Department of Computer Science and Engineering

Seminar Report on

“Cloud Security Risks”

for the fulfillment of CIE (Continuous Internal Evaluation) for the 7th semester students of
CSE for the academic year 2024-25.

Course : Cloud Computing (21CS72) .

Class : 7th Semester “A” Division.

Submitted By

Rol No. Name USN

18 AYMAN PATIL 2BL21CS018
62 MAHALAXMI KINNAL 2BL21CS062
66 MEGHA ADALLI 2BL21CS066

Under the Guidance

of Prof. Supriya.K

Course Co-ordinator HOD

Prof. Supriya. K Dr. Leena Ragha
INDEX:

SI. NO CONTENT PAGE NO.

1 Introduction 1
2 Security Concerns in Cloud Computing 2
3 Cloud Security Risks 3
4 Major concerns for cloud users 4
5 Regulatory and Compliance Challenges 5
6 Security Mechanisms and Best Practices 6
7 Privacy and Trust in Cloud Computing 7
8 Technological Risks in Virtualization 8
9 Emerging Threats and Future Directions 9
10 Conclusion and Geo Tag Photos 10
References 11
 1. INTRODUCTION
Cloud computing has revolutionized the way businesses and individuals manage, store, and
process data.
1. Cloud Computing Benefits
Cloud computing has transformed data management by offering scalable, on-demand
resources via the internet. Organizations benefit from reduced operational costs, improved
flexibility, and the ability to focus on core activities rather than infrastructure management.
2. Importance of Cloud Security
The rapid adoption of cloud computing has coincided with increased global
interconnectivity, creating new vulnerabilities. Malicious actors, including organized criminal
groups and nation- states, now target cloud systems for their high-value data and resources,
making robust security measures critical.
3. Evolution of Security Concerns
Initially, computing security threats were internal, arising from unauthorized access within
organizations. As external connectivity expanded, risks evolved to include malware such as
viruses and worms. Today, the interconnected nature of systems magnifies the impact of
cyberattacks, often crossing national boundaries.
4. Global Cyber Threat Landscape
Cyberwarfare has become a significant concern, with nation-states targeting critical
infrastructure. The infamous Stuxnet attack demonstrated how cyber tools can disrupt
physical systems, underlining the real-world impact of cyber threats.
5. Cloud-Specific Challenges
Data Crossing Borders: Data stored in global cloud centers often moves across jurisdictions,
raising legal and regulatory complexities.
Trust and Responsibility: Cloud providers manage critical infrastructure, requiring
organizations to trust their security measures despite limited transparency.

1
 2. Security Concerns in Cloud Computing:
The adoption of cloud computing has introduced new security challenges due to
interconnected systems and shared resources. These concerns stem from both traditional
threats and risks unique to cloud environments.
Historical Perspective
Early computing security focused on internal risks, such as unauthorized access and poor
physical security. The shift to networked systems brought external threats like malware and
hacking. Cloud computing magnifies these risks by introducing a distributed, multi-tenant
structure.
Increased Risks with Connectivity
Cloud environments are more exposed to:

 Global Malware Propagation: Interconnected systems enable rapid malware spread

across borders.
 Complex Attack Vectors: APIs, shared resources, and virtualization add new points of
vulnerability.
Evolving Threats
 Cloud systems face modern challenges such as:
 Cyberwarfare: Nation-states exploit cloud vulnerabilities to target critical
infrastructure.
 Cross-Border Data Issues: Data flowing across jurisdictions faces regulatory and
privacy challenges.
Cloud-Specific Vulnerabilities
 Shared Resources: Multi-tenancy increases the risk of data breaches.
 Limited Transparency: Users often lack visibility into data handling and security
measures.
 Regulatory Challenges: Variations in international laws complicate compliance.

2
3. Cloud Security Risks
1. Traditional Security Threats
Data Loss: Cloud storage failures or inaccessible backups can cause severe damage.
Weak Authentication: Poor credential security leads to account hijacking and data exposure.
2. Modern Challenges
Shared Technology Risks: Multi-tenancy and VMM vulnerabilities increase breach risks.
Data Residency Issues: Cross-border data flows create legal and regulatory complexities.
3. Risks from Malicious Actors
Insider Threats: Employees can intentionally or accidentally compromise systems.
Malicious APIs: Insecure APIs may allow unauthorized access or disrupt services.
4. Operational and Service Risks
Service Downtime: Outages from hardware failures or mismanagement disrupt operations.
Lack of Transparency: Limited visibility into CSP practices complicates risk assessment.
5. Emerging Threats
Multi-Tenancy Challenges: Shared environments complicate forensic analysis and increase
breach potential.
Insecure VM Images: Outdated or tampered images introduce vulnerabilities.

