(IJACSA) International Journal of Advanced Computer Science and Applications,

Vol. 15, No. 2, 2024

Prominent Security Vulnerabilities in Cloud

Computing

Alanoud Alquwayzani, Rawabi Aldossri, Mounir Frikha

Dept. of Computer Networks and Communications (CCSIT), King Faisal University, Al Hassa 31982, Saudi Arabia

Abstract—This research study examines the significant se- works in Section II. Section III presents cloud computing
curity vulnerabilities and threats in cloud computing, analyzes statistics, highlighting its growth and the paradigm shift in
their potential consequences for enterprises, and proposes ef- organizations. The methodology, including penetration testing
fective solutions for mitigating these vulnerabilities. This paper and vulnerability scanning, is outlined in Section IV. The paper
discusses the increasing significance of cloud security in a time concludes with a discussion on future trends and a summary
characterized by rapid data expansion and technological progress.
The paper examines prevalent vulnerabilities in cloud computing,
of the findings and recommendations in Section V.
including cloud misconfigurations, data leakage, shared technol-
ogy threats, and insider threats. It emphasizes the necessity of II. L ITERATURE R EVIEW
adopting a proactive and comprehensive approach to ensure cloud
security. The report places significant emphasis on the shared A. Selection of Papers by PRISMA
responsibility paradigm, adherence to industry laws, and the This paper aims to conduct a rigorous Systematic Literature
dynamic nature of cybersecurity threats. The situation necessi- Review (SLR) of the existing literature on prominent security
tates the cooperation of researchers, cybersecurity professionals,
vulnerabilities in cloud computing, guided by the Preferred
and enterprises to proactively address these difficulties. This
partnership aims to provide a thorough manual for organizations Reporting Items for Systematic Reviews and Meta-Analyses
aiming to bolster their cloud security measures and safeguard (PRISMA) methodology. PRISMA’s transparent, methodolog-
valuable data in an ever-evolving digital landscape. ical approach ensures an unbiased selection and assessment of
the papers, enabling a comprehensive and replicable review. In
Keywords—Cloud computing; vulnerabilities; cloud security; the first step, the search was conducted in the IEEE Xplore and
cloud misconfigurations; data loss; threats
Google Scholar databases using the querying combination of
the following keywords: (Security Vulnerabilities OR Threats)
I. I NTRODUCTION AND Cloud Computing. The literature is restricted to studies
Cloud computing has revolutionized how companies published between 2012 and 2023 in English. Google Scholar
manage data and information technology, offering flexi- revealed 8580 papers that discuss security vulnerabilities in
ble, on-demand resources that facilitate innovation and col- cloud computing, specifically focusing on data breaches, unau-
laboration. Through services such as Infrastructure-as-a- thorized access, and other security threats. These 8,580 search
Service (IaaS), Platform-as-a-Service (PaaS), and Software- papers were registered, with 2,000 duplicate papers removed
as-a-Service (SaaS), businesses of all sizes can now opti- before screening and 4,080 papers excluded for other reasons.
mize costs, improve agility, and enhance efficiency. Despite Additionally, 29 papers were identified in the IEEE Xplore.
its numerous benefits, cloud computing is not without its Thirteen papers were excluded after screening the title and
challenges, particularly in the realm of security. misconfig- abstract due to unspecific goals. A total of 157 and 9 papers
urations, improper authentication, and phishing attempts are were assessed for eligibility from the Google Scholar and IEEE
among the many vulnerabilities that have led to significant Xplore databases, respectively. Finally, after a thorough review
data breaches and financial losses for organizations [1]. The and study of these papers, 44 papers were selected from the
financial implications of these security vulnerabilities are stark, Google Scholar database and 7 from the IEEE Xplore, making
with the average cost of a data breach reaching $4.24 million a total of 51 papers selected. This selection process of papers,
in 2023, the highest in 17 years, according to the International as conducted by PRISMA, is illustrated in Fig. 1.
Business Machines (IBM) Corporation. Moreover, breaches in
cloud environments have proven to be more costly than tradi- B. Related Papers
tional on-premises intrusions, underscoring the critical need for
Cloud computing has a significant role in modern business
robust cloud security measures. This study aims to examine the
and individuals’ lives. Numerous articles and studies are fo-
impact of cloud computing vulnerabilities on organizations and
cused on different literary studies in this field. For instance, a
review practical mitigation strategies to enhance cloud security.
review article written by Alouffi et al. [2] titled “A Systematic
It seeks to explore the advantages and disadvantages of these
Literature Review on Cloud Computing Security: Threats and
solutions, considering security and usability trade-offs. The
Mitigation Strategies” identified seven major security threats
ultimate goal is to contribute to the cloud security literature
to cloud computing services, including data tampering and
and provide insights for practitioners and policymakers on
leakage, intrusion of data, and storage of data. Similarly,
safeguarding valuable data in an increasingly digital world.
the paper identifies blockchain as a partnering technology to
The rest of the paper is organized as follows: Section address some of the security concerns. Akello et al. in [3]
II discusses the selection of papers through the PRISMA summarized existing security surveys in the domains of cloud,
methodology, followed by a detailed literature review of related fog, and edge computing. The paper underscores the need for
www.ijacsa.thesai.org 803 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

Fig. 1. Selection of papers for literature review using PRISMA.

addressing security problems related to these domains while on this subject matter. The articles are summarized in the table
carrying out a comprehensive examination of the different below:
security problems associated with them.
Humayun et al. in [4] in their review paper titled “Cyber III. C LOUD C OMPUTING S TATISTICS
Security Threats and Vulnerabilities: A Systematic Mapping
Study” included a list of existing studies relating to cyber Scalability, flexibility, and cost-efficiency are among the
security vulnerabilities and categorizes them considering the benefits of cloud computing, which is continually growing.
type of a commonly known security threat vulnerability, victim However, cloud computing presents severe security issues.
of a cyber threat, vulnerability degree, and method of data Research shows that 90% of cloud data is unstructured and
collection as well as verification. Another review paper in requires different processing and storage methods. This expo-
[5] titled “Security Issues in Cloud Computing: A Review on nential increase is a major issue. Text, photos, audio, video,
Security Problems in Cloud Computing—A Survey” also indi- and other unstructured data have no standard or schema. Un-
cated security hurdles like data confidentiality, data integrity, structured data is harder to manage and secure than structured
and data privacy. data. Multi-cloud strategies are growing, with an estimated
87% of companies going multi-cloud by 2024. Multi-cloud
Numerous other articles exist [6], [5] that offer a compre- setups do, however, also raise the complexity and risk of
hensive examination of the diverse security concerns within the security breaches, which in 2022 accounted for 45% of all
realm of cloud computing. These scholarly articles delineate data breaches. The confidentiality, integrity, and availability of
a number of security challenges, including but not limited to cloud data and infrastructure can be jeopardized by security
issues pertaining to data privacy, data confidentiality, and data breaches, which can lead to monetary losses, damages to
integrity. It is imperative to acknowledge that although these one’s reputation, legal ramifications, and regulatory fines. The
articles offer a comprehensive examination of the diverse se- average cost of these breaches globally was $4.35 million in
curity concerns in cloud computing, they do not encompass all 2022, and the healthcare industry faced costs as high as $10.10
possible aspects. However, these resources provide a valuable million. The financial consequences are enormous. In addition,
foundation for individuals seeking to further their knowledge there was a 38% increase in cybersecurity threats between
www.ijacsa.thesai.org 804 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

