Cloud computing has transformed the delivery and management of IT services. As a utility, cloud-computing solutions reduce IT expenses for individuals, agencies and businesses. It moves data and computing from the traditional portable devices and desktops to large data centers. With this revolution, the demand for cloud computing can be expected to grow exponentially (Hartig, 2009).
However, as this technology develops, so do threats and vulnerabilities that affect many users. These vulnerabilities and threats may result to illegal access of critical or confidential data. With the innovation of cloud computing, users do not have to purchase hardware, software and storage devices. A provider through servers and networks can provide these services. Organizations should be aware of these threats and vulnerabilities as they embrace this technology in order to protect their users from crime.
Abuse and Suspicious Use of Cloud
Users receive various types of services from cloud providers, such as bandwidth and storage capacity. Some service providers provide their users with a free trial period that gives hackers and malicious users an opportunity to access the cloud with nefarious intentions. Spammers and other criminals take advantage of the simple procedures, relatively anonymous access and convenient registration to access the cloud and launch malicious attacks (Hicks, 2009a).
Some of the impacts of their attacks include cracking passwords, decoding and building rainbow tables. Hackers and cybercriminals also take advantage of the fact that cloud service providers have limited fraud detection capabilities to launch dynamic attack points, conduct malicious data hosting and execute botnet commands. For example, some hackers use flash files and other content rich applications that allow them to install malware by utilizing users’ browsers (Spitzner, 2011)
To lessen this threat, service providers need to establish stricter initial registration and validation processes. Credit card fraud monitoring and coordination efforts should be enhanced, as well as stepping up introspection of customer network traffic. Another area requiring rigorous monitoring is the public blacklists for the service provider’s network blocks. This will assist in protecting the integrity of clients’ data, some of which could be sensitive (Backhouse & Dhillon, 2000).
Insecure Interfaces and Application Programming Interfaces
Cloud customers are able to interact and manage cloud services through interfaces and APIs. Service providers need to secure their service models because they play an important role in the orchestration, provisioning, and management and monitoring of the processes of running the cloud. Customers on the other hand, must be aware of the security risks associated with the use, implementation and management as well as monitoring of the cloud services (Schreiber, 2004).
The security of these service models affects the security and availability of cloud services, and therefore, they should include features of authentication, access controls, encryption and monitoring of activities. A weak set of APIs and interfaces results to a variety of security issues, including malicious or unidentified access, API dependencies, inflexible access controls, reusable tokens/passwords, limited monitoring/logging capabilities, anonymous access, clear text transmission and/or authentication of content and improper authorizations. These security issues affect the confidentiality, integrity, availability and accountability of a data in the cloud. The security model of cloud providers interfaces should be analyzed to ensure they are effective. Service providers should implement strong authentication processes and access controls and in concert with encryption transmission. They should also be aware and understand the chain associated with the API (Flavio & Roberto, 2010).
Advanced persistent threats are some of the threats facing cloud computing in this era. Insider attacks are becoming a common occurrence in this technology and are orchestrated by employees at the provider or user’s site (Anderson & Rainie, 2010). A malicious insider can access cryptographic keys and files as well as passwords that can allow them to participate in information theft, damage and fraud.
Insiders can also by-pass or bend of security control and engage in other acts of security breaches, and hence, compromise the security controls established to safeguard information systems from attacks against integrity, confidentiality and availability of IT systems, networks and the data in the cloud. The problem of insider attacks has been on the rise especially due to lack of transparency in the processes and procedures of providing cloud services (Underwood, 2012). This means that a provider may not reveal how access is granted to employees and how their access is monitored and how reporting and policy compliance is analyzed.
Additionally, customers may not understand the hiring practices of their service providers that could make room for an adversary, hackers or other cyber-criminals to steal confidential information or even take control of the cloud. The level of access granted could be an avenue for accessing confidential data or taking control of the cloud services with little or no risk of detection. Malicious insider attacks pose a great threat to the brand reputation and productivity as well as the financial well-being of an organization (Underwood, 2012). The overall premise behind insider attack is the use of much unsophisticated methods of tricking or coercing users into doing something they would normally not do. For example, an insider may send a phishing email to a user who ends up downloading a malicious code onto their computer or whichever device they are using. According to Spitzner (2011), one hundred percent of all successful compromises are a result of an insider assisting the attacker.
