# Security Issues in IoT and Cloud Computing Service Models with Suggested Solutions

Authors: Dinesh Kumar Saini; Krishan Kumar; Punit Gupta
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Cloud computing is a new model for providing computing services, where computing is delivered as a service over the Internet. Cloud computing is a very popular choice among SMEs because computing services are provided at much lower prices compared to their own IT infrastructure. In the cloud computing model, computing services and data storage are outsourced to cloud service providers. Customers do not have full control over applications and their data. Therefore, an added overhead of security risks comes along, and the security of data becomes the primary concern for cloud customers when considering cloud services. This paper explores various deployment models of cloud computing services and IoT (Internet of Things), figures out associated data security issues with them, and suggests a metric-based solution to assess security provided by cloud services.


---

## Body

## 1. Introduction

NIST (National Institute of Standards and Technology) mentions, “cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction” [1].Cloud computing offers many great benefits like agility, scalability, sustainability, reliability, and affordability, yet customers (especially data-sensitive organizations like banks, defense, government, and financial institutions) think critically about opting for cloud services because data security is the main concern behind their reluctance.Cloud service providers (CSPs) focus on security mechanisms primarily because security is the most important attribute in the deployment and use of cloud computing services [2]. Mostly, available literature talks about different security solutions to encounter existing threats and service-level agreements of security policy implementation, but the challenging part is that data security is a spiral process that must be reviewed consistently, and new security solutions must take place in order to address anticipated future attacks. To implement new security solutions, CSPs and cloud customers must ensure that to-be-implemented security solutions should address two key aspects. First, they should not compromise with the performance; second, they should be able to gauge future attacks.This paper is organized into six sections.(i)
Section2 of this paper talks about cloud computing models and services.(ii)
Section3 sheds light on different threats that occur in the cloud computing environment.(iii)
Section4 highlights security issues in various computing services.(iv)
Section5 lists security assessment metrics that help cloud customers to decide upon the data and application security in cloud.(v)
Section6 proposes a model for cloud security assessment using metrics mentioned in Section 5.(vi)
Section7 talks about the research conclusion and future prospects.


## 2. Cloud Deployment Models and Cloud Computing Services

According to NIST, there are five essential characteristics of cloud, “on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service” [3]. All cloud deployment models and services must have these characteristics.There are two basic types of cloud deployment models: private and public. By mixing these two types, there emerge two more variants: hybrid and multicloud.According to Armbrust et al.,private cloud is used to set up internal data centers of an organization. Private clouds are not for public use, whereas public clouds are deployed to use by organizations on a pay-as-you-go basis [4]. Public clouds offer shared resources; that is why they are the most affordable computing solutions for small- and medium-sized enterprises.Cloud customers subscribe to public clouds for computing services by paying monthly or annual subscription fees depending upon the services they use and their service contract. Some examples of well-known public cloud providers are Microsoft Azure, Amazon Web Services (AWS), and Google Cloud.According to NIST, hybrid cloud is “a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together” [3].According to RedHat, “multicloud is a cloud approach made up of more than one cloud service, from more than one cloud vendor, public or private” [5].Figure1 depicts various cloud deployment models.Figure 1
Different types of cloud deployment models.Cloud deployment models offer four types of cloud computing services. A cloud computing service tells about what resources will be provided as part of the computing service. These cloud computing services are software as a service (SaaS), platform as a service (PaaS), infrastructure as a service (IaaS), and database as a service (DBaaS).


### 2.1. IaaS

In infrastructure as a service, CSP manages hardware part like virtual machines (VMs), storage, and networking, while cloud customer manages operating systems and other types of required software for their business needs like middleware, runtime environments, database, and application software [6]. Some IaaS examples are Microsoft Azure, Amazon Web Services (AWS), and Google Compute Engine (GCE).


### 2.2. PaaS

Platform as a service is one layer above IaaS. In PaaS, CSP manages IaaS along with basic software stack like operating systems, utility and analytics software, development tools, and database management systems, whereas cloud customer manages application software and services [7]. Azure App Service, AWS Elastic Beanstalk, and Google App Engine are some examples of PaaS.


### 2.3. SaaS

As the name suggests, software as a service delivers application software over the Internet. CSP manages everything in this model of computing service from hardware to application software [7]. Cloud customers access the application software over the Internet without bothering of complex software and hardware management. Microsoft Office 365, Google Drive, Dropbox, and Cisco WebEx are some examples of SaaS.Figure2 shows servicewise resource provisioning in various cloud computing services.Figure 2
Resource provisioning in cloud computing.