TABLE I. S UMMARY OF L ITERATURE R EVIEW PAPERS

Author Year Description Type of

Paper

Prabadevi et al. 2014 The paper reviews the list of existing studies relating to cybersecurity vulnerabilities and categorizes them considering the type Literature
[1] of a commonly known security threat vulnerability, victim of a cyber threat, vulnerability degree, and method of data collection Review
as well as verification. The authors suggested state-of-the-art techniques for recognizing human emotions from speech, facial
expressions, and multimodal signals to address security issues.

Akello et al. 2022 Provides a summary of security surveys in the cloud, fog, and edge computing domains. Literature
[3] Review

Alouffi et al. 2021 The research revealed seven primary security vulnerabilities that pose a risk to cloud computing services. These vulnerabilities Literature
[2] include data manipulation and leakage, intrusion, and storage. The study also proposes the utilization of blockchain as a Review
complementary solution to address security concerns.

Humayun et al. 2020 identify available studies on cybersecurity vulnerabilities and categorize these solutions against commonly available security Mapping
[4] vulnerabilities, victims of cyber threats, vulnerability severity, and data collection and validation methods. Study

Patel et al. [7] 2020 The paper overviews cloud security issues, threats, and related attacks. Literature
Review

Kumar et al. 2017 Provide an overview of cloud computing security issues. The paper identifies several security challenges, such as data privacy, Survey
[6] confidentiality, and integrity.

Tabrizchi et al. 2020 Identify several security challenges such as data privacy, confidentiality, and integrity. Survey
[8]

Shaikh et al. 2012 Provides an overview of the various security issues in cloud computing. The paper identifies several security challenges, such as Survey
[5] data privacy, confidentiality, and integrity.

Sharma et al. 2021 The paper proposes a new topology for a single-phase inverter that can reduce the leakage current and increase the efficiency of Literature
[9] photovoltaic systems. Review

Jabir et al. [10] 2016 Th paper presents a framework for conducting penetration testing on a private cloud computing infrastructure. Research

Shetty et al. 2012 Analyzes the security level of network applications on routers between cloud subscribers and cloud providers. Research
[11]

Kumar et al. 2019 A comprehensive survey focusing on cloud security requirements, threats, vulnerabilities, and countermeasures. It provides an Survey
[12] in-depth analysis of cloud computing security challenges and offers a unified taxonomy for security in the cloud environment.

Sun et al. [13] 2020 This paper analyzes security and privacy protection in cloud computing. It reviews various privacy security issues, access control Review
technologies, and attribute-based encryption (ABE) for cloud security. The paper also explores searchable encryption techniques
and integrating various technologies for enhanced privacy and security in cloud computing.

Stergiou et al. 2018 This paper addresses security, privacy, and efficiency in sustainable cloud computing, particularly Big Data and IoT. It explores Review
[14] the integration of cloud computing with IoT technologies and the resulting security challenges while proposing a new system to
improve cloud computing security through enhanced network architecture and encryption methods.

Parikh et al. 2019 The paper critically analyzes the unique security and privacy challenges in cloud, fog, and edge computing environments. It Review
[15] discusses the emerging security risks and privacy concerns in these distributed computing models, especially in relation to IoT
integration and increasing data traffic. The study also proposes strategic approaches to mitigate these challenges, emphasizing the
need for robust security mechanisms tailored to the complexities of interconnected computing systems.

Ahmed et al. 2016 This paper presents a detailed taxonomy for identifying security issues in cloud computing environments. It systematically Taxonomy
[16] categorizes various security threats and challenges in cloud computing, offering a structured framework for understanding and Review
addressing these issues. The paper emphasizes the need for comprehensive security strategies to manage cloud security risks’
evolving and complex nature.

Guan et al. 2018 The paper explores data security and privacy challenges in fog computing. It critically discusses the unique security and privacy Review
[17] issues that arise due to the nature of fog computing as an extension of cloud computing, especially with regard to IoT applications.
The study highlights the need for innovative security approaches due to the limitations of existing cloud computing security
solutions in the fog computing paradigm.

2022 and 2023, underscoring the critical need for stronger management, threat detection, incident response, compliance
security protocols to keep bad actors away from cloud data management, and more. Some of the aspects under the problem
and infrastructure1 . Phishing, ransomware, Denial-of-Service statement are discussed in detail below:
(DoS), Distributed Denial-of-Service (DDoS), malware, insider
threats, and others are cybersecurity attacks. These attacks
A. Exponential Growth
exploit cloud computing weaknesses such as misconfiguration,
inadequate authentication, a lack of encryption, insufficient The use of cloud services by numerous industries and
monitoring, and shared responsibility. Thus, organizations sectors adds to the exponential expansion of cloud data.
must take a holistic and proactive approach to cloud security According to the International Data Corporation (IDC), global
that covers data protection, access control, encryption, identity public cloud services and infrastructure investment expanded
from $229 billion in 2019 to $500 billion in 2023, a 22.3%
1 https://aag-it.com/the-latest-cyber-crime-statistics/ compound annual growth rate (CAGR). More companies are
www.ijacsa.thesai.org 805 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

