Harshalreport
Harshalreport
SEMINAR REPORT
ON
Submitted By:
Prof. J. S. Pawar
CERTIFICATE
This is to certify that, this seminar report entitle “SECURITY ISSUES IN CLOUD COM-
PUTING” submitted by Mr.Harshal Khushal Mali, laid down by SAVITRIBAI PHULE
PUNE UNIVERSITY, Pune. This is a record of his own work carried out by his under my
supervision and guidance during academic year 2023-2024
Place: - Nashik
Date: -
Exam No: TCP-19046
Guide HOD
Prof.(Dr.) S. B. Bagal
Principal
ABSTRACT
Cloud computing has revolutionized the way organizations and individuals store, process, and
access data and applications. While its benefits are substantial, security concerns have emerged as a
critical challenge in this technology paradigm. This paper provides an overview of the various security
issues and threats that cloud computing environments face, including data breaches, identity theft,
and service availability disruptions. We explore the mechanisms, best practices, and technologies
available to mitigate these risks. By addressing these security challenges, cloud providers and users
can ensure the confidentiality, integrity, and availability of their data and services in the cloud.
Keywords
Cloud computing, Data storage, Data processing, Data access, Benefits of cloud computing, Security
concerns, Technology paradigm, Security issues, Threats in cloud computing.
ACKNOWLEDGEMENT
It gives us great pleasure in presenting the seminar report on ‘SECURITY ISSUES IN CLOUD
COMPUTING’. I would like to take this opportunity to thank my guide Prof. J. S. Pawar for giving
me all the help and guidance I needed. I am really grate- ful to them for their kind support. Their
valuable suggestions were very helpful.
In the end our special thanks to the staff members for providing various resources such as
laboratory with all needed platforms, continuous Internet connection, for Our Seminar.
I hereby declare that the Seminar entitled, “SECURITY ISSUES IN CLOUD COMPUT-
ING” was carried out and written by me under the guidance of Prof. J. S. Pawar, Department of
Computer Engineering, L.G.N.Sapkal College of Engineering, Anjeneri, Nashik. This work has not
been previously formed the basis for the award of any degree or diploma or certificate nor has been
submitted elsewhere for the award of any degree or diploma.
Place: - Nashik
Date: -
1 Introduction 2
1.1 Why Security Issues come in cloud computing? . . . . . . . . . . . . . . . . . . . . . 2
1.2 What is Security In Cloud Computing? . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Cloud Security Alliance (CSA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3.1 Misuse and Inexcusable Use of Cloud Computing . . . . . . . . . . . . . . . . 4
1.3.2 Insecure Application Programming Interfaces (API) . . . . . . . . . . . . . . . 4
1.3.3 Mischievous Insiders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.4 Mutual Technology Issues/Multi-Tenure Nature . . . . . . . . . . . . . . . . . 5
1.3.5 Information Crash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.6 Record, Service, and Traffic Hijacking . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.7 Unidentified Risk Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Literature Survey 6
3 System Architecture 9
5 Multi-Occupancy 12
6 Methodology 13
6.1 Cloud Data Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
8 Conclusion 16
1
Chapter 1
Introduction
Cloud computing has become a dominant force in the world of IT, offering unparalleled scala-
bility, flexibility, and cost-efficiency. It enables organizations to offload their computing and storage
needs to remote data centers, reducing the burden of maintaining extensive on-premises infrastruc-
ture. However, this convenience and agility come with a set of security challenges that cannot be
ignored. As sensitive data, critical applications, and entire IT ecosystems migrate to the cloud, a new
frontier of security risks emerges. In this introduction, we will delve into the fundamental security
issues associated with cloud computing, including data breaches, identity and access management,
compliance, and the shared responsibility model. We will also explore the evolving landscape of
security solutions and best practices required to safeguard data and applications in the cloud.
2
SECURITY ISSUES IN CLOUD COMPUTING
6. Compliance and Legal Issues: Different regions and industries have specific data protection regu-
lations. Complying with these laws can be complex in the cloud environment.
7. Identity and Access Management: Ensuring the right people have access to cloud resources and
limiting privileges is a challenge. Weak identity and access management can lead to breaches.
8. Service Vulnerabilities: Vulnerabilities in cloud services or misconfigurations can be exploited by
attackers.
9. Insider Threats: Insiders with access to cloud resources can misuse or abuse their privileges,
leading to security breaches.
10.Third-Party Risk: When relying on third-party services or integrations in the cloud, the security
of those third parties becomes a critical concern.
11.Lack of Visibility and Control: Cloud environments are often abstracted from physical infrastruc-
ture, making it challenging to monitor and control security effectively.
12.Cyberattacks: Cloud environments are attractive targets for various cyberattacks, including DDoS
attacks, malware, and phishing campaigns.