It is imperative that organizations implement policies to mitigate the threat of an insider taking part in an advanced persistent threat. Separation of duties is an important concept in the internal controls, though sometimes difficult and costly to implement. This objective is achieved by allocating tasks and associate privileges to multiple people for a specific security process. Separation of duties in the IT organization is fundamental and it’s the mandate of firms to apply it for regulatory purposes (Backhouse & Dhillon, 2000). As a result, IT organizations should lay more emphasis on separation of duties in all their functions, especially security.
Separation of duties achieves two objectives in relation to security. First, it prevents conflict of interest, wrongful acts, errors, fraud and abuse that occur in case of conflict of interest (Backhouse & Dhillion, 2000). The other very important objective is the detection of control failures including information theft, security breaches and by-pass or bending of security controls.
Due to the cloud virtualization, service providers reside their users’ applications on virtual machines based on shared infrastructure. The virtual machines are not designed to accommodate a multi—tenant architecture and are based on the physical hardware of the cloud provider (Karthick et. al., 2011). Overlooked flaws in technology have enabled guest operating systems to obtain unauthorized levels of control and influence on the platform. In order to maintain the security of the users, service providers are isolating their VMs to prevent one malicious VM from affecting the others under the same provider.
In order to provide virtual memory as well as schedule CPU caches policies to VMs, VMs are managed by hypervisor. In addition, since the hypervisor is the main way of managing a virtualized cloud platform, hackers are targeting it in order to gain access to VMs and physical hardware because it resides in between the two (Siani, 2009). This means that an attack on hypervisor can damage both the VMs and hardware. Service providers should employ strong isolation to ensure that VMs are not able to access or affect the operations of other users running under the same cloud service provider. Moreover, service providers should implement the best practices for configuration and monitor the environment for unauthorized activity. The authentication and access operations should be strengthened in addition to enforcing procedures for patching and vulnerability remediation. Vulnerability scanning and configuration audits should also be promoted.
Data Loss or Leakage
Data loss refers to compromised data that may include deletion or alteration of records without first making a backup of the original content which can be intentional or unintentional (Farell, 2008). It can also occur in the course of unlinking part of a record from the larger context, unauthorized access of confidential data and loss of an encoding key. Data loss and leakage can result from various issues including: operational failures; inconsistent use of encryption keys; authorization and audit controls; political issues; disposal challenges; insufficient authentication; inconsistent software keys; persistence and remanence challenges; risk of association; disaster recovery and unreliable data storage (Tim et.al., 2009). Unreliable data storage occurs when data is stored on unreliable media that will be impossible to recover if data is lost. Inconsistent use of encryption keys will lead to both loss of the data and unauthorized access of the data by illegal users, resulting to destruction of sensitive and confidential information.
An example of data loss is the case of twitter hacks. Twitter online hackers accessed accounts and numerous sensitive corporate documents housed in Google’s online web office service Google Docs were stolen. The security of twitter data was not efficient enough, since the entire company data was only a single password crack away from discovery. This shows the effect of a data leakage on a brand, its reputation and the trust of partners, employees and users. Loss of core intellectual property has noncompliance and legal consequences beside the competitive and financial implications involved (Farell, 2008).
Cloud providers need to specify backup strategies and generate strong key generation, management, storage and destruction practices. The integrity of data in transit should be protected and such data should be encrypted if possible (Flavio & Roberto, 2010). API access should be strongly controlled, while providers should be expected to wipe persistent media before releasing it into the pool.
Account or Service Hijacking
Account or service hijacking occurs when hackers gain unauthorized access and control users’ accounts usually by using stolen credentials. Such attacks include fraud, phishing and exploitation of software vulnerabilities. Attackers can use stolen credentials and spy on users’ sensitive activities, return falsified information, redirect information to illegitimate sites, manipulate data and hence compromise the integrity, confidentiality and availability of the cloud computing services (George, 2011). Attackers are using users’ accounts as a new base to leverage cloud service providers’ reputation by launching constant attacks. Monitoring should be proactive to detect unauthorized activity and prohibit users and services from sharing credentials. Clients should also understand the security policies of cloud providers.
Unknown Risk Profile
With the innovation of cloud computing, organizations are less involved with acquiring and/or maintain hardware and software. However, users need to understand software versions, code updates, intrusion attempts and other security practices (Hicks, 2009a). While these features and their functionality may be well advertised when adopting cloud-computing services, the details of compliance to the internal security procedures, patching, auditing, logging and configuration hardening may not be clear. Users need clarification about how and where their data and related logs are stored since an unknown risk profile may include serious threats. Infrastructural details should be partially or fully disclosed, as well as should the logs and data.
Cloud Computing Vulnerabilities
Several significant vulnerabilities exist that organizations should consider before they start to use cloud computing services as described below.