Figure 3.1: Surfaces of attacks in a cloud computing environment

3
 4. Major Concerns for Cloud Users
Cloud users face several critical security and operational challenges that directly impact
their data, operations, and trust in cloud service providers (CSPs). These concerns stem from
both internal vulnerabilities and external threats.

1. Unauthorized Access and Data Theft

 Insider Threats: Employees or contractors with access to sensitive systems may
intentionally or unintentionally misuse their privileges.
 Third-Party Risks: CSPs may inadvertently expose data to unauthorized entities
through insufficient security measures.
 User Weaknesses: Poor password hygiene or inadequate user-level controls can lead
to breaches.

2. Data Loss and Leakage

 Replication Failures: Single points of failure in cloud storage can result in permanent
loss of critical data.
 Inadequate Backups: Users often discover that backup policies are insufficient only
after an incident.
 Accidental Exposure: Misconfigurations in shared environments, such as storage
buckets, can lead to unintended data leakage.

3. Account Hijacking
 Credential Theft: Phishing and weak passwords allow attackers to gain unauthorized
access to user accounts.
 Privilege Escalation: Once an account is compromised, attackers may escalate
privileges to access more sensitive systems.
 Preventive Measures: Multi-factor authentication (MFA) and strict access controls
are crucial to mitigate this risk.

4. Multitenancy Vulnerabilities
 Shared Resource Risks: Poor isolation between tenants in a shared environment can
expose data to other users.
 Forensic Challenges: Tracing attacks is more difficult in multi-tenant systems due to
overlapping logs and activities.

4
 5. Regulatory and Compliance Challenges
Regulatory and compliance issues in cloud computing arise from the complex legal and
operational frameworks governing data storage, processing, and transfer. These challenges
are compounded by the global nature of cloud services.
1. Inconsistent Regulations
Different countries have varying data protection laws, creating compliance difficulties for
organizations operating across borders.
Example: The *GDPR* in the EU imposes strict privacy requirements that may conflict with
laws in other jurisdictions.
2. Cross-Border Data Transfers
Data stored in global cloud centers often crosses national boundaries, subjecting it to
multiple regulatory regimes.
Users must ensure compliance with data sovereignty laws, which dictate where data can be
stored and processed.
3. Ambiguous Data Ownership
Many cloud service agreements fail to clearly define who owns the data and how it can be
used.
This ambiguity raises concerns about unauthorized secondary usage of data by CSPs.
4. Privacy Concerns
Users have limited control over how their data is handled, leading to potential misuse or
exposure.
Privacy Impact Assessments (PIAs) are increasingly necessary to identify and mitigate risks.
5. Compliance Costs
Meeting multiple regulatory requirements across regions can significantly increase
operational costs.

5
 6. Security Mechanisms and Best Practices
Cloud security requires collaboration between users and service providers to ensure data
protection and system integrity. The shared responsibility model highlights the need for
proactive measures on both sides.

1. User-Side Measures
 Strong Passwords and Multi-Factor Authentication (MFA): Critical for preventing
unauthorized access, MFA adds a secure layer even if credentials are compromised.
 Regular Security Training: Educating users on threats like phishing and social
engineering reduces vulnerabilities from human error.
 Access Controls: Role-based restrictions ensure sensitive data is only accessible to
authorized personnel.

2. Service Provider Responsibilities

 Secure APIs: Regularly updated and authenticated APIs minimize vulnerabilities.
 Data Encryption: Encrypting data at rest and in transit protects it from unauthorized
access.
 Monitoring and Incident Response: Real-time monitoring and a clear incident
response plan help mitigate threats promptly.

3. Service-Level Agreements (SLAs)

 Data Ownership and Liability: SLAs must clarify data ownership, usage rights, and
provider accountability for breaches.
 Compliance and Auditability: SLAs should address regulatory compliance and enable
security audits.