• Encryption: Implementing encryption for data at rest and in transit to protect it from unautho-
rized access.
• Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS): Deploying these tools to safe-
guard cloud resources from external threats.
• Backup and Disaster Recovery: Implementing data backup and recovery strategies to ensure data
availability in case of data loss or system failures.
• User Training and Awareness: Educating users and staff about best security practices, including
recognizing phishing attempts and using secure passwords.
• Vendor and Third-Party Security: Assessing and ensuring the security of third-party services or
vendors used within the cloud ecosystem.
• Security Updates and Patch Management: Keeping software, operating systems, and applications
up to date with security patches to prevent exploitation of known vulnerabilities
Programmers, spammers, and different crooks exploit the appropriate enrolment. This engineer-
ing completely isolates your data from other client’s data while permitting us to turn out quickly
the most recent usefulness at the same time. This methodology offers the most configurability and
permits you to separate profound understanding from your data. Prophet conveys a most recent
Multitenant design that permits a multitenant compartment database to get a handle on various
pluggable databases. An existing database can basically be embraced with no application changes
essential. Strategies and relatively vague access to cloud administrations to dispatch different as-
saults, for example, key breaking, secret phrase, and so forth.
Clients deal with and communicate with cloud benefits through API’s. Suppliers must guarantee
that security is incorporated into their administration models, while clients must know about security
dangers.
Malevolent insiders make a tremendous risk in the cloud computing condition since buyers don’t
have an away from of supplier approaches and methodology. Vindictive insiders can increase unap-
proved access into the association and their benefits.
This is essentially founded on shared framework, which isn’t intended to suit a multi-inhabitant
design.
Involved information may incorporate erased or adjusted information without making a reinforce-
ment, un-linking a record from a tremendous situation, loss of an encoding key, and unlawful access
to delicate information.
Record or administration commandeering is generally done with taken qualifications. Such as-
saults incorporate phishing, extortion, and misuse of programming vulnerabilities. Assailants can get
to basic territories of cloud computing administrations like classification, honesty, and accessibility
of administrations.
Cloud administrations mean that associations are less engaged with programming and equipment,
so associations ought not to know with these issues, for example, inner security, security consistence,
reviewing, and logging might be neglected. (Tim Mather, Subra Kumaraswamy, 2009).
Literature Survey
• The journal ‘Trustworthy middleware services in Cloud’ written by Abbadi, Cloud infrastruc-
ture should be capable of Supporting Internet-scale critical applications (e.g., hospital systems
and smart grid systems). Without clear guarantees that their Specifications will be met, essen-
tial infrastructure providers and companies will not outsource their critical applications to the
Public Cloud. The consumer should be presented with proof of the Cloud elements’ trustwor-
thiness, which is at the heart of this Issue. Establishing a Cloud confidence model is critical,
but the sophistication and dynamism of the Cloud’s architecture make it Difficult to do so. One
of the main goals of the EU-funded TClouds (Trustworthy Clouds) project is to establish trust
in the Cloud. TClouds focuses on developing trust models with varying degrees of transparency
in the sense of technological complexities and Trust establishment. These trust models benefit
not only Cloud users, but also Cloud vendors, partnering Clouds-of-Clouds, and Third-party
auditors. In this paper, we look into this issue and summarise some of the most recent TClouds
project findings in the Sense of trust establishment
• In the journal “The cloud Grid approach: Security Analysis and Performance”, V. Casola, A.
Cuomo and M. Rak, said that in both cloud computing and grid computing are paradigms
which manage sets of distributed resources which will benefit the scientific community from
their convergence. This paper proposes a model known as Cloudgrid, through which can
achieve cloud and grid integration. After analysing the security issues involved, a solution
is proposed based on fine-grained access control mechanisms and identity federation through
which interoperability and cooperation is allowed among untrusted cloud resource.
• R. L Grossman, in his publication “The case for Cloud Computing”, says that understanding
clouds and cloud computing Is understanding there are two different types of clouds. They are
distinguished by provide on-demand computing instances’ and ‘provide on-demand computing
6
SECURITY ISSUES IN CLOUD COMPUTING
capacity. Both of them uses similar machines, but the second one is designed as support
data- or Compute-intensive applications by scaling capacity. Example of the first category is
the Amazon EC2 services, and Google’s MapReduce is the example of second category. The
provide on-demand computing instances uses instance to supply Software as a Service (SaaS)
or Platform as a Service (PaaS).
• The book by Tim Mather, Subra Kumaraswamy, Shahed Latiff, “Cloud Security and Privacy:
AN Enterprise Perspective On Risks and compliance starts with the basic introduction of Cloud
Computing and its evolution. It tells us how Computing Changed into Cloud computing during
a period of time. It introduces the readers with features of Cloud Computing like pay as you Go
model, elasticity, shared resources, vast scalability, and self- provisioning of resources. It tells us
that Cloud Computing is a Fast-changing field which have recently came into existence. Cloud
can have multiple definitions and this book tries to explain the Same in a very easy manner.