moving their data and apps to the cloud to maximize its duties, effectively oversee numerous vendors and platforms,
scalability, flexibility, and cost-effectiveness [12]. However, and guarantee the protection and confidentiality of data. The
more data is generated, processed, and stored in the cloud, shared responsibility model is a fundamental component of
presenting new data management and security challenges. cloud security, defining the allocation of security responsibil-
Cloud data grows exponentially due to new technologies and ities between the cloud service provider and the consumer.
trends that generate large amounts of data. The Internet of The level of control and responsibility that customers have
Things (IoT) is a network of internet-connected devices that over the security of their data and applications varies depend-
collect and exchange data. Cisco predicted that global IoT ing on the specific type of cloud service they are utilizing,
connections would rise from 18.4 billion in 2018 to 43.9 either IaaS, PaaS, or SaaS. In the context of IaaS, it is the
billion in 2023, a 19% CAGR. It was also predicted that customer’s responsibility to ensure the security of the operating
global IoT data traffic would expand from 14.4 exabytes system, applications, data, and network traffic4 . Conversely, the
per month in 2018 to 79.4 by 2023, a 41% CAGR. Since provider assumes the responsibility of securing the physical
IoT devices have limited storage and processing, most data infrastructure, virtualization layer, and network. Within the
would be saved and analyzed in the cloud. Another reason realm of SaaS, the onus of ensuring data security and user
driving exponential data expansion in cloud systems is the access lies solely on the customer. At the same time, the
demand for data analytics and Artificial Intelligence (AI) provider bears the responsibility for all other aspects.
applications. Organizations can improve customer experiences,
An additional crucial element of cloud security is ad-
processes, and insights with data analytics and AI [12]. The
herence to industry-specific legislation and standards. Exam-
global business intelligence and analytics software market was
ples of these include the Health Insurance Portability and
estimated to expand from $23.1 billion in 2020 to $33.8 billion
Accountability Act (HIPAA) for the healthcare sector, the
in 2025, a 7.9% CAGR, according to Gartner. The worldwide
Payment Card Industry Data Security Standard (PCI DSS)
AI software market was to expand 33.2% from $22.6 billion
for the payment card business, and the General Data Protec-
in 2020 to $126.0 billion in 2025 [23]. Cloud storage and
tion Regulation (GDPR) for data protection inside Europe.
processing of enormous volumes of data are needed to train
The primary objective of these regulations is to safeguard
and execute these applications. According to IDC’s prediction,
the confidentiality, integrity, and availability of sensitive data
there is an anticipated CAGR of 12.9% in spending on cloud
and systems. Nevertheless, these regulations enforce stringent
infrastructure during the period of 2021–2026. This growth is
criteria and responsibilities for both the cloud service provider
expected to result in a total expenditure of $135.1 billion in
and the customer. As an illustration, it is mandated under the
2026, representing 67.3% of the total expenditure on compute
HIPAA that both entities involved must engage in the execution
and storage infrastructure. The utilization of shared cloud
of a business associate agreement (BAA), which outlines their
infrastructure is projected to represent 72.3% of the overall
respective obligations and duties pertaining to safeguarding
cloud capacity, exhibiting a CAGR of 13.8%2 . The expenditure
protected health information (PHI)4 . The GDPR mandates
on specialized cloud infrastructure is projected to see a CAGR
that entities must conform to the fundamental principles of
of 10.7%, reaching a total of $37.4 billion. Expenditure on non-
data minimization, purpose limitation, and consent. Hence,
cloud infrastructure is projected to exhibit a CAGR of 2.3%,
enterprises must undertake a comprehensive evaluation of risks
ultimately attaining a value of $65.6 billion by the year 2026.
and exercise due diligence prior to the selection of a cloud
It is projected that expenditures made by service providers
service provider. The user needs to ascertain that the service
on compute and storage infrastructure would see a CAGR
provider satisfies their security and compliance prerequisites
of 12.1%, ultimately reaching a total of $131.9 billion by
while also offering transparency and accountability in their
the year 20263 https://infotechlead.com/cloud/cloud-spending-
service provisions5 . In addition, it is imperative for organi-
to-grow-17-to-88-9-bn-in-2022-vs-10-in-2021-idc-74765. This
zations to consistently engage in monitoring and auditing of
is shown in the graph below.
their cloud infrastructure in order to identify and address any
The global market for AI had a valuation of USD 454.12 possible security risks or occurrences promptly. Therefore,
billion in 2022 and is projected to reach approximately USD cloud computing represents a significant shift in the prevailing
2,575.16 billion by 2032, exhibiting a CAGR of 19% from paradigm, presenting numerous advantages and posing various
2023 to 2032, as shown below. obstacles for enterprises. Conducting research is necessary in
order to comprehensively comprehend and efficiently tackle
B. Paradigm Shift in Organizations these difficulties6 . Organizations may effectively use the capa-
bilities of cloud computing while mitigating potential dangers
Cloud computing is a multifaceted phenomenon that en- by adhering to established best practices and standards in cloud
compasses both technological advancements and strategic con- security and compliance.
siderations, exerting influence over various aspects of an
organization, such as its structure, culture, and performance. C. Security Vulnerabilities
Organizations that implement cloud computing can experience
In 2022, a significant proportion of data breaches were
several advantages, including enhanced agility, innovation,
attributed to infiltrations into cloud-based systems. This em-
and collaboration, with decreased operational expenses and
phasizes the pressing necessity of promptly addressing the
complexity. Nevertheless, these organizations also have other
obstacles, including the need to adapt to evolving roles and 4 https://www.crowdstrike.com/cybersecurity-101/cloud-security/cloud-vul
nerabilities/
2 https://solutionsreview.com/data-management/80-percent-of-your-data-w 5 https://www.cloudvulndb.org/
ill-be-unstructured-in-five-years/ 6 https://www.cypressdatadefense.com/blog/cloud-computing-security-vul
3 \unskip\protect\penalty\@M\vrulewidth\z@height\z@depth\dpff nerabilities/