Session Riding and Hijacking
Session hijacking refers to the use of a valid session to obtain unauthorized access to the information in a computer system or theft of a user authentication cookie used in accessing a remote server. The cookie is also used in web application technologies weaknesses in the web application structure and is easily accessible to hackers, giving them an opportunity to carry out a wide variety of malicious activities (Brohi & Bamiah, 2011). Session riding refers to hackers sending commands to web applications on behalf of users by tricking the targeted user. Hackers send an email to the user or coerce him to visit a specially crafted website.
Session riding executes online transactions, deletes user data, and sends spam to an intranet through the internet. Other outcomes of session riding are changes to the system and network configurations as well as opening the firewall (Tim et. al., 2009). Additionally, web technologies and refinement evolve new ways of compromising data, provide access to otherwise secure networks and pose threats to the smooth running of online business.
Virtual Machine Escape
Cloud computing servers make use of the same web applications, OS and enterprise as localized VMs and physical servers. The probability of a malware or hacker to remotely exploit vulnerabilities in these systems and applications is a great threat to virtualized cloud computing environments (Hartig, 2009). Locating multiple VMs jointly increases the attack surface and the risk of compromise from VM – to VM. Security systems should be capable of detecting intrusion and malicious activity at VM level, regardless of where the VM is located within the virtualized cloud environment.
VM escape is a significant vulnerability that enables guest-level VM to attack the host VM. An attacker runs a code on a VM allowing an OS to run within it to break out and interact with the hypervisor (Schreiber, 2004). This enables an attacker to access the host OS and all other VMs running on that particular host. The complexity of Hypervisors and VMs may increase the threat to attack surface that weakens security, such as check pointing, migration of VMs and paging.
Reliability and Availability of Service
Another significant cloud computing vulnerability is reliability and availability. In the event of glitches in infrastructure such as failure to cloud storage, data may be inaccessible or even lost (Flavio & Roberto, 2010). With more services being developed on top of cloud, computing infrastructures, a failure or outage can create a domino effect by interrupting many internets based applications and services. This raises questions such as what forms of settlement exist for stakeholders in cases of failures, what is the responsibility of cloud providers and what procedures should be put in place to overcome these issues.
Organizations have come up with algorithms and cryptographic mechanisms as means to secure their data. However, attackers have discovered means to decode these security mechanisms and hack them. This is so because it is common for crucial flaws to exist in the implementation of cryptographic algorithms, which can change strong encryption into weak encryption that is vulnerable to attack (Spitzner, 2011).
Although VMs provide more flexible and efficient set-up than traditional servers in cloud providers’ data centers, they still lack enough access to generate random numbers required to properly encrypt a data, and this becomes a big problem. How do computers generate truly random numbers that cannot be replicated or guessed? In PCs, mouse movements and key strokes are monitored by an OS to gather bits of a data that is collected in an entropy pool (Underwood, 2012). In servers with neither a mouse nor a keyboard, random numbers are pulled from the movements of the computer’s hard drive. According to Schreiber (2004), the random numbers gathered from the movements of VMs’ internal clock is not enough to generate strong encryption keys.
Data Protection and Portability
Services are offered on contractual bases between a client and the provider. However, it is not clear what happens when the contract is terminated and the client does not want to continue. Is the client’s sensitive data going to be deleted or is it going to be misused by the provider. The other issue is what would happen to the services and the client’s data if the provider were to go out of business for any reason. Data portability therefore becomes a main weakness in cloud computing (Karthick et. al., 2011)
Vendor Lock In
New business models and immature service providers has raised the risk of business failure. Lock-in makes a client unable to deal with another provider without a good amount of switching costs due to dependence on one provider for products and services. Before the process of selecting a provider, clients need to be sure of their potential provider (Hartig, 2009). Clients may also remain locked in to one provider due to lack of standards. They do not have the freedom to migrate easily from one provider to another because of the heterogeneous policies and standards set by each provider.
Cloud computing is dependent on the internet technology where users access services via the web browser. With internet outage, critical clients systems and operations such as healthcare that are supposed to run 24 hours cannot be accessed, and the outcome could be disastrous.
Cloud computing is flexible, multi-shared and scalable with a high capacity that gives business an innovative shape. However, these benefits are reduced by the vulnerabilities and threats that face the cloud. Significant contributions are required to ensure the safety of this technology and its development (Siani, 2009). In-depth security mechanisms and policies need to be designed to counter these threats and vulnerabilities and ensure the security of users and maintain their trust.