## 2.1. IaaS

In infrastructure as a service, CSP manages hardware part like virtual machines (VMs), storage, and networking, while cloud customer manages operating systems and other types of required software for their business needs like middleware, runtime environments, database, and application software [6]. Some IaaS examples are Microsoft Azure, Amazon Web Services (AWS), and Google Compute Engine (GCE).


## 2.2. PaaS

Platform as a service is one layer above IaaS. In PaaS, CSP manages IaaS along with basic software stack like operating systems, utility and analytics software, development tools, and database management systems, whereas cloud customer manages application software and services [7]. Azure App Service, AWS Elastic Beanstalk, and Google App Engine are some examples of PaaS.


## 2.3. SaaS

As the name suggests, software as a service delivers application software over the Internet. CSP manages everything in this model of computing service from hardware to application software [7]. Cloud customers access the application software over the Internet without bothering of complex software and hardware management. Microsoft Office 365, Google Drive, Dropbox, and Cisco WebEx are some examples of SaaS.Figure2 shows servicewise resource provisioning in various cloud computing services.Figure 2
Resource provisioning in cloud computing.


## 3. Security Threats in Cloud

Cloud computing is the preferred computing solution for small- and midsized enterprises because they have to spend less on IT infrastructure management and maintenance [8]. However, the security of data is their main concern when SMEs think of opting for cloud services. Data security in cloud eventually ascertains the safety of data that leads to winning customer’s trust in CSP.According to CSA (Cloud Security Alliance), most notable security issues in cloud are data breaches, misconfiguration of cloud resources, poor security architecture and strategy, poor credential and access management, insider threat, account hijacking, insecure APIs, weak control plane, metastructure failures, cloud usage visibility, and cloud service abuse [9]. Table 1 lists down major security incidents that happened over the last decade.Table 1
Security issue incidents in cloud.
S. no.Type of threatBusiness impactSecurity issue1Uber’s AWS account was hacked in 2016, which compromised 57 million users’ personal information worldwide [10]Loss of reputation and trust of customers or partnersData breach2Voipo database containing customer call information and credentials became a victim of a data breach in 2019 [11]Legal and contractual liabilitiesData breach3In 2017, AWS S3 misconfiguration caused a data leak of 123 million American households [12]Confidential information leakageMisconfigurations and inadequate change control4In 2017, Accenture negligently left private data across four unsecured Amazon S3 buckets that exposed passwords and secret decryption keys [13]Severe business impact like financial loss and reputation damageLack of cloud security architecture and strategy5In 2017, hackers managed to get OneLogin’s AWS keys to gain access to the company’s AWS platform via APIs from an intermediate host [14]Snoop on data in transit and data in restInsufficient identity, credential, access, and key management6In June 2014, code spaces failed to protect its administrative console with multifactor authentication [15]Loss of confidential informationAccount hijacking7In 2018, Tesla suffered a malicious insider attack [16]Loss of confidential information and intellectual informationInsider threat8In 2018, Facebook suffered a significant data breach affecting more than 50 million [17]Loss of confidential user informationInsecure interfaces and APIs9In 2018, more than 120 million unique identification numbers issued by the Brazilian Federal reserved for Brazilian citizens were exposed from S3 bucket because of weak control plane configurationA weak control plane could result in data loss by either theft or corruption. This could lead to a massive business impact, particularly if data loss includes private user dataWeak control plane10In 2018, Microsoft security intelligence report documented that “79 percent of SaaS storage apps and 86 percent of SaaS collaboration apps do not encrypt data both at rest and in transit” [18]Negative impact on service customersMetastructure and applistructure failures11According to 2018 research conducted by cloud security firm lacework, “more than 22,000 container orchestration and API management systems are unprotected or publicly available on the Internet, highlighting the reality of the risks of operating workloads in the cloud” [19]Lack of governance, awareness, and security are the major risks involvedLimited cloud usage visibility12Spread of Zepto variant of the Locky ransomware via different cloud storage services [20]Financial loss to customerAbuse and nefarious use of cloud servicesAs we see in Table1, security issues adversely affect cloud services. Data breaches, loss of data, poorly designed APIs, denial of service, and misconfiguration or inefficient design are the most critical threats for cloud-based applications.


