2017 IEEE 3rd International Conference on Collaboration and Internet Computing

Security failure trends of cloud computing

Zachariah Pabi Gariba John Andrew Van Der Poll
School of Computing Graduate School of Business Leadership
University of South Africa University of South Africa
Florida Park, Johannesburg, South Africa Midrand, South Africa
[email protected] [email protected]

Abstract- Cloud computing technology is causing a shift virtualised platform, different user applications are
in Information Communication Technology usage by managed by their own operating systems which run on the
transforming the approaches businesses employ information same hardware, independent of the host operating system.
technology services. This benefits computing usage by
Virtualisation can is employed for both hardware and
allowing users to share hardware resources via multiplexing
of virtual machines which are the basic units of cloud software in a functional and layered manner [3].
computing. Small and new businesses which often lack good
financial standing but desire to use the cloud, need not own For small and newly created business organisations that
these resources, but only pay for their use at a reduced price. lack strong financial strength for establishing in-house data
This alleviates the cost of technological maintenance and
operation. However, the services provided by third-party centres [4], cloud computing could be a cost effective
cloud service providers involve inherent security threats. The technological solution for them. They may decide to
relocation of corporate resources to an external transfer part of their services, data and infrastructure to a
administrative jurisdiction escalates security concerns such as cloud computing service provider for the aforementioned
trust, assurance and transparency. There may be devastating
effects to clients, should their financial transactions and benefits, namely, performance, flexibility, and
corporate information be compromised as a result of a service opportunities. This computing paradigm is causing a shift
provider’s security challenges. This research employs a [5] in technology which may well transform the approaches
quantitative case study to analyse the security challenges of
popular cloud computing services existing within the past four
on how businesses employ information technology
years. An overview of security vulnerabilities in cloud services. Clients deploying cloud will have to only rent and
computing is presented; a preliminary cloud security pay for its usage at reduced cost. This alleviates the burden
framework is developed and the role of computing formalisms of software maintenance, operation and support on the part
is investigated.
of the client.
Keywords- cloud computing, formal methods,
information security, trust, security failure, privacy, cloud NIST considers cloud computing as a threefold model
security modelling comprising of service models, deployment models and
essential characteristics. There are four cloud deployment
I. INTRODUCTION models outlined by NIST, comprising of private, public,
Arguably the accepted definition for cloud computing is hybrid and community models [6] as indicated in Fig. 1. In
that given by the National Institute of Standards and addition to these, there are three service models being
Technology (NIST) [1] which defines cloud computing as Software as a Service (SaaS), Platform as a Service (PaaS)
“ICT sourcing and delivery model for enabling convenient, and Infrastructure as a Service (IaaS). In the public model,
on-demand network access to a shared pool of configurable the physical infrastructures are generally managed by a
computing resources that can be rapidly provisioned and service provider which is located off-site in the control of
released with minimal management effort or service the service provider [7]. In private, the physical
provider interaction”. The basic unit of cloud computing infrastructure is controlled by a service provider with an
comprises a virtual machine (VM) [2] which is installed on extension lead by management and security control policies
a host to provide various internet applications. The VM controlled by the organisation. In a community deployment
primary function is to improve on resource sharing among model, the physical infrastructures are controlled by
multiple users and improve computer performance in terms numerous organisations that have mutual interests for
of resource utilisation and application flexibility. Given a example mission, policy, security requirements and

0-7695-6303-1/17/31.00 ©2017 IEEE 247

DOI 10.1109/CIC.2017.00041
compliance considerations. However, the hybrid involves challenges and as a result be unable to deliver, then the
two or more of these [8]. The essential features comprise of business may suffer a significant setback.
On-demand Self-Service, Broad Network Access, Resource
Pooling, Rapid Elasticity and Measured Service. The objective of this research is to investigate and
synthesise security failures of some popular cloud
The main benefit of IaaS is that it provides granular control computing services and their negative impact to business.
for choosing the core components for the infrastructure. In The available literature to inform our study indicates little
PaaS there are core hosting OSs and voluntary building scholarly work on the annual analyses of security failure
block services for running your clients applications. Its rates of present cloud computing services.
benefits are that the client needs not be concerned about the
running updates and hardware upgrades. For SaaS, clients II. RESEARCH QUESTIONS
utilise only the applications that are needed in their Subsequently, the research questions (RQs) for our work
business. The key benefit of SaaS is that it incurs little or are:
no upfront investment on software licensing. x RQ1: What are the cloud security aspects
underlying the failure of cloud services?
x RQ2: How may the said cloud security challenges
be addressed?
The layout of the paper is as follows: Section III presents a
brief overview of the literature on cloud computing and
information security issues applicable to the cloud. Section
IV illustrates our modelling of available security solution
for cloud usage. Section V presents the research method
which we employed in our study whilst Section VI gives
the result of the security incidents obtained from popular
cloud services. Section VII presents the discussion on the
results obtained, Section VIII gives formalizing our
security framework and Section IX is the conclusions and
future work in this area.

