## 4 Main Security and Privacy Challenges
### Cloud Paradigm Challenges
However, some employees have higher status, which guarantees them the privilege of accessing certain essential data within the company. Based on CSA, they proposed the implementation of transparency in the general data security and management activities standard, outlining notification procedures during security failures, while using Service Level Agreement (SLA) as a demand for human resource, and finally establishing and exercising strict rules in the management of supply chain [105]. It may be far easier for a person with malicious ideas to work for a CSP since no one is seen as a suspect [106]. This individual can quickly be involved in malicious events, especially if they have unhindered access to sensitive information, especially if the CSP cannot strictly monitor its workers. * Identity Theft: Victims or organizations can suffer heavy impact due to weak passwords due to phishing attacks by some attackers who turn to disguise as authentic persons to steal the different important data of their victims. The sole reason for identity theft is to gain access to sensitive digital resources of individuals and companies by any malicious means. Every protected communication within the Cloud system happens with access control, and this is made possible using an encryption key [107]. * Man-in-the-Middle Attack: During the flow of data from one end to another or between different systems, cybercriminals can easily take advantage and gain access, therefore having control of classified data. This can easily occur when the secure socket layer (SSL) is insecure due to inadequate configuration. Specifically, in Cloud systems, hackers can attack the communication within the information centers. Efficient SSL configuration and data analysis among accepted entities can go a long way to significantly lower the threat posed by a middle-man attacker [108]. * The DoS attack aims to limit or stop the execution of service and from accessing needed data. This creates a scenario where actual users partially or fully lack service availability. Whenever the right person uses the Cloud services to reach the data server to access information, access is denied. This happens because the attacker uses a method in which he constantly congests the server of a precise resource through request flooding, and the targeted server will then be unable to reply to a legitimate access request. There exist several ways this attack can be performed, for example, by way of SQL injection attack, bandwidth wastage, and also by way of incorrectly using model resources [109]. * Phishing Attack is one of the most common attacks in which the criminal turns to impersonate and deceive their victims by leading them to malicious links. The presence of the Cloud makes it flexible for hackers to hide their Cloud hosting of numerous accounts of different clients that uses Cloud services using phishing activities. There are two kinds of threat divisions in which phishing can be grouped. Primary, irresponsible attitude whereby a cybercriminal can also make full use of Cloud services to simply host a site for a phishing attack. Secondary, Cloud computing services and their many accounts can be hijacked [110].