and solution stack as a
service.
Ó GoogleApps
Ñ IaaS (Infrastructure as a Service)
Ó Clients buy resources (servers, software, data center space,
network equipment) as a fully outsource service.
Ó Amazon web service
Ñ SaaS (Software as a Service)
Ó How is your data being stored and secured? Ó System availability and access
Ñ PaaS (Platform as a Service)
Ó Advantages can also be used as potential points
of aZack for hackers
Ñ IaaS (Infrastructure as a Service)
Ó Most IaaS suppliers only provide basic levels of
security, forcing the client to manage the application side security
Overview of Security
Ñ Data security Ñ Network security Ñ Data locality Ñ Data integrity Ñ Data segregation Ñ Data access
Ñ Authentication and authorization Ñ Data confidentiality
Ñ Web application security Ñ Data breaches
Ñ Virtualization vulnerability Ñ Availability
Ñ Backup
Ñ Identity management and sign-‐‑on processes
Ñ Service providers must adopt additional
security checks to ensure data security
Ñ Common issues:
Ó Application vulnerabilities Ó Malicious employees/users
Ñ All data flow over network must be secured to
prevent leakage of sensitive information
Ó Secure Socket Layer (SSL)
Ó Transport Layer Security (TLS)
Ñ Amazon Web Service (S3) approach
Ó End to end encryption
Security Issues in SaaS: Data
and Network Security
Ñ All data flow over network must be secured to
prevent leakage of sensitive information
Ó Secure Socket Layer (SSL)
Ó Transport Layer Security (TLS)
Ñ Amazon Web Service approach
Ó End to end encryption
Ñ Common tests to validate security
Ó Network penetration and packet analysis Ó Session management weaknesses
Ó Insecure SSL trust configuration
Security Issues in SaaS:
Network Security
Ñ Locality
Ó Where is your data being stored? Ó Export issues
Ó Potentially sensitive information Ó Whose jurisdiction does it fall under?
Ñ Integrity
Ó Generally there is a mix of on-‐‑premise and SaaS
applications
Ó One of the biggest challenges is transaction
management
Ó No current mature standard for handling this issue Ó Different levels of availability and SLA (service-‐‑
level agreement)
Security Issues in SaaS: Data
Locality and Integrity
Ñ Generally there is a mix of on-‐‑premise and SaaS
applications
Ñ One of the biggest challenges is transaction
management
Ñ No current mature standard for handling this
issue
Ñ Different levels of availability and SLA (service-‐‑
level agreement)
Security Issues in SaaS:
Data Integrity
Ñ Segregation
Ó Multiple users data will reside in same physical location Ó Intrusion can occur from:
Ô Hacking through loopholes in the application Ô Injecting client code into SaaS system
Ó Clear boundary for data is a MUST at both application
and physical levels
Ñ Access
Ó In a “normal” environment, not all employees have the
same level of access to data on their companies network.
Ó SaaS providers must allow for the same functionality as
well as providing organizational boundaries.
Ñ Authentication
Ó Who is managing it?
Ó Potential increase in overhead
Security Issues in SaaS: Data
Ñ In a “normal” environment, not all employees
have the same level of access to data on their companies network.
Ñ SaaS providers must allow for the same
functionality as well as providing organizational boundaries.
Security Issues in SaaS:
Data Access
Ñ In a “normal” environment, companies store
employee information in some type of
Lightweight Directory Access Protocol (LDAP) or Active Directory (AD)
Ñ These accounts must be mirrored in SaaS
providers servers
Ñ Causes additional overhead for customer Ñ Utilizing more SaaS products increases
overhead greatly
Security Issues in SaaS:
Ñ Many types of cloud computing services exist
Ó Data storage, video hosting, tax preparation,
personal health record, etc.
Ñ Privacy and confidentiality risks vary significantly
depending on terms of service
Ñ Disclosure issues Ñ Legal issues
Ñ Protections exist for emails and other computer
records, but it is difficult to apply these to cloud computing
Ó Electronic Communications Privacy Act of 1986
(ECPA)
Ó Why is it difficult to apply these protections?
Security Issues in SaaS:
Data Confidentiality
Ñ Why is it difficult to apply ECPA to cloud
computing?