III. LITERATURE REVIEW

The ISO [13] defines information security as the
safeguarding of confidentiality, integrity and availability
(CIA) of information. Also, [14] indicates that ensuring
confidentiality, integrity and availability has been the
industry standard for employing information security.
However, the US National Infrastructure Protection Center
supplemented CIA with authentication and non-repudiation
Fig. 1: Utilising cloud computing models as additional requirements to the CIA. Cloud computing
security frameworks available in the literature [5], [10],
Security is a critical issue for a cloud system [5], [7], [9], [15], [18] focus on preventing unauthorised users from
[10], [11] and [12] because the various models are mostly accessing cloud resources. However it should be noted that
located off-site whilst providing services to the clients. A CSPs (Cloud Service Providers) are also a source of attacks
company which depends on cloud computing for its and failures.
transactions implies its vital documents and data will be
managed by a third party service provider at an unknown The security elements elicited above, namely,
location. Should the service provider experience security confidentiality, integrity, authentication, non-repudiation
and service reliability [14], [19] and [20], have been

248
employed to form information security elements and ought framework for understanding and communicating the
to be adhered to consistently in IS (Information Security). components of a cloud has been illustrated in [1]. The
These five (5) aspects may be categorised into principal actors in this framework include Service
cryptographic and non-cryptographic approaches of Consumer, Service Provider, Broker, Auditor and Cloud
security. The cryptographic group consist of the first four Carrier.
elements whilst the non-cryptographic category is made up
of the last element, namely, service reliability. The various The study in [10] proposes a security as a service (SECaaS)
approaches for addressing each of these security aspects are model aimed at allowing users control over their cloud
given in TABLE I. computing security. The principal element of its
architecture is the security manager which allows
Cloud computing being a relatively recent computing subscribers to select their needed security measures.
paradigm introduces new security vulnerabilities and risk Limitations of such frameworks are potential
into a computing system. Conventional security communication overhead between the cloud-hosting
vulnerabilities are also inherited by cloud computing, subscribers’ data and those presenting security services.
however, the impact of these are arguably less than the new
security issues introduced by cloud computing. Some of A cloud adoption assessment model as in [32] assists
these security aspects with respect to the implementation of organisations in accepting and incorporating the cloud into
cloud security have been researched in [15] and [21] – [26]. business organisations’ information technology, defines
Furthermore, numerous studies, e.g. [12], [16] and [27] – new capabilities, improves on organisational readiness and
[29] have been conducted on security variability of cloud provides strategies for successful implementation. The
computing with respect to the conventional information research reported on in this paper uses systematic literature
security issues. reviews [33] and case studies to evaluate model
effectiveness.
A survey by these authors [30] on 244 IT directors on cloud
services indicates that security is a contentious challenge as The importance of cloud computing to business is vast and
indicated by 74.6% of the respondents. Also, a study on has been motivated in Section I. However, cloud security
Amazon Web Service security [17] indicated security ought elements, combined with conventional computing security
to be the major component of the cloud rather than aspects pose major risks. Our literature survey indicated
auxiliary operations. Extensive surveys on cloud security there are numerous works available on cloud-unique
aspects like risks, threats and vulnerabilities are illustrated security features and solutions which we have synthesised
in [12], [15], [26] and [30]. Absence of security constraints in TABLE I. However, the researchers found little
in cloud Service Level Agreements (SLAs) [31] may well information on how efficient these unique features have
cause loss of trust. The NIST Reference Architecture (RA) affected cloud computing security in present times

TABLE I
COMPARING DIFFERENT CLOUD RELATING SECURITY SOLUTIONS

Security solution Authors Components

Ajigini, van der Poll and

Security challenge Developed a model for security challenges during the migration of sensitive information
Kroeze
model from a proprietary system to an open source system.
[35]

It illustrates an extensible procedure for constructing compliance relating to SLA security

controls.
Hale and Gamble [36]
Service level
Agreement (SLA) Built a framework known as SecAgreement which allows for security metrics to be
Hale and Gamble [37]
expressed in terms of service descriptions and objectives. SecAgreement also allows for
CSPs to embed security in their SLAs.