www.ijacsa.thesai.org 806 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

distinct security risks that impact cloud environments. The businesses had a cloud-based data breach or failed audit in
vulnerabilities encompass a wide range of issues, including 2021, up 5% from 2020, raising increased concerns about
misconfigurations in cloud settings, inadequate user access cybercrime. Cloud adoption, especially multicloud usage, is
controls, weaknesses in the architecture of cloud service rising globally. In 2021, enterprises worldwide used 110 SaaS
providers, and advanced attack methodologies. Conducting apps, up from eight in 2015. 72% of enterprises now use
research in this field is crucial for the identification of these multiple IaaS providers, up from 57% in 2021. One in five
vulnerabilities and the formulation of efficient strategies to (20%) respondents use three or more providers, virtually
protect sensitive data within businesses. Misconfigurations are doubling in 2021. Despite their growing popularity, businesses
identified as a primary contributing factor to data breaches worry about the complexity of cloud services, with 51%
occurring within cloud infrastructures7 . Cloud services provide of IT experts saying cloud privacy and data protection are
a wide range of choices, and enterprises frequently have diffi- harder. Complexity necessitates stronger cybersecurity. Most
culties configuring them in a secure manner. Misconfigurations respondents (66%) reported that 21–60% of their sensitive data
have the potential to inadvertently expose data to unauthorized resides in the cloud. Only 25% indicated they could classify all
access, leakage, or alteration. Research can yield significant the data. About 32% of respondents had to notify a government
insights into prevalent misconfigurations and effective preven- agency, client, partner, or employee of a breach. This should
tive measures. The infrastructure of cloud service providers worry sensitive data-holding companies, especially in highly
represents an additional factor contributing to vulnerability. regulated industries. Cyberattacks continue to threaten cloud
The security of data stored in cloud environments is frequently apps and data. Malware, ransomware, and phishing/whaling
contingent upon the security measures implemented by the assaults increased for 26%, 25%, and 19% of respondents,
cloud service provider. Hence, it is vital to comprehend the respectively. IT professionals consider encryption essential for
prospective vulnerabilities within the provider’s infrastructure multicloud data protection. Most respondents use encryption
and their potential impact on the data. Research also plays (59%) and key management (52%) to secure cloud data. When
a crucial role in enabling enterprises to effectively monitor asked how much of their cloud data is encrypted, just 11%
and stay updated on the most recent vulnerabilities. This replied 81–100%. Enterprises may also face key management
allows them to ensure that cloud providers swiftly patch these platform sprawl. 10% utilize one to two platforms, 90% use
issues. Furthermore, it is important to note that, with the three or more, and 17% use eight or more. Enterprises should
continuous evolution of cyber threats, conducting research in prioritize cloud data encryption8 . The practical usefulness of
this particular domain might provide valuable insights into encryption platforms was shown when 40% of respondents
emerging attack strategies and vulnerabilities that are unique to said they avoided breach reporting because the stolen or
cloud computing. The acquisition of this knowledge is crucial leaked data was encrypted or tokenized. Positive signals of
for enterprises to adopt a proactive approach to safeguarding businesses investing in Zero Trust were also promising. About
their data against developing dangers. Different scholars assert 29% of respondents are actually implementing a Zero Trust
that it is important to enable firms to identify and address many strategy, 27% are analyzing and developing one, and 23% are
types of attacks, including cryptojacking, denial-of-service, contemplating it. This is encouraging, but there is potential for
and server-side request forgery, within their cloud settings. It improvement.
is imperative to note that the duty to ensure security in cloud
computing is a collaborative effort between enterprises and D. Financial Ramifications
cloud service providers. Gaining insight into the allocation of
this responsibility and acquiring knowledge about successful The occurrence of data breaches inside cloud computing
collaboration are essential elements in the process of mitigating environments can result in major monetary losses for enter-
security vulnerabilities in cloud computing. prises, impacting their immediate and sustained operational
outcomes. Based on a report published by IBM, it has been
The exposed data included sensitive information such as determined that the worldwide mean expense associated with
authentication credentials, secret API data, and decryption a data breach in the year 2023 amounted to USD 4.45 million,
keys. Moreover, documents contained in these servers revealed reflecting a 15% escalation over a span of three years9 .
that the databases were storing data for Accenture’s clients, Nevertheless, the financial implications of a data breach ex-
including high-profile telecommunication companies and other hibit considerable disparity, contingent upon the geographical
Fortune 100 firms. The breach could expose Accenture and location and sector of the afflicted entity10 . In addition to
its clients to significant risks, including unauthorized data comprehending the possible financial implications associated
manipulation, fraud, and targeted phishing attacks. Fortunately, with data breaches, it is imperative for enterprises to adopt
the exposed databases were discovered by a security researcher proactive measures aimed at the prevention and mitigation
before any known malicious exploitation could occur. This of such incidents. According to a survey published by IBM,
incident underlines the critical need for stringent security prac- the utilization of security AI and automation has the potential
tices in cloud storage configuration. The primary lesson here to yield a reduction in the average cost of a data breach by
is the importance of regular security audits and implementing USD 1.76 million in comparison to firms that do not employ
strict access controls. Companies must ensure their cloud these technologies. The implementation of security AI and
services are correctly configured and regularly monitored for
potential vulnerabilities. 8 https://cpl.thalesgroup.com/about-us/newsroom/thales-cloud-data-breache
s-2022-trends-challenges
The 2022 Thales Cloud Security Report by 451 Research, 9 https://www.ibm.com/reports/data-breach
part of S&P Global Market Intelligence, found that 45% of 10 https://newsroom.ibm.com/2023-07-24-IBM-Report-Half-of-Breache
d-Organizations-Unwilling-to-Increase-Security-Spend-Despite-Soaring-Bre
7 https://www.upguard.com/blog/cloud-misconfiguration ach-Costs

www.ijacsa.thesai.org 807 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

2023, the global average expenditure was USD 5.66 million,

a whopping hike of 21% from 2022. Zero-day exploits have
increasingly seen their occurrence and impact. The menace
this trend poses to critical infrastructure and the nation’s
security is substantial. These social engineering attacks are
becoming more sophisticated and targeted, taking advantage of
the growing use of social media and online environments. They
are aimed at psychological tricks that would induce people to
give out private data or engage in dangerous acts. Supply chain
attacks that compromise software and hardware components
from trustworthy vendors and partners pose serious challenges
to firms. The assaults are capable of affecting different entities
within several sectors. It is imperative for organizations to
comprehend the dynamic strategies and underlying incentives
driving these attacks. Research can provide valuable insights
into the methods, techniques, and processes employed by
Fig. 2. The most affected sectors. cybercriminals, enabling firms to formulate proactive security
plans. Research plays a crucial role in enabling companies to
discern the indicators of compromise and the assault vectors
employed by diverse threat actors, along with comprehending
automation within businesses can contribute to the expedited
their goals and objectives.
identification and mitigation of potential threats, thereby reduc-
ing the adverse consequences of security breaches. In addition, Research can also aid firms in comprehending the be-
it is advisable for firms to adopt comprehensive cybersecurity havioral and psychological elements that impact consumers’
insurance policies, as they can provide coverage for the fi- vulnerability to social engineering attacks, as well as in devis-
nancial ramifications that may arise from security breaches. It ing proficient awareness and education initiatives to alleviate
is recommended that organizations allocate resources towards such risks. Moreover, the proliferation of remote work and
the implementation of cybersecurity training and awareness the use of cloud-based services have resulted in the expansion
programs. of the attack surface, hence heightening the susceptibility of
enterprises to cyber threats. Research plays a crucial role in
These initiatives aim to mitigate human errors and in-
enabling firms to discern the precise issues presented by these
sider threats, which are prominent factors contributing to data
transformations and formulate effective methods to safeguard
breaches. By adhering to these suggestions, firms can enhance
remote and cloud-based operations. This encompasses the
their readiness for the financial consequences associated with
enhancement of identity and access management, the imple-
data breaches in cloud computing and mitigate their financial
mentation of multi-factor authentication, and the improvement
losses11 . Data breaches can potentially lead to significant
of threat detection and response capabilities. Research can ad-
ramifications for the financial viability and long-term viability
ditionally aid organizations in assessing the security stance and
of companies as shown in Fig. 2 the healthcare sector has the
adherence to regulations of their cloud service providers, as
lion’s share of being attacked. However, these breaches can be
well as establishing explicit roles and duties for the governance
averted and alleviated by implementing appropriate security
of cloud security [18]. The establishment of partnerships and
measures and strategic investments. Conducting research in
cooperation among researchers, cybersecurity professionals,
this domain can assist firms in making well-informed decisions
and other organizations is crucial to proactively addressing
pertaining to their cybersecurity strategy and policies.
the increasing frequency and severity of cybersecurity threats.
The dissemination of knowledge regarding emerging threats
E. Escalating Cybersecurity Attacks and vulnerabilities has the potential to facilitate the creation
The observed surge in cybersecurity attacks throughout the of enhanced security measures12 . The investigation conducted
period spanning from 2022 to 2023 highlights the dynamic in this field has the potential to make a valuable contribution
nature of the threat environment, as shown in Fig. 3. Conduct- to the collaborative endeavor of protecting data and systems
ing research in this domain is crucial in order to investigate in an ever more hostile digital environment.
the characteristics of these attacks and provide efficacious
strategies to mitigate their impact. The complexity and variety F. Gap in Existing Literature
of cyberattacks are increasing, incorporating a wide array of
strategies like ransomware, zero-day flaws, social engineering, Cloud computing is a conceptual framework that presents
and supply chain attacks [18]. In recent years, there has been a multitude of advantages, including scalability, elasticity, and
a notable increase in the occurrence and financial impact cost-effectiveness. However, it also presents notable security
of ransomware attacks. Such attacks consist of an initial obstacles. The presence of security vulnerabilities within cloud
encryption of the victim’s data before requesting a monetary computing has the potential to jeopardize the confidentiality,
ransom for the release of the hijacked information. In terms integrity, and availability of both cloud services and data. This,
of ransomware expenditure, according to a survey by IBM in in turn, can result in significant ramifications for both suppliers
and users of cloud services. Hence, it is important to ascertain
11 https://newsroom.ibm.com/2023-07-24-IBM-Report-Half-of-Breache and evaluate the key security risks in cloud computing and put
d-Organizations-Unwilling-to-Increase-Security-Spend-Despite-Soaring-Bre
ach-Costs 12 https://onlinedegrees.sandiego.edu/top-cyber-security-threats/