This book describes some of the most important aspects of Cloud Computing like visualization.
In Third chapter, we see how Cloud is helpful in providing security to IT infrastructure. We
can learn about IT infrastructure security In different levels like network, host and application
levels. Fourth chapter introduces us with Data Security and Storage which Inspects the data
storage and data security of current state in the cloud. It includes features like integrity,
confidentiality and Availability of services. After Data Security and Storage, we come across
Identity and access Management feature of Cloud which Is helpful in authentication, auditing
and authorization of users accessing the cloud services. Security Management can be seen in
Chapter six which shows various frameworks used in Security Management. We also learn about
necessary protocols required for cloud in Security Management. After Security Management
we come to know about the privacy control on cloud. It makes us familiar with the privacy
points to remember about Cloud Computing and also compares the similarities and differences
with traditional cloud models. We also come across legal and regulatory aspects of cloud.
These aspects could be helpful while providing as well as using cloud services. Chapter eight
deals with Audit and Compliance where we can know the significance of Audit and Compliance
functions. Moreover, we get to know about frameworks and protocols to consider in context
of Audit and Compliance. After this we get to know about some of the most popular Cloud
Service Providers in market and what services they provide. Another emerging feature of
Cloud is Security-As-a-Service which is talked about in chapter ten. Here we come to know
how security is provided as a service on cloud and how it is becoming more popular day-by-day.
We also get to know what are the security services that are provided on cloud. In the final
chapter, we go through the Impact of Cloud Computing on the role of Corporate IT. We can
know about the perspective of Cloud Service Providers and IT departments towards each other.
Cloud Computing is a very important aspect in context of IT but the fact that it replaces much
of what IT is cannot be ignored by IT departments. Finally, we come across the conclusion
of book, which highlights the important points presented in the book and a brief description
about the future of Cloud Computing
System Architecture
This engineering completely isolates your data from other client’s data, while permitting us to turn
out quickly the most Recent usefulness at the same time. This methodology offers the most config-
urability and permits you to separate profound Understanding from your data. Prophet conveys a
most recent Multitenant design that permits a multitenant compartment database to get a handle
on Various pluggable databases. An existing database can basically be embraced with no application
changes essential
System Architecture
9
SECURITY ISSUES IN CLOUD COMPUTING
Security issues in cloud computing system architecture are a paramount concern. To address
these challenges, cloud architects must prioritize various security measures. Data security, a funda-
mental aspect, is safeguarded through robust encryption techniques for data at rest and in transit,
coupled with stringent access control policies to limit data access to authorized users. Identity and
Access Management (IAM) plays a crucial role, necessitating the use of multi-factor authentication
(MFA) and role-based access control (RBAC) to enhance user authentication and ensure the principle
of least privilege.
Network security is equally vital, requiring the deployment of firewalls, network segmenta-
tion, and Virtual Private Clouds (VPCs) to protect and isolate the network, reducing the potential
attack surface. Compliance and legal issues must also be addressed, with organizations establishing
data governance strategies and ensuring data residency adherence based on the relevant regulations
and standards. Protection from Distributed Denial-of-Service (DDoS) attacks involves the use of
specialized mitigation services and technologies.
1. Asset Identification: Identify all assets, data, and resources involved in your cloud infrastructure,
including applications, data, hardware, and software.
2. Threat Identification: Identify potential threats to your cloud environment, such as data breaches,
unauthorized access, or service outages.
3. Vulnerability Assessment: Determine vulnerabilities in your cloud setup, which could be related
to misconfigurations, outdated software, or weak access controls.
4. Risk Analysis: Assess the likelihood and impact of identified threats exploiting vulnerabilities.
This is often done using risk matrices or formulas.
5. Risk Prioritization: Prioritize risks based on their severity, which helps in focusing on the most
critical issues first.
6. Mitigation Planning: Develop strategies to mitigate or reduce the identified risks. This might
involve implementing security controls, policies, or procedures.
7. Security Controls Implementation: Put security controls in place, which can include encryption,
access controls, monitoring, and incident response mechanisms.
8. Continuous Monitoring: Continuously monitor your cloud environment for new threats and vulner-
abilities. Tools and practices like intrusion detection systems and regular vulnerability assessments
are crucial.
9. Incident Response: Have a well-defined incident response plan to react to security incidents
promptly and effectively
11
Chapter 5
Multi-Occupancy
12
Chapter 6
Methodology
13
Chapter 7
7.1 Advantages
To capture all the risk in the cloud
7.2 Disdvantages
1. Data Breaches: Security issues can lead to data breaches, resulting in the theft or exposure of
sensitive information, causing financial losses and damage to an organization’s reputation.