249
 Developed a cloud security overlay network, which provides for integrated security
Privacy and integrity Salah et al. [38] services. They considered popular security software, intrusion detection systems, distributed
denial-of-service prevention and security management.

Suggested a scheme which inherits flexibility and fine-grained access control in supporting
Access control Wan, June, and Deng [39]
compound attributes of attribute-set-based encryption.

Xia, Liu, Chen and Zang Suggested an approach for striking a balance between security and functionality in cloud
VM migration
[40] computing. This allows users to audit their logs to check for malicious rollbacks in the VM.

Wang, Wu, Grace and Presented HyperLock, a methodical approach to strictly segregate privileged, but potentially
Hypervisor
Jiang [41] vulnerable, hosted hypervisors from a compromising hosting operating system.

Indicated the constituents and sources of an information security policy for organisations
Security policy Höne and Eloff [43] which is a vital document. These are mostly from various international security standards
which served as a guild.

Presented a framework for establishing, implementing, monitoring, operating, reviewing,

ISO/IEC [19] improving and maintaining an Information Security Management System.

International standards Developed an information security governance framework which can be used by
organisations to ensure they are governing information security in a holistic manner, thereby
Da Veiga and Eloff [44] mitigating risk.

Highlighted on availability issues and how cloud computing could be made more secure and
Hassam, Kamboh and
Availability available. The factors which affect availability include migration, software failure, hardware
Azum [45]
error and human error.

The above discussion together with the information in In the SLA stage, aspects relating to the drawing up of
TABLE I present an answer to our RQ1 above. compliances to the security controls are determined. Also,
security metrics and agreements on managing corporate
In the following section we suggest a preliminary data are signed between the CSP and the organisation. The
framework to facilitate security for cloud computing. risk management stage involves the identification of the
IV. TOWARDS A CLOUD risks in cloud usage, categorising of risks and mitigation
SECURITY FRAMEWORK processes of each identified risk. Sub frameworks to be
Our framework is illustrated in Fig. 2 and follows a used for the risk analyses are determined.
rudimentary structure proposed in [35]. The content is
synthesised from the information in TABLE I as well as the Data confidentiality addresses the encryption mechanism to
CIA grouping, augmented by authentication and non- be employed for the data by the CSP, whilst the availability
phase aims to ensure cloud users always have access to
repudiation (refer Section III). During the security policy
phase, the policies and procedures on the security to be their service – the cloud service should be available
adopted for cloud are developed by the top hierarchy. The especially for corporates. The authentication phase involves
data and information stage involves the categorisation of the systems that are used to identify the users. Such
corporate data using well-established data classification authentication may be biometric systems and audio
identification. The access control regulates authorised
frameworks. The privacy phase involves trust on how this
classified data would be managed. Naturally, this will users, based on privileges which are granted to certain data
include the Cloud Service Provider (CSP) who is a third categories (refer the use of Formal Methods in Section VIII
party authorised to have access to the data. below).

250
 tick (9) is used to indicate a CSP had an incident within a
specific year. Multiples of it within a year correspond with
the quantity of the incident noted. The listing of the
months under the date is in a sequential order of occurrence
of attack incidents with corresponding CSP.

In the following section we discuss the challenges

experienced by 12 CSPs during the period 2013 – 2016.