### 3.1. Data Breaches

In this kind of threat, an attacker or hacker tries to get access to data illegally. SQL injection is the most known attack for data breaches. Data breach is considered one of the serious threats.In web applications, SQL injection is a common attack for data breaches. In cloud, it is more dangerous than web applications because in cloud many applications share one database. Therefore, vulnerability in one application can potentially expose the data of all applications to the attacker.


### 3.2. Data Loss

Data loss is another threat, in which malicious user or software destroys data intentionally. Permanent data loss leads to a large negative impact on both CSP and cloud customer. Not only do malicious attacks cause loss of data, but also there could be other reasons for failures and disasters like fires, floods, or earthquakes that affect a CSP’s infrastructure adversely.However, cloud customers are also responsible for implementing and managing data security solutions. If a cloud customer encrypts data before uploading to cloud and loses the private/public keys, then encrypted data will be of no use because it cannot be decrypted back. When it comes to handling and protection of data, it is a shared responsibility between CSP and cloud customer.In order to mitigate data loss issues, CSP should take a timely backup of data.


### 3.3. Insecure Interfaces and APIs

In cloud computing, CSPs provide APIs to cloud customers to interact with cloud services. These APIs offer a wide range of functionality for management, monitoring, and CRUD operations.Security of all these APIs depends on the correct design of the API and proper usage by customers meaning that cloud customers should follow CSP’s instructions and best practices for the API.If authentication and access control of the API is not implemented correctly, then it is possible for attackers to abuse the APIs for their own purpose.Sometimes, organizations or third parties use the basic APIs of the cloud service to implement their own services on top of basic cloud APIs, which offer customers services that are more complex. These new services are seen as a new API layer that needs to be secured along with the underlying base layer.In order to design secure APIs that are safe from malicious data access, CSPs must consider the best following practices for API development:(i)
Proper authentication, encryption, access control, and activity monitoring. All APIs must use API keys to access cloud services, and those keys must not be reused.(ii)
Rely on standard API frameworks like Open Cloud Computing Interface (OCCI) and the Cloud Infrastructure Management Interface (CIMI) [21, 22].(iii)
All APIs must be secured with the API keys. API keys must not be hard-wired in code, and they should not be pushed to GitHub or any other code repository. If any attacker by chance gets the API key, then they can access the data or service on customer’s behalf [23].(iv)
Add application and domain restrictions to API keys so that if a request comes from a different domain, then the server does not entertain it.


### 3.4. Denial of Service

Denial of service attack aims to stop cloud customers from accessing their applications or data. In this case, service consumes a large amount of system resources like memory, disk space, or network bandwidth.If attackers/hackers are able to achieve this goal, then it usually results in system slowdown, where cloud customers are not able to use the service properly after the DoS attack. Denial of service attacks can be executed from several attackers or attack sources at once, which is known as distributed denial of service (DDoS). In February 2020, AWS suffered a DDoS attack, stopping a 2.3 Tbps attack [24].Denial of service attacks can also be executed by identifying a vulnerability inside a web server, database, or other cloud resources. If such a vulnerability exists, an attacker may be able to take out the system by using an extremely small payload in his attack that would result in a denial of service.


### 3.5. Insufficient Design, Planning, and Misconfiguration

Many companies jump on cloud computing without understanding the full context of the cloud environment. Without sufficient understanding of the cloud service environment, an organization may run into several issues. Applications, for instance, can be pushed into the cloud, which are not suitable or capable for cloud service.Sometimes, information about internal cryptography, network monitoring, or incident response is pushed into the cloud. Pushing such information into the cloud may not be advisable otherwise.In addition, unknown operational or architectural issues arise when developers, designers, or architects are not familiar with cloud development. Therefore, before moving to a cloud environment, it becomes necessary for an organization to understand all risks associated with using cloud services. For some applications, it may be necessary to redesign core elements of services pushed into the cloud, for example, security functions with respect to key management.