Ó Characterization of activity as communication or
storage is complicated
Ó Is the information content or non-‐‑content? Ó Cloud provider terms of service
Ó User granted consent
Ó Identity of service provider
Security Issues in SaaS:
Data Confidentiality
Ñ Customers access SaaS software via the web
Ñ Security holes in the web applications used by SaaS
providers create vulnerabilities
Ñ Traditional network security solutions do not
adequately address problem
Ñ Verizon Business 2008 Data Breach Investigation
Report
Ó 59% of breaches involved hacking Ô Application/service layer – 39% Ô OS/platform layer – 23%
Ô Exploit known vulnerability – 18% Ô Exploit unknown vulnerability – 5% Ô Use of back door – 15%
Security Issues in SaaS:
Ñ If web application in use by SaaS provider is
vulnerable to a type of aZack, all of the data behind the application is at risk
Ñ Top risk factors faced by web applications
Ó Injection flaws like SQL, OS, and LDAP Ó Cross-‐‑Site scripting
Ó Broken authentication and session management Ó Insecure direct object references
Ó Cross-‐‑site request forgery Ó Security misconfiguration
Security Issues in SaaS:
Ñ Data breaches in the cloud can have a large
impact
Ñ An aZack on a cloud environment risks the
data from all users being affected
Ñ Verizon Business 2008 Data Breach
Investigation Report
Ô External criminals pose greatest threat (73%) but
achieve least impact
Ô Insiders pose the least threat (18%) but achieve the
greatest impact
Ô Partners are middle of the pack in both threat and
impact
Security Issues in SaaS:
Data Breaches
Ñ Virtualization
Ó Virtualization is one of the main components of the cloud Ó Keeping instances running on the same machine isolated
is a major task, currently not met completely.
Ó Administrators must keep tight control on host and guest
operating systems
Ô Malicious scripts run by users can exploit holes in
virtualization
Ñ Backup
Ó SaaS vendors must ensure all sensitive data is regularly
backed up for recovery purposes.
Ó Encryption is not guaranteed Ó Problems include
Ô Insecure storage
Ô Insecure configuration
Security Issues in SaaS:
Ñ SaaS vendors must be able to guarantee service
around the clock
Ñ Resiliency to hardware and software failures as
well as DDoS aZacks need to be built from ground up
Ñ Geographic diversity is important
Security Issues in SaaS:
Availability
Security Issues in SaaS:
Identity Management
Ñ Any security below the application level (host
and network intrusion prevention, data
segregation between applications) is still in the scope of the service provider
Ñ Tends to be more extensible but less customer-‐‑
ready features (including security features and capabilities)
Ñ Likely areas of aZack
Ó Infrastructure
Ó Machine-‐‑to-‐‑machine Service Oriented
Architecture (SOA) applications
Ñ Developer has beZer control over security Ñ Virtualization causes issues
Ó Retaining control over data regardless of
physical location Ñ Physical security
Ñ Security responsibilities vary greatly
depending on service provider
Ó Amazon (EC2) as an example
Security Issues in IaaS
Infrastructure
Management Infrastructure Ownership Infrastructure Location Access and Consumption
Public Cloud Third party
provider Third-‐‑Party provider Off-‐‑premise Untrusted Private/ Community Cloud Organization or third-‐‑party provider Organization or third-‐‑party provider On-‐‑premise or
off premise Trusted
Hybrid Cloud Both
organization and third party provider
Both Both Trusted and
Ñ Cloud Security Alliance
Ó Working towards beZer standards and best
practices
Ñ Open Web Application Security Project
Ó Maintains an up to date list of top vulnerabilities
Ñ Best approach to security is developing a
framework that has a tough security architecture
Ñ Resource isolation
Ñ Using encrypted protocols
Ñ Cloud-‐‑based computing systems have some extreme
advantages over traditional systems, but have many practical problems
Ñ Outstanding issues include
Ó Service level agreement discrepancies Ó Security and privacy
Ó Power efficiency
Ñ Until proper security procedures are in place, many
customers will stay away from cloud-‐‑based solutions
Ñ Integrated security models targeting different levels of
security of data is an important step in the process
Ñ Requirement based (customizable) security.
Ñ With the increase of cloud-‐‑based computing, security
issues are becoming increasingly important to fix
Thanks! Questions/Comments?
Anthony Postiglione Email: [email protected]
[SK2011] S. Subashini and V. Kavitha, “A survey on security issues in service delivery models of cloud computing,” Journal of Network and Computer
Applications, Volume 34, Issue 1, pp. 1-‐‑11, January 2011.