VI. RESULTS
In 2013, studies identified four different and major cloud
computing brands whose systems experienced security
attacks. These are Amazon AWS Service, Microsoft
Window Azure, Adobe (twice) and Target which were
attacked in January, February, October and November
respectively. Adobe, had attacks twice in that year with a
disclosure of customers’ records and privacy issues which
affected 152 million clients and 38 million accounts [46].
Amazon Web Service had a Denial of Service (DoS) attack
which resulted in interruptions and a destruction of service.
Fig. 2: Modelling security aspects for cloud usage For Microsoft Window Azure, there was a threat of
removal of service and disclosure of information. We
At this point Fig. 2 above gives a partial answer to our postulate that strong authentication and data confidentiality
RQ2. could have prevented this attack. However, for Target,
there was disclosure, and an identity and privacy theft
Following the security aspects mentioned before and the threat which affected 70 million credit cards [47]. Strong
development of a framework from these, we next elicit privacy, strong authentication and good data confidentiality
actual cloud security challenges during the past couple of might well have resolved these.
years and quantify the frequency and occurrences of these.
In 2014 the CSPs identified were Dropbox, Home depot,
V. METHODS Amazon AWS service, Apple iCloud and Microsoft. The
In this study we employed an inductive approach with security breaches were noted in January, April, June,
respect to our research questions. A quantitative choice of September and November respectively. Dropbox had a
data collection was done in case studies through collecting web server error which resulted in a global outage. Home
information from scholarly literature and websites. A cross- Depot had a malware attack which affected 56 million
sectional time horizon was embarked on to compare credit cards [48], which is possibly caused by threats of
security failures, financial implications and recommended destruction, corruption and disclosure. In addition,
counter measures among various service providers. The Amazon AWS had a challenge with code space which
sample size was 12 CSPs among the population of cloud compromised its business. The study suggested destruction,
service providers. Our survey utilises a four year period corruption and disclosure of information as the threats
beginning from the year 2013 to 2016. This is viewed as which affected it. For Apple iCloud, hackers accessed
sufficient to make valid conclusions and inductive customer photos which breached on privacy and data
comparisons. confidentiality leading to a disclosure of clients’ pictures.
However, for Microsoft Azure, their website crashed
We enumerated 12 CSPs against their respective dates of possibly caused by worms and viruses, compromising
security incidents with the impact on both clients and availability and resulting in destruction and interruption. A
business in TABLE II and recommended possible identified strong authentication mechanism might well have
threats also against counter measures. The date consists of prevented this attack.
the months and their respective years of the occurrence. A

251
In 2015, Google IaaS, Apple’s iCloud and Verizon cloud interruption. For Twitter, faulty codes were uploaded
were identified. To be specific, the date in which these causing 8 hours of outages, compromising access control
security breaches took place were February and March for and limiting availability. Also, for Microsoft Office 365,
Google, March and May for Apple’s iCloud and lastly only damage to cloud resources resulted in Europeans being
in May for Verizon. It should be noted that Google IaaS unable to access their emails through their phones, due to
and Apple’s iCloud recorded security breaches twice the threat of destruction and interruption which would have
during that particular year. With respect to each company’s been avoided by a good availability and risk management.
cloud systems, for Google, most zones were disabled Furthermore, Apple had general outages which made it
because outbound data got lost. The entire Google attack hard for customers to access various services. This might
could have been addressed by improved availability. The have had threats of destruction and interruption which
iCloud attack was due to a DNS error causing outage for 12 could have been avoided by improved availability and risk
hours [49]. However, Verizon’s challenges were caused by management. However for Symantec cloud, management
system maintenance issues, causing outages by interruption of clients’ security was disrupted for 24 hours making it
to clients. Arguably, a good risk assessment could have difficult to send emails and administer web security
prevented this. services [50]. A good availability mechanism could
possibly have prevented these threats of destruction and
In 2016, Verizon, Twitter, Microsoft office 365, Symantec interruption.
cloud and Apple iCloud were identified. The security
failures occurred in January, April and June. Verizon had a The above discussions are synthesised in TABLE II.
network connection error which made the system
unavailable, possibly caused by threat of destruction and

TABLE II
CLOUD COMPUTING SECURITY FAILURE RATE ISSUES

Date
Service
No. Month 2013 2014 2015 2016 Effects Threats Counter measures
provider

• Identity theft • Data confidentiality

38 million accounts
1 Adobe Oct √√ • Removal • Privacy
affected
• Disclosure • Authentication

• Worms & viruses

$5 million revenue • Availability
Jan., • Removal
2 Amazon AWS √ √ loss • Authentication
Feb. • Corruption
4 hours global outage • Data confidentiality
• Interruption

Sept.,
• Identity theft • Availability
Mar., Nude photo surfaced
3 Apple iCloud √ √√ √ • Disclosure • Data confidentiality
May, Global outages
• Interruption • Privacy
Jun.