4. Additional Best Practices

 Backups: Regular backups ensure data recovery during failures.
 Security Audits: Periodic assessments help identify and address vulnerabilities.
 Multi-Tenancy Isolation: Strong isolation mechanisms protect against cross-tenant
risks.

6
 7. Privacy and Trust in Cloud Computing
Privacy is critical due to sensitive data in the cloud. Robust mechanisms are needed to prevent
unauthorized access and misuse.
Importance of Privacy Impact Assessments (PIA)
 Definition: Tools to identify and mitigate privacy risks, ensuring compliance with laws.
 Benefits: Uncover vulnerabilities, ensure legal compliance, and build user trust.
 Necessity: Essential as data protection laws like GDPR evolve.
Privacy Challenges
 Lack of Visibility: Users lack control over data handling by CSPs.
 Data Proliferation: Duplication increases misuse risks.
 Dynamic Environments: Real-time provisioning complicates tracking.
 Multi-Tenancy: Shared resources risk data exposure.
Building Trust
Trust relies on CSPs' transparency, reliability, and security.
 Transparency: Clear security measures, audits, and compliance.
 Reliability: Consistent uptime, data integrity, and incident response.
 Security: Encryption, multi-factor authentication, and continuous monitoring.
 Trust is foundational to the adoption of cloud services. It depends on the ability of
CSPs to demonstrate reliability, transparency, and strong security practices.

Figure 7.1: (a) Virtual security services provided by the VMM. (b) A dedicated security VM

7
 8. Technological Risks in Virtualization

Virtualization Security Risks in Cloud Computing:

1. Shared Images:
Poorly secured or outdated VM images can expose sensitive data (e.g., credentials) and pose
vulnerabilities.
Studies show many shared images have critical flaws.

2. Multi-Tenancy:
Shared infrastructure increases data breach risks due to insufficient VM isolation.
Overlapping tenant activities complicate forensic analysis.

3. Virtual Machine Monitor (VMM) Vulnerabilities:

Risks: Denial of Service (DoS), side-channel attacks, and compromised VM images.
Implications: A breached VMM can compromise multiple VMs, necessitating secure
configurations, updates, and isolation.

Figure 8.1: Privacy Impact Assessments

8
 9. Emerging Threats and Future Directions
The evolving nature of cloud computing presents new threats that demand adaptive security
strategies.
Emerging Threats
1. Insecure APIs:
APIs are vital for cloud operations but can be exploited for unauthorized access if poorly
secured. Common risks include insufficient authentication, improper input validation, and
outdated protocols.
2. Malicious Insiders:
Employees or contractors with privileged access can misuse their roles to compromise
data or systems. Providers often lack transparency in hiring and monitoring practices,
amplifying this threat.
3. Shared Technology Flaws:
Vulnerabilities in shared infrastructure, such as virtualization platforms or container
systems, can lead to cross-tenant attacks or resource exploitation.
Future Directions
1. Stronger Security Protocols:
 Development of advanced encryption methods for data at rest and in transit.
 Adoption of zero-trust architectures, ensuring no implicit trust within the network.
 Improved identity management systems, such as password less authentication or
biometric security.
2. Continuous Monitoring and Threat Response:
 Real-time monitoring using AI and machine learning to detect and respond to threats
promptly.
 Automated incident response systems to minimize downtime and mitigate attacks
faster.

9
10. Conclusion and Geo Tag Photo
Cloud computing offers immense benefits but comes with significant security risks. These
risks include:
Key Concerns: Unauthorized access, data breaches, and vulnerabilities in virtualization and
APIs.
Best Practices: Employing robust encryption, regular audits, and proactive monitoring.
Shared Responsibility: Security is a collaborative effort between users and providers, with
clearly defined roles in Service-Level Agreements (SLAs).
Future Focus: As threats evolve, continuous innovation in security protocols, monitoring
systems, and compliance frameworks is essential to maintain trust and protect data.
By embracing shared responsibility and staying vigilant against emerging threats,
organizations can harness the full potential of cloud computing while safeguarding their
data and systems.

Figure 10.1: Seminar in the classroom

1
References
[1] https://cloud.google.com/learn/what-is-cloud-security
[2] https://www.ibm.com/topics/cloud-security
[3] https://openlibrary.org/books/OL24598372M/Cloud_Security_and_Privacy

1
1