www.ijacsa.thesai.org 808 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

abilities refer to inherent weaknesses or deficiencies inside a

given system or application that can be potentially exploited
by malicious actors with the intention of compromising the
system’s confidentiality, integrity, or availability, as well as the
data it houses. Security vulnerabilities can result in significant
consequences for both cloud providers and their clients14 .
These consequences include, but are not limited to, data
breaches, financial losses, legal liability, reputational harm,
and operational disruptions. The following are the impacts of
security vulnerabilities in cloud computing:
1) Cloud misconfiguration: Cloud misconfiguration is a
prevalent security vulnerability that occurs in cloud computing.
Cloud misconfiguration refers to the situation in which a cloud
resource or service is not appropriately configured in accor-
dance with established security best practices or regulations.
An instance may arise if a cloud storage bucket is inadvertently
made accessible to the general public on the internet, hence
enabling unauthorized individuals to get entry to confidential
Fig. 3. Frequency increase of cybersecurity attacks between 2019 and 2023.
information15 .
Alternatively, a cloud user may possess an abundance
of permissions or privileges that exceed the requirements of
forth effective mitigation strategies. Nevertheless, the current their designated position or function. Human error, a lack
body of scholarly work pertaining to cloud security is char- of knowledge base, or insufficient automation can all lead
acterized by fragmentation and dispersion. It predominantly to cloud misconfiguration. Misconfigured clouds can have
concentrates on specific aspects or domains of cloud security detrimental effects on both cloud service providers and users,
while lacking a comprehensive and methodical examination including: Data breaches: Cloud misconfigurations may lead to
that encompasses the diverse security vulnerabilities, their data breaches wherein unauthorized individuals may access,
ramifications, and the corresponding remedies within a unified steal, alter or delete confidential data stored in the cloud16 .
and coherent analysis. The objective of this study is to address Data breaches can have adverse financial implications, legal
the aforementioned deficiency by undertaking a comprehensive obligations, government sanctions, and loss of the reputation
examination of existing literature, known as a SLR, to identify of the customers and the cloud service providers themselves.
and analyze the major security vulnerabilities present in cloud Compliance violations: Cloud misconfiguration leads to non-
computing. A SLR is a methodological approach characterized compliance instances where cloud providers or clients cannot
by its rigorous and transparent nature that aims to locate, observe security standards or obligations enshrined in laws,
evaluate, and synthesize the available body of knowledge rules, contracts, or industry frameworks. Non-compliance in-
pertaining to a certain subject. This study aims to utilize the stances may attract fines, regulatory actions, legal proceedings
SLR approach to present a thorough and current examination or lack of confidence for cloud service providers and their
of the existing research on vulnerabilities in cloud security. customers.
Additionally, it seeks to identify areas where further research Operational disruption: Cloud service/application availabil-
is needed and suggest potential future directions in this field. ity and performance may be impacted by cloud misconfigura-
This study aims to investigate the primary security issues tion. For example, a firewall that is not properly configured can
associated with cloud computing, including questions: What block the lawful traffic network, and a load balancer that is not
are the ramifications of these security vulnerabilities for cloud properly configured can cause the quality of service degrada-
service providers and their clientele? What are the productive tion. Operational disruption can cause customer dissatisfaction,
mitigation solutions for these security vulnerabilities? reduced revenues, and diminished competitive advantage to
cloud providers and their clients.
IV. C LOUD C OMPUTING S ECURITY A SSESSMENT
To prevent or mitigate cloud misconfiguration, cloud
A. Impact of Security Vulnerabilities in Cloud Computing providers and customers should follow some best practices,
Cloud computing refers to providing various computing such as:
services, including storage, servers, databases, networking, a) Enforce the principle of least privilege: The principle of
software, analytics, and intelligence, through the Internet. least privilege suggests that each user or service should possess
Cloud computing has numerous advantages for both enterprises only the essential level of access or permissions necessary
and individuals, encompassing scalability, cost-effectiveness, to carry out their designated tasks. The use of this measure
performance, reliability, and innovation. Nevertheless, the ad-
vent of cloud computing also presents novel security concerns 14 https://www.orientsoftware.com/blog/vulnerability-in-cloud-computing/
and hazards that necessitate attention and resolution from both 15 https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-c
cloud service providers and their clientele13 . Security vulner- loud/the-most-common-cloud-misconfigurations-that-could-lead-to-securit
y-breaches
13 https://www.wiz.io/academy/common-cloud-vulnerabilities 16 https://www.techtarget.com/searchsecurity/definition/data-breach