• Interruption • Risk management

4 Dropbox Jan. √ Global outages
• Destruction • Availability

• Worms & viruses

Feb., • Availability
5 Google-IaaS √√ 45mins outages • Corruption
Mar • Risk management
• Interruption

56 million emails • Destruction • Access control

6 Home deport Apr. √
compromised • Removal • Data confidentiality

252
 Date
Service
No. Month 2013 2014 2015 2016 Effects Threats Counter measures
provider

Microsoft Feb. Global denial of • Destruction • Data confidentiality

7 √ √
Azure Nov. access • Worms & viruses • Risk management

Microsoft office Mobile email access • Destruction • Availability

8 Jan. √
365 was denied • Interruption • Risk management

Web security and • Destruction

9 Symantec cloud Apr. √ • Availability
email affected • Interruption

70 million credit cards • Identity theft • Privacy

10 Target Nov. √
compromised • Disclosure • Data confidentiality

• Corruption • Availability
11 Twitter Jan. √ 8 hours global outage
• Destruction • Access control

May, Service provider cut • Availability

12 Verizon cloud √ √ • Interruption
Jan. service • Risk management

VII. DISCUSSION
We produce TABLE III as a summary of the security and Google-IaaS. There was none which experienced three
incidents categorised into 4 groups, occurrences 1 to 4. This attacks representing 0.0%. However, Apple iCloud
gives a general overview of the security for the entire years representing 9.1% had four attacks. This is the only cloud
and a cross tabulation of service providers against attacks. service provider which had the largest security attacks within
Category 1 represents one security incident, category 2 the period of consideration for this research. The total count
represents two security incidents, category 3 represents three is 11 which indicate that in reality 11 cloud computing
security incidents and category 4 represents four security service providers experienced attacks.
incidents. The columns within the occurrence depict the
grouping of cloud services, according to how often these Further quantifying the above by multiplying the count
occurred within the four year period. Also, the count row in against the occurrences and summing up gives a total of
the cloud service provider section of the table indicates the twenty (20) cloud computing security attacks for the period of
number of service providers for a category. Furthermore, the study. Subsequently, the total number of cloud computing
percentage (%) of the total row indicates the percentage of attacks is obtained by:
each category in comparison to the total. A graphical view is
indicated in Fig 3 which is a bar chart on the count of ( ∗ )
occurrences of the security attacks.
TABLE III
As per TABLE III we note from the count categories, six A CROSS TABULATION OF FAILURE RATE VS COUNT
cloud computing service providers each had an attack within
Failure rate
the four years of the study. This represents the largest number Total
of service providers in a category, in this case representing 1 2 3 4
54.6%. In real terms the service providers which fall within 6 4 0 1 11
Count
this category are Symantec cloud, Target, Twitter, Dropbox,
Home depot and Microsoft office 365. Also, four service % of
54.6 36.4 0.0 9.1 100.0
providers had attacks twice within the period of Total
consideration. This is the second largest group of providers
representing 36.4% of the entire sample. TABLE II above
indicates that these companies are Adobe, Verizon, Amazon

253
 User(x): x is a user.
7
6 Use(x, y): x uses y for personal purposes.

5 Naturally, formulae [1] and [2] above are not equivalent, and
4 the question arises which of these are to be preferred by a
Failure rate policy developer. It turns out (using e.g. the OTTER theorem
3
Count prover [53]) that [1] → [2], but not the other way round. In
2 [1] any or all users are prohibited from using any or all
1 proprietary information for personal purposes. In [2], variable
0 y is inside the scope of x, and therefore becomes a function of
1 2 3 4 x. The nett effect is that certain users may not use company
information for personal purposes, but a user who is a top-
Fig. 3: Failure rate against count level executive may indeed be allowed to use company
information for personal purposes. These scenarios may or
In addition to putting in place a framework like Fig. 2 above
may not be allowed, depending on company security policies.
to facilitate cloud security, one may as a next step tidy up
some of the security policies, access control, data privacy, This example illustrates important aspects around data
etc. This is addressed in the following section. privacy, confidentially and access control as prescribed by the
relevant security policies of a company. These attributes are
VIII. FORMALISING CLOUD
embedded in Fig 3, developed for cloud security and policy
SECURITY ASPECTS
developers may decide to formalise critical aspects of a cloud
The use of Formal Methods (FMs) involving discrete
security policy to remove (at least some) ambiguity in the
mathematics and logic has often been proposed as a software
said policies.
methodology to construct provably correct or at least highly
dependable software. To this end, numerous formal The above presentations together with Fig. 3 give a more
specification languages have been developed over time to comprehensive answer to our RQ2.
facilitate the construction of correct software. Examples of
such languages are Z [51] and CafeOBJ [52] to name but a IX. CONCLUSION
few. In this work, we surveyed a number of cloud security aspects
and constructed a framework for addressing some of the
An example on how FMs may assist information security cloud security concerns. Our framework is illustrated in Fig 2
may be in order. and its content was synthesised from the information in
TABLE I as well as the CIA grouping, augmented by
Example 1
authentication and non-repudiation.
Consider a security policy document containing the following
requirement: We also surveyed the available literature to identify the major
cloud security attacks incidents during 2013 – 2016. The
x Users shall not use proprietary information for personal rationale for considering these years is to enable us to make
purposes. appropriate conclusions on the utilisation of cloud and its
security drawbacks. Furthermore, we have been able to
To avoid any ambiguity, a policy writer may opt for categorise attacks per year as in TABLE II. Service availability
formalising the above, potentially ambiguous, natural was identified as the primary security mechanism which is
language statement. At least two (2) formulations come to the affecting cloud computing security. Furthermore, twenty (20)
fore: security attacks on cloud computing within a four year period
ought to be a concern for the industry, with Apple’s iCloud
[1] (x) (y) ( User(x)šProprietary_Info(y) →™Use(x, y) ) having been attacked most frequently.

