Many individuals have resulted to storing their information in the cloud through online storage services to protect it from natural and human caused disasters. Cloud storage is considered to be the best method of protecting information from physical damage. It provides the ability to store large amount of unstructured or structured data in a way that promises high levels of performance, scalability and availability. Besides protection, cloud storage also offer convenient accessibility to the information stored. One is able to access his/her important information no matter where he is provided there is a network connection. You can access and edit your information by the use of a smartphone, iPhone or a personal computer from wherever you are.
Cloud computing has promised a more cost effective and efficient way of making use of the available technological resources (software applications and IT infrastructure). It is possible to instantly access large amount of data stored securely on remote servers at a sound cost. It allows consumers to use applications when they require them, rather than purchasing expensive software.
Just like any other form of technology such as traditional data storage methods, cloud computing has its disadvantages, the major ones being the risks associated with it. Interfaces to data storage systems can be easily exploited by attackers to gain unauthorized access if not used correctly. Introduction of data and computing services in a cloud service provider circumstance put the customer’s information at risk because it is exposed to a new set of vulnerabilities and threats. Although cloud computing is faced by numerous threats, all is not lost because modern development platforms are able to offer mitigations that can safely use cloud services (1). There are several ways of reducing the opportunity for attacks and cloud storage service providers are making use of them to reduce risks associated with cloud storage. Cloud storage service providers should ensure that all the applications they offer are well protected and cannot allow unauthorized access by other users or applications.
The main goal of this paper is to address the issue of security concerns in cloud storage. To achieve this, the paper will discuss threats of cloud storage as well as security measures which are put in place to reduce the impacts of these threats.
Threats to Cloud and Ways of Reducing Them
The cloud is generally faced by serious threats. As users of cloud computing we must accept the existence of these threats so that we can formulate ways of controlling them. Individuals and businesses have no otherwise but to trust their cloud service provider to uphold sufficient security practices. This indicates that cloud customers are usually not aware whether service provider’s software and servers are under secure connections. This section will discuss the common threats to cloud and ways of reducing their impact.
a) Insecure interfaces and APIs
Cloud customers use a number of software interfaces or APIs exposed to them by their providers as a way of managing and interacting with services offered to them. These interfaces are used to perform management, monitoring, orchestration and provisioning. Therefore, the availability of cloud services as well as their security depends on the security of these APIs. These interfaces are supposed to be designed in a way that they do not increase the risks of the cloud being attacked. Service providers should utilize encryption, access control and authentication services as well as activity monitoring in order elude any malicious or accidental attempts to attack the cloud. Examples of risks associated with insecure interfaces and APIs include improper authorizations or inflexible access controls, API dependencies or unknown service, transmission of content or clear-text authentication, and reusable tokens/passwords or anonymous access (3).
To reduce chances of insecure interfaces and APIs, strong access control and authentication should be implemented together with encrypted transmission. Cloud customers are also encouraged to analyze the security model of cloud service provider interfaces in order to avoid such risks. It is also recommended to understand the dependency chain connected with the API (3). Cloud service providers that rely on insecure interfaces and APIs can easily destroy their reputation and they constantly be faced by security issues related to integrity, confidentiality, accountability and availability.
b) Malicious insiders
Malicious insider within any organization can be very dangerous because they may be exposed to confidential and proprietary information during the course of their operations, which they might use to cause damage to the organization. This threat is even bigger for cloud customers since they are normally under a single management domain, and they do not understand the operations of their service providers (5). In most cases, customers are not aware of how the service providers hire their employees, how they grant them access to virtual and physical assets, how thy monitor them, or how they analyze and report on policy compliance (3). Such a situation may attract individual with bad intentions because they can easily access the cloud data with ease as well as misusing it without being detected. Therefore, it is advisable for cloud customers to understand what service providers are doing to protect malicious insider threat.
To reduce chances of being attacked by a malicious insider, cloud customers should insist on human resource requirements as being part of the legal contract. Transparency, breach notification and compliance reporting are the key issues to a secure cloud service offering. Security breach notification processes should be determined within the cloud service offering. Another security measure to reduce this threat is the enforcement of a strict supply chain management as well as conducting an extensive supplier assessment (2).
c) Data loss or leakage
Data can be compromised in many ways. For instance, altering or deleting information without any backup of the original copy. Unauthorized individuals should not be allowed to have access to vital information because they are likely to compromise it depending on their intentions. This threat is growing rapidly in the cloud environment due to the fact that many individuals are having access to unprotected cloud data through the internet (2). Loss of data or leakage can seriously harm an organization depending on the vitality of the data. Examples of practices which could lead to data loss or leakage include inconsistent use of software and encryption keys; authorization, insufficient authentication and audit controls; disaster recovery; risk of associations; operational failures; jurisdiction and political issues; operational failures; data center reliability; and data remanence and persistence challenges.