www.ijacsa.thesai.org 809 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

can effectively decrease the attack surface and mitigate the cessation of these services. Resource abuse is a significant
potential extent of harm in the event of a security breach. worry in the realm of cybersecurity since malevolent actors
exploit communal technology for illicit objectives, resulting
b) Use third-party tools: Third-party technologies can scan in escalated expenses, diminished operational efficiency, and
and identify instances of cloud misconfiguration, as well as compromised availability [19]. In order to address these risks,
offer advice or remedial measures. One illustration of how a it is imperative for both cloud providers and clients to adhere to
cloud-native application protection platform (CNAPP) might established best practices. These include timely patching and
enhance the visibility and security of cloud resources can be update, resource isolation, segregation. Also, constant tracking
observed. and auditing should ensure prompt detection of irregularities
c) Review and audit regularly: Regular evaluation and or any breach in the security.
auditing of cloud configurations by both cloud providers and
4) Insecure interfaces and APIs: Cloud computing security
clients is critical to ensuring adherence to security policies
is a great problem due to insecure interfaces and APIs. The
and best practices. In addition, it is essential for individuals
communication and interaction between the services are done
to diligently oversee and record any modifications or actions
through these interfaces and APIs, but if the interfaces or the
pertaining to their cloud-based assets, with the purpose of
APIs are poorly designed and also not secured, then they can
identifying any irregularities or occurrences.
be the biggest dangers that a system may have. They could
2) Data leakage: Data leakage is a prevalent security risk arise through weaknesses in authentication, inappropriate en-
that is frequently seen in the realm of cloud computing. Data cryption, ineffective input validation, and poor error handling
18
leakage is the unintended or purposeful transfer of data from . The potential outcomes of these vulnerabilities might have
a secure source to an unauthorized destination17 . Unencrypted significant ramifications, such as instances of data breaches
communication lines, unsecured APIs, employees with ill- where confidential data may be illicitly accessed, pilfered,
intent within the organization, hacked passwords, third party altered, or erased. This can lead to financial detriments, legal
dependencies may be potential data leakage avenues. implications, regulatory penalties, and reputational harm for
both cloud service providers and their clientele19 . Furthermore,
Data leakage is a serious threat for cloud service providers service disruptions like DDoS attacks can have an impact on
and their clients. These risks involve data breaches, which can the availability and performance of cloud services and apps.
lead to monetary losses, legal issues, fines, and damage to one’s
reputation. Also, it is worth mentioning that privacy breaches In summary, the exponential expansion of cloud computing
occur when the personal or confidential data is divulged has undeniably revolutionized the manner in which enterprises
without the due authority, therefore leading to identity theft, manage their data and information technology requirements,
fraud, or harassment. Lastly, an unregulated data leakage is presenting a multitude of benefits in relation to adaptability,
also capable of destroying a company’s competitive advantage availability, and cooperation. Nevertheless, this paradigm shift
by revealing sensitive information such as secret knowledge, has concurrently presented a plethora of security concerns and
business strategies, or important assets to competitors. It is vulnerabilities that necessitate resolution in order to safeguard
important to follow the current best practices in order to confidential information and uphold the authenticity of cloud
prevent or mitigate these risks. This involves putting up several infrastructure.
security measures to make sure that the data is not accessed by
individuals without authority to do so. These measures include B. Cloud Security Assessment Techniques
encrypting data both when it is stored and when it is being
transmitted, using secure application programming interfaces 1) Penetration testing: Penetration testing is a technique
(APIs) that comply with recognized security standards, and employed to assess the security of a cloud environment by
deploying data loss prevention (DLP) solutions to identify, emulating an attack originating from a malevolent entity. This
categorize, and safeguard sensitive data. Additionally, access process facilitates identifying familiar and unfamiliar vulnera-
and usage policies are enforced across both cloud-based and bilities inside the cloud environment, encompassing miscon-
on-premise environments. figurations, inadequate authentication mechanisms, insecure
Application Programming Interfaces (APIs), data breaches,
3) Shared technology vulnerabilities: The presence of and more security weaknesses. It contains five stages, as
shared technology vulnerabilities in cloud computing arises shown in Fig. 4. By identifying vulnerabilities that malicious
from the fundamental utilization of common infrastructure, actors could exploit, penetration testing provides valuable
platforms, and software for the provision of services to numer- insights and suggestions for improving the security posture
ous consumers. Consequently, any flaw present in the shared and resilience of the cloud environment.
technology possesses the capacity to pose a possible threat
to all users. These vulnerabilities have the potential to result Penetration testing can be conducted at several levels inside
in data breaches, which can expose sensitive information and the cloud environment, including the network, application,
result in financial losses, legal consequences, and reputational data, and user layers. Penetration testing can be undertaken
damage for both service providers and customers. from several perspectives, including black-box, white-box, or
gray-box, depending on the test’s scope and objectives. Black-
Furthermore, these entities have the potential to interfere box testing emulates the actions of an external adversary
with many services, exemplified by their involvement in denial-
of-service assaults, resulting in the deterioration or complete 18 https://cloudsecurityalliance.org/blog/2022/07/30/top-threat-2-to-cloud-c
omputing-insecure-interfaces-and-apis
17 https://metomic.io/resource-centre/what-are-the-biggest-risks-of-data-lea 19 https://www.darkreading.com/application-security/insecure-apis-a-growi
ks ng-risk-for-organizations

www.ijacsa.thesai.org 810 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

a precise grey box penetration testing methodology known

as TAC. This strategy aims to identify instances of identity
and access management (IAM) vulnerabilities and privilege
escalation (PEs) in third-party services. Third-party cloud
security services are frequently employed to identify potential
PEs resulting from misconfigurations in IAM. In order to
address the dual issues of labor-intensive anonymizations and
potential exposures of sensitive information, TAC engages
with consumers through a selective querying approach that
focuses solely on the relevant information required. The pri-
mary finding of this article is that the IAM configuration
contains a limited amount of pertinent information for the
detection of IAM PE. This study introduces the concept of
IAM modeling, which allows for detecting a wide range of
IAM PEs by utilizing the limited information obtained from
queries. In order to enhance the effectiveness and versatility
of TAC, our objective is to reduce customer contacts by
implementing Reinforcement Learning (RL) in conjunction
Fig. 4. Five stages of penetration testing process. with Graph Neural Networks (GNNs). This integration enables
TAC to acquire the ability to minimize the number of queries
made.
without prior knowledge of the cloud environment. White-box Our approach to penetration testing, especially in the
testing involves emulating an internal attacker who possesses context of mobile cloud computing, is informed by the findings
comprehensive access to and understanding of the cloud in- and methodologies discussed by Bakar et al. in [22] provided
frastructure. Gray-box testing involves emulating a partially a comprehensive overview of penetration testing techniques
informed adversary with restricted access to or understanding and best practices tailored for mobile cloud environments,
of the cloud infrastructure. which is particularly relevant for our research as it addresses
the unique challenges and considerations in these settings.
An example of penetration testing within cloud computing Our penetration testing methodology is significantly influenced
is the AWS Penetration Testing service. This service enables by the groundbreaking work of Vuggumudi et al. in [23]
customers to seek authorization to conduct permitted tests outlined an innovative approach known as Compliance Based
on their AWS resources. An additional illustration may be Penetration Testing (CBPT), specifically tailored for PaaS
in the form of IBM X-Force Red Vulnerability Management environments. This approach underscores the importance of a
Services. This service provides a comprehensive methodology collective approach to security in cloud services, highlighting
for cloud penetration testing, encompassing many aspects the necessity for ongoing monitoring and compliance-aligned
such as infrastructure, apps, data, and users. In our research, testing. Such an approach is vital for our research, considering
penetration testing is critical for assessing cloud security the ever-changing landscape of cloud environments and the
vulnerabilities. This methodology is informed by the insights continuous evolution of regulatory requirements.
provided by Vasenius (2022) in his thesis “Best Practices in
Cloud-Based Penetration Testing.” Vasenius’ comprehensive 2) Vulnerability scanning: Vulnerability scanning is a tech-
analysis of cloud-specific penetration testing approaches, tools, nique of systematically discovering, assessing, and reporting
and best practices offers a valuable framework for our pen- security vulnerabilities in a cloud environment and It goes
etration testing strategy, particularly in the context of cloud through five stages as shown in Fig. 4. It helps enterprises
environments and their unique security challenges20 . uncover gaps in their cloud services, infrastructure, and appli-
cations that potentially threaten the confidentiality, integrity,
In 2022, Khuong et al. in [20] studied a novel architec- or availability of their data and resources. Vulnerability scan-
tural approach called deep cascaded reinforcement learning ning also helps firms comply with security standards and
agents (CRLA). This approach was developed to tackle the regulations, such as PCI DSS, HIPAA, GDPR, and more.
challenge of large discrete action spaces in an autonomous Vulnerability scanning can be performed using numerous tools
penetration testing simulator. In such simulators, the number and approaches, such as automatic scanners, human audits,
of available actions grows exponentially as the complexity code reviews, or ethical hacking. Vulnerability scanning can
of the cybersecurity network being tested increases. Using be split into two types: active and passive. Active scanning
an algebraic action decomposition strategy, the Comparative involves sending probes or queries to the cloud environment to
Reinforcement Learning Algorithm (CRLA) demonstrates su- find vulnerabilities and measure their impact. Passive scanning
perior efficiency and stability in determining the optimal attack involves monitoring the network traffic or records of the cloud
policy in scenarios characterized by extensive action spaces. environment to find vulnerabilities and irregularities.
This outperforms the conventional deep Q-learning agent,
frequently employed as an artificial intelligence approach for An example of vulnerability scanning in cloud computing
autonomous penetration testing. is AWS Amazon Inspector, which is an automated security
evaluation tool that helps clients enhance the security and
In 2023, a research paper by Hu et al. in [21] introduced compliance of their AWS applications21 . Another example is
20 https://www.utupub.fi/handle/10024/173476 21 https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html