[2] (x)( User(x)š(y) (Proprietary_Info(y)→™Use(x, y)) ) It must be mentioned that these authors [54] did an earlier
cloud vulnerability related work between January 2008 and
Where:
February 2012 with 172 incidents. Their findings indicate that
Proprietary_Info(y): y is proprietary information. 56% of the vulnerability incidents were identified by top

254
three providers which are Amazon, Google and Microsoft. inside and outside the eucalyptus cloud,” ACM Int. Conf. Proceeding
Ser., pp. 95–101, 2013.
Our study also identified these top three providers within the [17] S. Narula, A. Jain, and Prachi, “Cloud Computing Security: Amazon
last four years. This indicates the significance of our work, Web Service,” 2015 Fifth Int. Conf. Adv. Comput. Commun. Technol.,
pp. 501–505, 2015.
namely, vulnerability still manifests in the top three incidents
[18] J. Che, Y. Duan, T. Zhang, and J. Fan, “Study on the security models
for cloud providers, which is a challenging security issue in and strategies of cloud computing,” Procedia Eng., vol. 23, pp. 586–
cloud computing presently. 593, 2011.
[19] ISO/IEC, “International Standard ISO/IEC 27001,” Iso/Iec, vol. 2005,
p. 34, 2005.
A number of possibilities for addressing cloud security [20] R. Saint-germain, “Information Security Management Best Practice
concerns exist and we postulated the use of Formal Methods Based on ISO/IEC 17799,” Inf. Manag. J., vol. 39, no. 4, pp. 60–66,
2005.
(FMs) to assist cloud developers to design provably correct [21] J. Wei, X. Zhang, G. Ammons, V. Bala, and P. Ning, “Managing
solutions. To this end we constructed an example on adhering security of virtual machine images in a cloud environment,” Proc. 2009
ACM Work. Cloud Comput. Secur. - CCSW ’09, no. Vm, p. 91, 2009.
to data privacy and confidentiality with respect to access [22] W. Jansen and T. Gance, “Guidelines on Security and Privacy in Public
control underwritten by an underlying security policy (cf. a Cloud Computing,” 2011.
[23] M. Anisetti, C. A. Ardagna, F. Gaudenzi, and E. Damiani, “A
component in Fig 2). Following this approach a developer certification framework for cloud-based services,” Proc. 31st Annu.
may choose to formalise any number of components in Fig 2. ACM Symp. Appl. Comput., pp. 440–447, 2016.
We anticipate this to a rich source for future work in this area, [24] A. Youssef and M. Alageel, “A Framework for Secure Cloud
Computing,” Int. J. Comput. Sci., vol. 9, no. 4, pp. 487–500, 2012.
whereby specifiers and designers can specify, develop and [25] R. K. Chakrawarti and K. Singhai, “The Architechtural Framework for
verify the correctness and efficiency of a cloud security Public Cloud Security,” 2014.
[26] M. Ali, S. U. Khan, and A. V. Vasilakos, “Security in cloud computing:
system. Opportunities and challenges,” Inf. Sci. (Ny)., vol. 305, pp. 357–383,
2015.
REFERENCES [27] B. Hay, K. Nance, and M. Bishop, “Storm clouds rising: Security
challenges for IaaS cloud computing,” Proc. Annu. Hawaii Int. Conf.
[1] R. B. Bohn and J. Messina, “NIST Cloud Computing Reference Syst. Sci., pp. 1–7, 2011.
Architecture,” pp. 594–596, 2011. [28] D. A. B. Fernandes, L. F. B. Soares, J. V Gomes, M. M. Freire, and P.
[2] X. Zhang, Y. Zhang, X. Zhao, G. Huang, and Q. Lin, R. M. Inácio, “Security issues in cloud environments: A survey,” Int. J.
“SmartRelationship: a VM relationship detection framework for cloud Inf. Secur., vol. 13, no. 2, pp. 113–170, 2014.
management,” Proc. 6th Asia-Pacific Symp. Internetware Internetware [29] S. Pearson, Privacy , Security and Trust in Cloud Computing. Springer-
- INTERNETWARE 2014, pp. 72–75, 2014. Verlag, 2013.
[3] K. Bilal, S. U. R. Malik, O. Khalid, A. Hameed, E. Alvarez, V. [30] M. Jouini and L. B. A. Rabai, “Surveying and analyzing security
Wijaysekara, R. Irfan, S. Shrestha, D. Dwivedy, M. Ali, U. Shahid problems in cloud computing environments,” Proc. - 2014 10th Int.