### 3.6. Physical Security Threats

Physical security in cloud is as important as data and application security. A data center is a location, where actual data is stored in cloud. It consists of computing, storage, networking, power, and cooling infrastructure to handle computing service demands.Physical security ensures the protection of all tangible resources of a data center from all sorts of events that can cause damage to the data center’s infrastructure. Physical security includes protection from all factors that can cause physical damage like fire, flood, and natural disasters.Physical security in data centers is a multilayer approach that follows a well-chiseled security framework.Hardware resources (power, cooling, compute, storage, cabling, fire alarms, CCTVs, etc.) and monitoring systems (data center monitoring systems-DCIM) are two main components of physical security.In a data center, hardware resources are prone to physical damage; therefore, they need physical security. On the other hand, DCIMs are used to monitor various systems like power supplies, cooling unit temperature, and other control units.Poorly configured DCIMs could be smooth ground for attackers. Exposing these systems without adequate protection may lead to false readings of monitoring systems. Recently, over 20,000 data center management systems have been exposed to attackers [25].


## 3.1. Data Breaches

In this kind of threat, an attacker or hacker tries to get access to data illegally. SQL injection is the most known attack for data breaches. Data breach is considered one of the serious threats.In web applications, SQL injection is a common attack for data breaches. In cloud, it is more dangerous than web applications because in cloud many applications share one database. Therefore, vulnerability in one application can potentially expose the data of all applications to the attacker.


## 3.2. Data Loss

Data loss is another threat, in which malicious user or software destroys data intentionally. Permanent data loss leads to a large negative impact on both CSP and cloud customer. Not only do malicious attacks cause loss of data, but also there could be other reasons for failures and disasters like fires, floods, or earthquakes that affect a CSP’s infrastructure adversely.However, cloud customers are also responsible for implementing and managing data security solutions. If a cloud customer encrypts data before uploading to cloud and loses the private/public keys, then encrypted data will be of no use because it cannot be decrypted back. When it comes to handling and protection of data, it is a shared responsibility between CSP and cloud customer.In order to mitigate data loss issues, CSP should take a timely backup of data.


## 3.3. Insecure Interfaces and APIs

In cloud computing, CSPs provide APIs to cloud customers to interact with cloud services. These APIs offer a wide range of functionality for management, monitoring, and CRUD operations.Security of all these APIs depends on the correct design of the API and proper usage by customers meaning that cloud customers should follow CSP’s instructions and best practices for the API.If authentication and access control of the API is not implemented correctly, then it is possible for attackers to abuse the APIs for their own purpose.Sometimes, organizations or third parties use the basic APIs of the cloud service to implement their own services on top of basic cloud APIs, which offer customers services that are more complex. These new services are seen as a new API layer that needs to be secured along with the underlying base layer.In order to design secure APIs that are safe from malicious data access, CSPs must consider the best following practices for API development:(i)
Proper authentication, encryption, access control, and activity monitoring. All APIs must use API keys to access cloud services, and those keys must not be reused.(ii)
Rely on standard API frameworks like Open Cloud Computing Interface (OCCI) and the Cloud Infrastructure Management Interface (CIMI) [21, 22].(iii)
All APIs must be secured with the API keys. API keys must not be hard-wired in code, and they should not be pushed to GitHub or any other code repository. If any attacker by chance gets the API key, then they can access the data or service on customer’s behalf [23].(iv)
Add application and domain restrictions to API keys so that if a request comes from a different domain, then the server does not entertain it.


## 3.4. Denial of Service

Denial of service attack aims to stop cloud customers from accessing their applications or data. In this case, service consumes a large amount of system resources like memory, disk space, or network bandwidth.If attackers/hackers are able to achieve this goal, then it usually results in system slowdown, where cloud customers are not able to use the service properly after the DoS attack. Denial of service attacks can be executed from several attackers or attack sources at once, which is known as distributed denial of service (DDoS). In February 2020, AWS suffered a DDoS attack, stopping a 2.3 Tbps attack [24].Denial of service attacks can also be executed by identifying a vulnerability inside a web server, database, or other cloud resources. If such a vulnerability exists, an attacker may be able to take out the system by using an extremely small payload in his attack that would result in a denial of service.


## 3.5. Insufficient Design, Planning, and Misconfiguration

Many companies jump on cloud computing without understanding the full context of the cloud environment. Without sufficient understanding of the cloud service environment, an organization may run into several issues. Applications, for instance, can be pushed into the cloud, which are not suitable or capable for cloud service.Sometimes, information about internal cryptography, network monitoring, or incident response is pushed into the cloud. Pushing such information into the cloud may not be advisable otherwise.In addition, unknown operational or architectural issues arise when developers, designers, or architects are not familiar with cloud development. Therefore, before moving to a cloud environment, it becomes necessary for an organization to understand all risks associated with using cloud services. For some applications, it may be necessary to redesign core elements of services pushed into the cloud, for example, security functions with respect to key management.