www.ijacsa.thesai.org 811 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

Digital Defense Frontline VM, which is a cloud-based vul- 5) Blockchain for improved security: Blockchain technol-
nerability management tool that delivers continuous scanning ogy is expected to be increasingly adopted for cloud security
and reporting of cloud assets. Our research methodology for because it offers decentralized security and reduces single
vulnerability scanning incorporates insights and techniques points of failure. Its potential for ensuring data integrity and
from Mitchell and Zunnurhain’s (2019) study, “Vulnerability preventing tampering will make it a valuable tool in enhancing
Scanning with Google Cloud Platform,” presented at the CSCI cloud data security23 .
conference [24]. This paper presents a detailed examination
6) Rise in cybersecurity mesh: Cybersecurity mesh is a
of vulnerability scanning methods within the Google Cloud
flexible, modular approach that integrates various security
Platform, offering a specific lens on how these scans can be
services. This trend will allow organizations to deploy and
effectively utilized in cloud-based environments. Their work
integrate security where it’s most needed and manage it
provides a valuable perspective on the practical applications
in a more unified way, thus improving the overall security
and challenges of conducting vulnerability scans in such
posture24 .
settings, directly relevant to our research focus.
We have heavily referenced the comprehensive analysis V. C ONCLUSION
by Kritikos et al. [25] that meticulously evaluated the latest
tools and databases pertinent to vulnerability assessment in the Cloud computing has rapidly changed how firms manage
cloud. The survey’s detailed insights into these tools’ perfor- their data and IT demands, providing flexibility, accessibility,
mance, range, and functionalities significantly influence our and cooperation. This change has also revealed many
methodology, particularly in selecting and implementing the security risks that must be addressed to secure sensitive data
most effective techniques for extensive vulnerability scanning and cloud settings. Mismanaging cloud resources or data
in cloud-based applications. frequently results in cloud misconfiguration and data leakage.
These vulnerabilities can cause data breaches, compliance
violations, and financial losses for cloud providers and clients.
C. Future Trends in Cloud Computing Security Additionally, cloud-based shared technological vulnerabilities
As cloud computing evolves, staying ahead of emerging are risky. Cloud computing allows numerous enterprises to
security challenges is crucial. Cloud security landscape is share infrastructure and platforms, which can expose sensitive
expected to undergo significant changes in the coming years, data to breaches, service outages, and resource misuse if
influenced by technological advancements and shifts in cyber not properly secured. Quick patching, resource isolation,
threats. Below are key trends that are likely to shape the future and monitoring can mitigate these shared vulnerabilities.
of cloud computing security: Furthermore, understanding the shared responsibility concept
is crucial. This model defines cloud service providers and
1) Increased reliance on AI and Machine Learning (ML): customer security duties. Organizations must know how to
AI and ML are set to play a pivotal role in cloud security. These secure their cloud resources and data and use cloud providers’
technologies can analyze vast amounts of data to identify tools and services to improve security. Cloud services and
patterns indicative of cyber threats, enabling proactive threat emerging technologies like IoT and AI drive exponential data
detection and response. As cyberattacks become more sophisti- growth in cloud environments, creating unique problems.
cated, AI-driven security systems will be critical in identifying Securing varied cloud environments becomes more difficult
and neutralizing threats before they can cause damage[26]. as firms adopt multi-cloud strategies. Cloud data security
2) Greater emphasis on zero trust architectures: The tradi- and compliance need risk assessments, careful cloud
tional security model of ’trust but verify’ is shifting towards a service provider selection, and industry-specific requirements.
’never trust, always verify’ approach. Zero Trust Architecture Ransomware, zero-day exploits, social engineering, and supply
(ZTA) will become more prevalent, where security protocols chain assaults are becoming more sophisticated, requiring
require verification from everyone attempting to access re- cybersecurity specialists, corporations, and researchers to
sources in the network, regardless of whether they are inside share knowledge and information. To succeed in this changing
or outside the network perimeter. This approach minimizes the world, enterprises must take a proactive, holistic approach
risk of internal threats and data breaches [27]. to cloud security, covering technological and organizational
factors. In an ever-changing digital world, organizations
3) Expansion of edge computing: As the Internet of Things may protect their data, manage risks, and maintain their
(IoT) expands, edge computing will become more common, reputation and financial stability by remaining educated about
processing data closer to where it is generated rather than in new threats and vulnerabilities, applying best practices, and
a centralized cloud-based data center. This shift will require enhancing their cloud security maturity.
new security strategies to protect data across more dispersed
networks22 .
4) Enhanced regulatory compliance: With the growing ACKNOWLEDGMENT
concern over data privacy and security, regulatory compliance This work was made possible in part by a grant from
will become more stringent. Companies must adapt to these the university, which allowed us to conduct the research
regulations, which will likely require more robust security and collect the necessary data. This work was supported
measures to protect sensitive data, especially in industries like
healthcare and finance [28]. 23 https://www.computer.org/publications/tech-news/trends/blockchain-clo
ud-integration
22 https://techresearchonline.com/blog/edge-computing-an-extension-of-clo 24 https://securityintelligence.com/articles/cloud-security-trends-cybersecuri
ud-computing/ ty-mesh/