Khan, A. Abbas, N. Jalil, and S. U. Khan, “A taxonomy and survey on Conf. Comput. Intell. Secur. CIS 2014, pp. 689–693, 2015.
Green Data Center Networks,” Futur. Gener. Comput. Syst., vol. 36, [31] M. Almorsy, J. Grundy, and A. S. Ibrahim, “Supporting automated
no. c, pp. 189–208, 2014. vulnerability analysis using formalized vulnerability signatures,” Proc.
[4] C. Shruti and V. S. Dexit, “Cloud Computing,” vol. 40, no. 2, pp. 145– 27th IEEE/ACM Int. Conf. Autom. Softw. Eng. - ASE 2012, p. 100,
162, 2010. 2012.
[5] H. Yu, N. Powell, D. Stembridge, and X. Yuan, “Cloud computing and [32] U. Nasir and M. Niazi, “Cloud computing adoption assessment model
security challenges,” Proceeding ACM-SE ’12 Proc. 50th Annu. (CAAM),” Profes ’11, vol. 44, no. 0, pp. 34–37, 2011.
Southeast Reg. Conf., p. 298, 2012. [33] B. Kitchenham, O. Pearl Brereton, D. Budgen, M. Turner, J. Bailey,
[6] P. A. Boampong and L. A. Wahsheh, “Different facets of security in and S. Linkman, “Systematic literature reviews in software engineering
the cloud,” Proc. 15th Commun. Netw. Simul. Symp., p. 5, 2012. – A systematic literature review,” Inf. Softw. Technol., vol. 51, no. 1,
[7] M. Carroll, A. van der Merwe, and P. Kotzé, “Secure cloud computing: pp. 7–15, Jan. 2009.
Benefits, risks and controls,” in 2011 Information Security for South [34] A. Vorster and L. Labuschagne, “A framework for comparing different
Africa, 2011, pp. 1–9. information security risk analysis methodologies,” SAICSIT ’05 Proc.
[8] I. Gul, a ur Rehman, and M. H. Islam, “Cloud computing security 2005 Annu. Res. Conf. South African Inst. Comput. Sci. Inf. Technol. IT
auditing,” Next Gener. Inf. Technol. (ICNIT), 2011 2nd Int. Conf., pp. Res. Dev. Ctries., no. July 2005, pp. 95–103, 2005.
143–148, 2011. [35] O. A. Ajigini, J. A. Van Der Poll, and J. H. Kroeze, “Towards a model
[9] P. Samarati, “Data Security and Privacy in the Cloud,” 2015. on security challenges during closed source software to OSS
[10] M. Hussain and H. Abdulsalam, “SECaaS: security as a service for migrations,” 2014 9th Int. Conf. Internet Technol. Secur. Trans. ICITST
cloud-based applications,” Proc. Second Kuwait Conf. e-Services e- 2014, pp. 274–283, 2012.
Systems - KCESS ’11, pp. 1–4, 2011. [36] M. L. Hale and R. Gamble, “Risk propagation of security SLAs in the
[11] A. Bouti and J. Keller, “Securing cloud-based computations against cloud,” 2012 IEEE Globecom Work. GC Wkshps 2012, pp. 730–735,
malicious providers,” ACM SIGOPS Oper. Syst. Rev., vol. 46, no. 2, p. 2012.
38, 2012. [37] M. L. Hale and R. Gamble, “Building a compliance vocabulary to
[12] K. Dahbur, B. Mohammad, and A. B. Tarakji, “A Survey of Risks, embed security controls in cloud SLAs,” Proc. - 2013 IEEE 9th World
Threats and Vulnerabilities in Cloud Computing,” Computing, pp. 1–6, Congr. Serv. Serv. 2013, pp. 118–125, 2013.
2011. [38] K. Salah, J. M. Alcaraz Calero, S. Zeadally, S. Al-Mulla, and M.
[13] ISO, “ISO/IEC Std. ISO 27002:2005, Information Technology - Alzaabi, “Using cloud computing to implement a security overlay
Security Techniques - Code of Practice for Information Security network,” IEEE Secur. Priv., vol. 11, no. 1, pp. 44–53, 2013.
Management,” 2005. [39] Z. Wan, L. June, and R. Deng, “HASBE: A Hierarchical Attribute-
[14] M. Whitman and H. Mattord, “Principles of information security,” Based Solution for Flexible and Scalable Access Control in Cloud
Thompson Course Technology, no. 3, 2009. Computing,” IEEE Trans. Inf. FORENSICS Secur., vol. 217, no. 2, pp.
[15] M. Lauer, “Data Security in the Cloud Why Cloud Computing ?,” 1946–1951, 2013.
Seminar, pp. 61–64, 2011. [40] Y. Xia, Y. Liu, H. Chen, and B. Zang, “Defending against VM rollback
[16] M. Gusev, S. Ristov, and a Donevski, “Security vulnerabilities from attack,” Proc. Int. Conf. Dependable Syst. Networks, 2012.