## 3.6. Physical Security Threats

Physical security in cloud is as important as data and application security. A data center is a location, where actual data is stored in cloud. It consists of computing, storage, networking, power, and cooling infrastructure to handle computing service demands.Physical security ensures the protection of all tangible resources of a data center from all sorts of events that can cause damage to the data center’s infrastructure. Physical security includes protection from all factors that can cause physical damage like fire, flood, and natural disasters.Physical security in data centers is a multilayer approach that follows a well-chiseled security framework.Hardware resources (power, cooling, compute, storage, cabling, fire alarms, CCTVs, etc.) and monitoring systems (data center monitoring systems-DCIM) are two main components of physical security.In a data center, hardware resources are prone to physical damage; therefore, they need physical security. On the other hand, DCIMs are used to monitor various systems like power supplies, cooling unit temperature, and other control units.Poorly configured DCIMs could be smooth ground for attackers. Exposing these systems without adequate protection may lead to false readings of monitoring systems. Recently, over 20,000 data center management systems have been exposed to attackers [25].


## 4. Security Issues in Different Cloud Computing Services

The main difference between dedicated and cloud deployments is that when customers set up their own infrastructure, they have their own hardware and software stack, and they are responsible for its security and management, but in cloud, managing resources is a shared and mutual responsibility of CSP and cloud customer. Therefore, data security in cloud is different from conventional security models.For example, if a customer subscribes to a PaaS computing service, then CSP manages hardware infrastructure along with operating systems and other types of utility software, while cloud customer manages application software and services. In this scenario, customer will be responsible for securing the applications and data, while CSP will be responsible for securing infrastructure and platform [26].As we have mentioned earlier, in dedicated infrastructure, customers have full control over hardware, software, and data, but in cloud model, data are stored on remote servers (on CSP’s datacenters) [27]. Therefore, traditional security solutions will not be just enough, and we will have to take additional security measures.Securing infrastructure, business applications, and data without compromising affordability, performance, agility, and scalability should be the primary goal of security solutions in cloud.Security in cloud is a multidimensional approach that should take both physical and software security into account right from secure logins to network access. All applications must be deployed, keeping all security measures in mind [26].The aim of security solutions should not be limited to addressing existing threats, but they should be able to take preventive measures and actions to combat possible future attacks.Authentication, authorization, and encryption are the keys to secure data and applications. Authentication ensures that the right person or program is accessing the services, application, and data. Authorization ensures that the person or entity has permission to access the service, application, or data.Encryption is a mechanism of encoding data into incomprehensibleciphertext using a cryptographic key. Encrypting data ensures that even if there is a breach, hackers will not be able to read or understand that data [28].Authentication, authorization, and encryption have their own purposes for data security. Authentication is used for data access. Authorization is used for operation on data, and encryption is used for secure transportation of data over the network.Apart from data theft and misuse, there are many other issues that appear in computing services related to resource configuration, network security, and accessibility of service.Cloud storage is one of the most precious and important resources; therefore, no one is granted direct access to it. Nodes in public cloud are assigned a public IP address to connect to the Internet, but in order to provide secure access to hosts located in the private and public subnets of private virtual cloud networks, bastion hosts are used. Bastion host is used to connect users from specific IP addresses to target resources. Only specific IPs can access resources like cloud storage [29].


### 4.1. Security Issues in IaaS

When customers use IaaS, they have to take care of all security questions because they only get VMs, storage, and networking from CSP; rest all customers have to manage. Customers have to install, monitor, and operate all software components on their own.At the IaaS level, virtualization technologies are used to create VMs because many tenants share the same physical hardware in the form of virtual machines.Data visibility and resource isolation in shared hardware are the most critical issues faced in IaaS. Data confidentiality of guest VMs and denial of service attack by another guest VM are other critical issues [30].