2. Compliance Risks: Failing to address security issues can result in non-compliance with industry
regulations and legal requirements, leading to fines and legal repercussions.
3. Data Loss: Security issues can result in data loss due to factors like accidental deletions, service
outages, or lack of adequate backup and recovery measures.
4. Financial Impact: Remedying security breaches and addressing security vulnerabilities can be
costly in terms of technology, personnel, and legal expenses.
5. Loss of Trust: Security issues erode the trust of customers and partners, potentially leading to
lost business opportunities and damaged relationships.
6. Downtime and Disruption: Security incidents can lead to service disruptions, causing downtime
and affecting productivity, revenue, and customer satisfaction.
7. Reputational Damage: Publicized security incidents can harm an organization’s reputation, mak-
ing it more challenging to attract and retain customers.
8. Intellectual Property Theft: Intellectual property theft can occur when proprietary information
or trade secrets are exposed, leading to loss of competitive advantage.
9. Regulatory Scrutiny: Security breaches may trigger regulatory investigations, adding additional
14
SECURITY ISSUES IN CLOUD COMPUTING
Conclusion
In conclusion, security issues in cloud computing are a critical concern that organizations must
address to safeguard their data and infrastructure in the cloud. These issues encompass a wide
range of challenges, including data breaches, identity and access management, misconfigurations,
and compliance issues. To mitigate these risks effectively. By implementing measures and remaining
vigilant, organizations can significantly enhance the security of their cloud computing environments,
protect sensitive data, and ensure business continuity. Cloud security is an ongoing process, and
proactive measures are essential to address the dynamic nature of cybersecurity threats in the cloud.
16
SECURITY ISSUES IN CLOUD COMPUTING
References
1. Abbadi, I. M., Deng, M., Nalin, M., Martin, A., Petkovic, M., Baroni, I., Sanna, A. (2011).
Trustworthy middleware Services in the cloud. International Conference on Information and
Knowledge Management, Proceedings, October, 33–40. https://doi.org/10.1145/2064085.2064094
2. . Albugmi, A., Alassafi, M. O., Walters, R., Wills, G. (2016). Data security in cloud. comput-
ing. 5th International Conference on Future Generation Communication Technologies, FGCT
2016, October 2017, 55–59. https://doi.org/10.1109/FGCT.2016.7605062
3. Casola, V., Cuomo, A., Rak, M., Villano, U. (2013). The CloudGrid approach: Security
analysis and performance Evaluation. Future Generation Computer Systems, 29(1), 387–401.
https://doi.org/10.1016/j.future.2011.08.008
4. Grossman, R. L. (2009). The case for cloud computing. IT Professional, 11(2), 23–27.
https://doi.org/10.1109/MITP.2009.40
5. Guilloteau, S., Mauree, V. (2012). Privacy in Cloud Computing. ITU-T Technology Watch Re-
port, March, 26. http://www.itu.int/ITUT/techwatch0A http://www.itu.int/en/ITU-T/techwatch/Pag
computingprivacy.aspx
6. Naralasetty, T., Eswar, K. (2013). Secure Data Transmission Using Cloud Computing. 2(11),
1356–1362.
7. Qadir, S., Quadri, S. M. K. (2016). Information Availability: An Insight into the Most
Important Attribute of Information Security. Journal of Information Security, 07(03), 185–194.
https://doi.org/10.4236/jis.2016.73014
8. . Solanki, Seema Singh and Nabeel, S. (2014). Cloud Computing : Data Separation Is-
sues. International Journal Magazine of Engineering, Technology, Management and Research,
1(November), 155–160.
9. Teneyuca, D. (2011). Internet cloud security: The illusion of inclusion. Information Security
Technical Report, 16(3–4), 102–107. https://doi.org/10.1016/j.istr.2011.08.005
10. Tim Mather, Subra Kumaraswamy, and S. L. (2009). Cloud Privacy and Security. Governance
An International Journal Of Policy And Administration, 336
11. Vaish, A., Kushwaha, A., Das, R., Sharma, C. (2013). Data Location Verification in Cloud
Computing. International Journal of Computer Applications, 68(12), 23–27. https://doi.org/10.5120/11
7104
12. Varsha, V., Wadhwa, A., Gupta, S. (2015). Framework using Multitenancy Architecture in
Cloud Computing. International Journal of Computer Applications, 121(15), 12–17. https://doi.org/10.
4883
13. Vijayaragavan, V., Sivasankar, K. (2014). Data integrity in cloud computing – A survey.
International Journal of Applied Engineering Research, 9(23), 23285–23297.