www.ijacsa.thesai.org 812 | P a g e
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 15, No. 2, 2024

through the Annual Funding track by the Deanship of Scientific [14] C. Stergiou, K. E. Psannis, B. B. Gupta, and Y. Ishibashi, “Security,
Research, Vice Presidency for Graduate Studies and Scien- privacy & efficiency of sustainable cloud computing for big data & iot,”
tific Research, King Faisal University, Saudi Arabia [Project Sustainable Computing: Informatics and Systems, vol. 19, pp. 174–184,
2018.
No.GRANT5,690].
[15] S. Parikh, D. Dave, R. Patel, and N. Doshi, “Security and privacy issues
in cloud, fog and edge computing,” Procedia Computer Science, vol.
R EFERENCES 160, pp. 734–739, 2019.
[1] B. Prabadevi and N. Jeyanthi, “Distributed denial of service attacks [16] M. Ahmed and A. T. Litchfield, “Taxonomy for identification of
and its effects on cloud environment- a survey,” The 2014 International security issues in cloud computing environments,” Journal of Computer
Symposium on Networks, Computers and Communications, 2014. Information Systems, vol. 58, no. 1, pp. 79–88, 2018.
[2] B. Alouffi, M. Hasnain, A. Alharbi, W. Alosaimi, H. Alyami, and [17] Y. Guan, J. Shao, G. Wei, and M. Xie, “Data security and privacy in
M. Ayaz, “A systematic literature review on cloud computing security: fog computing,” IEEE Network, vol. 32, no. 5, pp. 106–111, 2018.
threats and mitigation strategies,” IEEE Access, vol. 9, pp. 57 792– [18] M. Alawida, A. E. Omolara, O. I. Abiodun, and M. Al-Rajab, “A deeper
57 807, 2021. look into cybersecurity issues in the wake of covid-19: A survey,”
[3] P. Akello, N. L. Beebe, and K.-K. R. Choo, “A literature survey of Journal of King Saud University-Computer and Information Sciences,
security issues in cloud, fog, and edge it infrastructure,” Electronic 2022.
Commerce Research, pp. 1–35, 2022. [19] Y. S. Abdulsalam and M. Hedabou, “Security and privacy in cloud
[4] M. Humayun, M. Niazi, N. Jhanjhi, M. Alshayeb, and S. Mahmood, computing: technical review,” Future Internet, vol. 14, no. 1, p. 11,
“Cyber security threats and vulnerabilities: a systematic mapping study,” 2021.
Arabian Journal for Science and Engineering, vol. 45, pp. 3171–3189, [20] K. Tran, M. Standen, J. Kim, D. Bowman, T. Richer, A. Akella, and C.-
2020. T. Lin, “Cascaded reinforcement learning agents for large action spaces
[5] R. Shaikh and M. Sasikumar, “Security issues in cloud computing: in autonomous penetration testing,” Applied Sciences, vol. 12, no. 21,
A survey,” International Journal of Computer Applications, vol. 44, p. 11265, 2022.
no. 19, pp. 4–10, 2012. [21] Y. Hu, W. Wang, and M. Tiwari, “Greybox penetration testing on cloud
[6] N. Kumar and J. K. Samriya, “Security issues in cloud computing: A access control with iam modeling and deep reinforcement learning,”
survey.” arXiv preprint arXiv:2304.14540, 2023.
[7] A. Patel, N. Shah, D. Ramoliya, and A. Nayak, “A detailed review [22] A. B. Bakar, M. S. bin Che Mansor, M. S. A. bin Omar, and M. F. Bin,
of cloud security: issues, threats & attacks,” in 2020 4th International “Fundamental study of penetration testing on mobile cloud computing.”
conference on electronics, communication and aerospace technology [23] S. Vuggumudi, K. Ragothaman, and Y. Wang, “Compliance based
(ICECA). IEEE, 2020, pp. 758–764. penetration testing as a service — aisel.aisnet.org,” in Proceedings of the
[8] H. Tabrizchi and M. Kuchaki Rafsanjani, “A survey on security chal- Seventeenth Midwest Association for Information Systems Conference,
lenges in cloud computing: issues, threats, and solutions,” The journal 2023.
of supercomputing, vol. 76, no. 12, pp. 9493–9532, 2020. [24] N. J. Mitchell and K. Zunnurhain, “Vulnerability scanning with google
[9] A. Sharma, U. K. Singh, K. Upreti, and D. S. Yadav, “An investigation cloud platform,” in 2019 International Conference on Computational
of security risk & taxonomy of cloud computing environment,” in 2021 Science and Computational Intelligence (CSCI). IEEE, 2019, pp.
2nd International Conference on Smart Electronics and Communication 1441–1447.
(ICOSEC). IEEE, 2021, pp. 1056–1063. [25] K. Kritikos, K. Magoutis, M. Papoutsakis, and S. Ioannidis, “A survey
[10] R. M. Jabir, S. I. R. Khanji, L. A. Ahmad, O. Alfandi, and H. Said, on vulnerability assessment tools and databases for cloud-based web
“Analysis of cloud computing attacks and countermeasures,” in 2016 applications,” Array, vol. 3, p. 100011, 2019.
18th international conference on advanced communication technology [26] A. Li and W. Huang, “A comprehensive survey of artificial intelligence
(ICACT). IEEE, 2016, pp. 117–123. and cloud computing applications in the sports industry,” Wireless
[11] S. Shetty, N. Luna, and K. Xiong, “Assessing network path vulner- Networks, 2023.
abilities for secure cloud computing,” in 2012 IEEE International [27] L. Ferretti, F. Magnanini, M. Andreolini, and M. Colajanni, “Survivable
Conference on Communications (ICC). IEEE, 2012, pp. 5548–5552. zero trust for cloud computing environments,” Computers & Security,
[12] R. Kumar and R. Goyal, “On cloud security requirements, threats, vul- vol. 110, p. 102419, 2021.
nerabilities and countermeasures: A survey,” Computer Science Review, [28] S. E. Kafhali, I. E. Mir, and M. Hanini, “Security threats, defense
vol. 33, pp. 1–48, 2019. mechanisms, challenges, and future directions in cloud computing,”
[13] P. Sun, “Security and privacy protection in cloud computing: Discus- Archives of Computational Methods in Engineering, vol. 29, pp. 223 –
sions and challenges,” Journal of Network and Computer Applications, 246, 2021. [Online]. Available: https://api.semanticscholar.org/Corpus
vol. 160, p. 102642, 2020. ID:255412617

www.ijacsa.thesai.org 813 | P a g e