# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 2 Background and Related Work
### CSC Cloud Security Concerns  
As consumers increasingly rely on cloud services and data uploads, monitoring for security becomes challenging. Consumer organizations must ensure data security with cloud providers, but providers are often reluctant to share security details, featuring reputational damage [19]. This lack of trust is a major barrier to cloud adoption for sensitive data handling [5]. To address this, a mechanism is needed for consumers to easily assess their data's security in the cloud. It is not necessary for all data to have identical protection standards, and some organizations may opt for cloud services across only certain data sets [14]. Yet, inherent security issues do persist, such as data loss, changing providers, and insider threats. Requirements for ensuring the security of cloud systems include elements such as authentication, authorization, liability, and privacy [6] and are often expressed collectively as confidentiality, integrity, and availability (CIA). Confidentiality covers data privacy where consumer data is not exposed to third parties without the consumers' expressed consent. Integrity refers to the protection of data stored in the cloud against unauthorized access or modification [15]. Availability refers to the services provided by the CSP being immediately available when expected and needed by the consumer. Authentication is a guarantee that when a person claims ownership of data, it is properly identified and authorized to access the data and consummate services. Authorization assures that a person has the proper access rights and is presumably to act on the designated cloud data in proper accordance [17]. Accountability holds persons or processes accountable for performing an activity on the data (i.e., non-repudiation) [18]. Non-repudiation is complete when the CIA holds and represents the transitive nature of the full repertoire of cloud services. Therefore, prior to employing the cloud, an organization must be certain about the security properties being provided by the CSP. Cloud services may cause some adoption risks, of which consumers must be made aware. Conversely, CSPs can bring security benefits that may be unknown to the CSC. Metrology should support the decision to move data to the cloud. Too often, this decision depends on how the risk of adopting CSP security guarantees will reduce the overall cost of data storage and the requisite services. CSCs should have greater transparency as to whether those benefits can be enjoyed while simultaneously avoiding the inherent risk of exfiltration, extrusion, and/or destruction [20]. The Cloud Security Association Consortium (CSAC) advises using established best practices to secure cloud-stored data, but challenges persist, especially regarding data security assurance [21; 22]. Cloud data insecurity can be attributed to the lack of (i) strong controls, (ii) shared resources, (iii) multi-tenancy, and (iv) visibility. Tailored encryption and access control measures are essential, yet they can inadvertently expose sensitive data. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Delivery Models** & **Cloud Consumer Activities** & **Cloud Provider Activities** \\ \hline SaaS & Utilizes and configures cloud & Implements, manages, and maintains cloud services. \\  & & CSC tracks usage. \\ \hline PaaS & Develops, tests, deploys, and manages cloud services and cloud-based solutions & Pre-con platforms and allocates the necessary underlying resources, middleware, and other IT resources as needed. The cloud consumer tracks usage. \\ \hline IaaS & Involes establishing and configuring fundamental infrastructure, and the installation, administration, and monitoring of necessary software. & Offers and controls the physical processing, storage, networking, and hosting required. Cloud consumers track usage. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Consumers Against Provider Activities About Delivery Models.