255
[41] Z. Wang, C. Wu, M. Grace, and X. Jiang, “Isolating commodity hosted [48] R. Sidel, “Home Depot’s 56 Million Card Breach Bigger Than
hypervisors with HyperLock,” Proc. 7th ACM Eur. Conf. Comput. Syst. Target’s,” The Wall Street Journal, 2014. [Online]. Available:
- EuroSys ’12, p. 127, 2012. https://www.wsj.com/articles/home-depot-breach-bigger-than-targets-
[42] P. Siani, “Privacy and Security for Cloud Computing,” in Computer 1411073571.
Communications and Networks, 2013, pp. 1–42. [49] P. Olson, “Apple’s iCloud Services Slow To A Crawl,” Forbes, 2015.
[43] K. Höne and J. H. P. Eloff, “Information security policy — what do [Online]. Available:
international information security standards say?,” Comput. Secur., vol. https://www.forbes.com/sites/parmyolson/2015/05/21/apples-icloud-
21, no. 5, pp. 402–409, 2002. services-slow-to-a-crawl/#183834a95d85.
[44] A. Da Veiga and J. H. P. Eloff, “An Information security governance [50] Symantec, “Internet Security Threat Report,” no. April, pp. 1–77, 2017.
framework,” Inf. Syst. Manag., vol. 24, no. 4, pp. 361–372, 2007. [51] J.M. Spivey, “The Z notation: A reference manual”, 2nd ed. Oxford,
[45] S. Hassan, A. A. Kamboh, and F. Azam, “Analysis of Cloud 2001. [Online]. Available:
Computing Performance, Scalability, Availability, & Security,” 2014. http://spivey.oriel.ox.ac.uk/mike/zrm/zrm.pdf.
[46] A. Levin, “Why the Adobe Hack Scares Me — And Why It Should [52] R. Diaconescu and K. Futatsugi, “CafeOBJ Report: The Language,
Scare You,” Huffpost, 2014. [Online]. Available: Proof Techniques, and Methodologies for Object-Oriented Algebraic
http://www.huffingtonpost.com/adam-levin/why-the-adobe-hack- Specification”, (Amast Series in Computing) Hardcover, July 1998.
scares_b_4277064.html. [53] W. McCune, W., 1994. “Otter 3.0 reference manual and guide (Vol.
[47] CBCNews, “Target data hack affected 70 million people,” 2014. 9700) ”, Argonne, IL: Argonne National Laboratory, 1994.
[Online]. Available: http://www.cbc.ca/news/business/target-data-hack- [54] R. Ko, S. Lee, and V. Rajan, “Cloud Computing Vulnerability
affected-70-million-people-1.2491431. Incidents: A Statistical Overview,” Cloud Secur. Alliance, p. 21, 2013.

256