### 4.2. Security Issues in PaaS

In PaaS, the responsibility of data and infrastructure security falls on both CSP and cloud customer’s shoulders.Most cloud customers use PaaS for their businesses; therefore, it becomes essential to figure out and address security issues in PaaS. A 2019 McAfee Cloud Adoption and Risk Report mentions that the number of PaaS users is expected to increase in big numbers because organizations are taking their applications to cloud.Misconfiguration is one of the main security issues in PaaS environments from the CSP side. It often happens when multiple resources are connected, but they are not configured properly. For example, Kubernetes and Docker containers interact with one another without proper permissions [31].On the other hand, cloud customers are responsible for securing applications, data, and user access. At the application level, proper authentication, authorization, and data encryption must be implemented to secure data and application.For example, if password-based authentication is implemented, then there must be a strong set of password policies, passwords must be generated with salted password hashes, and they should be stored in an encrypted format. If, by mistake, passwords are stored in plaintext, then malicious system admin can misuse user credentials [32]. Figure 3 shows an example of how to encrypt passwords.Figure 3
Generation of salted password hash.In the public cloud, password-based authentication is not considered good because customers use the Internet to connect to cloud services; therefore, the authentication in the public cloud is more vulnerable than private cloud.There are other newer and safer methods available for authentication like multifactor, biometric, and YubiKey (hardware authenticator) authentication. YubiKey generates keystrokes that are used along with passwords. It is an extra layer of protection beyond a password [33]. Amazon Web Services (AWS) uses multifactor authentication for identity and access management [34].In order to keep data secure in cloud, cloud storage encrypts data before writing to storage devices. This encryption happens after customer data arrives at cloud [35]. To be more secure, one additional layer of encryption can be applied, that is, client-side encryption. Client-side encryption is done before data are uploaded to cloud.Along with authentication and encryption, cloud customer must implement role-based access controls for both data and applications. Role-based access controls enable users to access only those resources, which they have been granted permission for.


### 4.3. Security Issues in SaaS

In SaaS computing service, except data and application access, CSP manages everything else. Cloud customer is solely responsible for what data they put in cloud and who can access it. In SaaS, CSP takes care of almost all security attributes because all resources right from hardware resources to the entire application software suite are managed by CSP. Theft of data, poor access control, poor or no encryption of data in transit, and poorly managed applications at the cloud side are major security threats in SaaS.While choosing a SaaS service cloud, customer must look into the cloud provider’s security solutions and policies. Timely auditing and security reports increase the confidence level of cloud customers [36].


## 4.1. Security Issues in IaaS

When customers use IaaS, they have to take care of all security questions because they only get VMs, storage, and networking from CSP; rest all customers have to manage. Customers have to install, monitor, and operate all software components on their own.At the IaaS level, virtualization technologies are used to create VMs because many tenants share the same physical hardware in the form of virtual machines.Data visibility and resource isolation in shared hardware are the most critical issues faced in IaaS. Data confidentiality of guest VMs and denial of service attack by another guest VM are other critical issues [30].


## 4.2. Security Issues in PaaS

In PaaS, the responsibility of data and infrastructure security falls on both CSP and cloud customer’s shoulders.Most cloud customers use PaaS for their businesses; therefore, it becomes essential to figure out and address security issues in PaaS. A 2019 McAfee Cloud Adoption and Risk Report mentions that the number of PaaS users is expected to increase in big numbers because organizations are taking their applications to cloud.Misconfiguration is one of the main security issues in PaaS environments from the CSP side. It often happens when multiple resources are connected, but they are not configured properly. For example, Kubernetes and Docker containers interact with one another without proper permissions [31].On the other hand, cloud customers are responsible for securing applications, data, and user access. At the application level, proper authentication, authorization, and data encryption must be implemented to secure data and application.For example, if password-based authentication is implemented, then there must be a strong set of password policies, passwords must be generated with salted password hashes, and they should be stored in an encrypted format. If, by mistake, passwords are stored in plaintext, then malicious system admin can misuse user credentials [32]. Figure 3 shows an example of how to encrypt passwords.Figure 3
Generation of salted password hash.In the public cloud, password-based authentication is not considered good because customers use the Internet to connect to cloud services; therefore, the authentication in the public cloud is more vulnerable than private cloud.There are other newer and safer methods available for authentication like multifactor, biometric, and YubiKey (hardware authenticator) authentication. YubiKey generates keystrokes that are used along with passwords. It is an extra layer of protection beyond a password [33]. Amazon Web Services (AWS) uses multifactor authentication for identity and access management [34].In order to keep data secure in cloud, cloud storage encrypts data before writing to storage devices. This encryption happens after customer data arrives at cloud [35]. To be more secure, one additional layer of encryption can be applied, that is, client-side encryption. Client-side encryption is done before data are uploaded to cloud.Along with authentication and encryption, cloud customer must implement role-based access controls for both data and applications. Role-based access controls enable users to access only those resources, which they have been granted permission for.