There are several ways of preventing data loss or leakage such as encrypting and protecting integrity of data being transmitted; implementing solid key generation, destruction, and management and storage practices; implementing solid API access control; through contractual terms demands service providers wipe persistent data before releasing it to the pool; and contractual specification regarding provider retention and backup strategies (3).
d) Account or service hijacking
Account or service hijacking is an old attack method which is still applied in cloud computing. Attack methods which are generally used in account or service hijacking include fraud, phishing and exploitation of software vulnerabilities (5). People often reuse their passwords and credentials, thus, increasing the potential of these attacks. Using stolen credentials to hijack an account or a service is one of the threats which have been used for a long time. Attackers have the capability of accessing critical areas of a given cloud computing services with stolen credentials, and this allow them to compromise the integrity, availability and confidentiality of such services.
This threat is serious in cloud computing because if attackers have access to someone’s credentials, they can easily manipulate data, redirect your clients to illegitimate sites, eavesdrop on someone’s transactions and activities, and return falsified information. This is a clear indication that someone’s account or service if not well taken care of can easily become a through way for the attacker. From your account or service, an attack can have the capability of destroying your reputation as well as launching subsequent attacks. Hence, it is advisable to take care of your credentials to avoid such mistakes.
To reduce the chances of account or service hijacking, it is necessary to prohibit sharing of account credentials between services and users. Strong authentication techniques should be applied where possible to reduce any breach of credentials. Organizations should try to identify unauthorized activities by employing proactive monitoring techniques. Cloud customers should be in a position to understand the provider security policies and Service Level Agreements (SLAs) (3).
e) Technical issues
This is a threat which is generally overlooked. Cloud computing is also associated with physical risks just like your personal hard drive (4). Although we consider cloud storage to be the best information protection method, cloud service providers can also experience hard drive failure or be faced by a natural disaster which might lead to loss of enormous information. As an individual or an organization you should always try to keep a local backup of files that are critical to you as you do not know what might happen in future. If it is not possible to keep local backups of your critical files, you should contact your cloud service provider to find out the mechanisms they apply to reduce physical risks to your critical information. This threat should not be overlooked because it can be a double loss if the cloud service provider loses your critical information that you do not have a backup (4).
f) Shared technology issues
Infrastructure as a service (IaaS) providers offer their services by sharing infrastructure. The unfortunate thing is that the components that make up the infrastructure were not designed to support this. All the shared elements were not designed for strong compartmentalization (3). As a result of this, attackers have the capability of impacting the operations of cloud consumers as well as gaining access to unauthorized data. Therefore, it is recommended to employ strong compartmentalization so that individual customers cannot impact the operations of other users running on the same cloud service provider. This will ensure that cloud customers do not have access to any other user’s residual or actual data, network traffic and so on.
To reduce risks associated with shared technologies, cloud service providers should be constantly monitoring the cloud environment to ensure that there are no unauthorized changes or activities. They should also ensure there is strong access control and authentication for administrative access and operations. Configuration audits and vulnerability scanning should be conducted now and then to elude any chances of this threat. Implementing security best practices for configuration or installation is highly recommended to remedy the problem of shared technology.
g) Abuse and nefarious use of cloud computing
Anyone have the ability to access the cloud services since the registration process to these services is not restricted. Attackers take advantage of this situation to conduct their malicious activities with relative impunity. Spammers, hackers and other criminals are targeting the cloud computing providers because their registration processes facilitate anonymity, and providers cannot detect fraud easily (1). Attackers are enjoying this situation since they can register with any cloud service provider and attack their intended organizations without being detected.
To reduce the abuse of cloud computing services, service providers have a key role to play. They should ensure that the initial validation and registration processes are stricter (3). Cloud customers should continuously monitor the public blacklists so that they can block the blacklisted networks. Service providers should also monitor the public blacklists so that they can block the blacklisted networks which can easily damage their customers’ data. Service providers are also encouraged to perform an extensive examination of the customer network traffic to ensure that they are no intruders within the traffic. Credit card fraud monitoring and coordination should also be enhanced to deny potential attackers the ability to register with a cloud service provider. When these measures are put in place, it will be possible to detect attackers and they will also have hard time while trying to perform their malicious activities in cloud computing.
Cloud services are increasingly gaining popularity and almost every other enterprise is using them. This has shifted the attention of attackers and they are focusing on the cloud. Numerous threats to the cloud have been identified and ways of minimizing them are still being evaluated and used where possible. Some of the threats which have been identified as discussed above include insecure interfaces and APIs, malicious insiders, data loss or leakage, account or service hijacking, technical issues, shared technology issues, and abuse and nefarious use of cloud computing. Different measures can be implemented to count these threats and all the possible ways of eliminating these threats that have been currently identified are well analyzed in this paper. Cloud computing is a new technology which has numerous benefits to individuals and business enterprises. Therefore, cloud security should be enhanced to ensure that we are venturing into a secure technology.