## 4.3. Security Issues in SaaS

In SaaS computing service, except data and application access, CSP manages everything else. Cloud customer is solely responsible for what data they put in cloud and who can access it. In SaaS, CSP takes care of almost all security attributes because all resources right from hardware resources to the entire application software suite are managed by CSP. Theft of data, poor access control, poor or no encryption of data in transit, and poorly managed applications at the cloud side are major security threats in SaaS.While choosing a SaaS service cloud, customer must look into the cloud provider’s security solutions and policies. Timely auditing and security reports increase the confidence level of cloud customers [36].


## 5. Cloud Security Assessment Metrics

As more and more customers are taking their applications and data to the cloud, data security becomes a very important factor. Data and applications must be secured in all possible manners.To achieve a high level of security, data security requirements must be clear enough before transiting to cloud. These requirements should allow the customer to evaluate the security of the cloud environment and help cloud customers to mitigate cloud-specific risks.Here we are proposing ten cloud security assessment metrics that help customers to assess the security of cloud service. Before moving to cloud, every customer must assess cloud service by following security assessment metrics mentioned in Table2. Table 2 lists 10 security assessment metrics along with security questions asked as part of each assessment metric.Table 2
Cloud security assessment metrics.
1. Governance, risk, and compliance metrics(a) What kind of regulations will be in place for cloud customers in order to protect user’s information and privacy?(b) Will it be a shared responsibility of CSP and cloud customer to implement governance and compliance processes?(c) Will CSP’s governance and notification processes match cloud customer’s requirements in order to use the cloud services?(d) What are the associated risks related to data storage location?2. Audit metrics(a) Are there appropriate mechanisms from CSP’s side to report all kinds of audit incidents to cloud customers?(b) Is there an appropriate logging mechanism in cloud for recording all kinds of security events and actions?(c) Is incident reporting and handling mechanism meeting all cloud customer’s requirements?3. Access control metrics(a) What kind of access control is provided by cloud services? Is it matching cloud customer’s needs?(b) Is MFA (multifactor authentication) in place for all cloud services?(c) Is user’s access to cloud services being monitored, recorded, and reported properly?4. Data and information security metrics(a) Do CSP and cloud customer know about all the data assets being used in cloud?(b) Are all roles and responsibilities clearly mentioned and described for both CSP and cloud customer?(c) Do data stored in cloud conform to all security standards and measures?5. Privacy policy metrics(a) What will be the data store and purge policy for personal information stored in cloud?(b) Are data protection laws and regulations clearly mentioned for the location of data storage and data usage?(c) How is personal information being handled in cloud? Are there appropriate controls in place to keep personal information safe and secure?6. Security provisions metrics(a) Depending on the cloud model, who is responsible for application security? Cloud customer or CSP?(b) Are cloud customers’ data appropriately encrypted while storing in cloud?7. Cloud network metrics(a) What mechanisms are there in place to deal with DoS (denial of service)?(b) Are there enough checks in place for intrusion detection and prevention from CSP’s side?(c) Are logging and notification mechanisms in place at the network level?(d) Is customer network access separate from provider network access?8. Physical infrastructure metrics(a) Is physical infrastructure fully secured? How will CSP ensure cloud customer about it?(b) How does CSP ensure availability of service in case of any kind of physical threat or resource failure?(c) How does CSP ensure malicious insider attack?9. Security terms and SLA metrics(a) Does SLA mention all the security responsibilities and conditions?(b) How does SLA make sure of security management? Are there enough metrics to measure the performance and effectiveness of security?(c) How will security incidents be notified and handled? Does SLA contain detailed information about it?10. Exit process metrics(a) Is it clearly mentioned that all customer data will be deleted from the CSP’s environment at the end of the exit process?(b) What will be the data destroy and purge policy during the exit process?


## 6. Cloud Security Assessment Using Metric-Based Model

Data security assessment in cloud is not a one-time task. Security threats in cloud environments are constantly evolving; therefore, there must be adequate processes, measures, and technologies in place to prevent cloud infrastructure from all possible threats [37].For cloud customers, the situation becomes more frustrating and challenging. IoT data have to be moved to cloud in order to leverage cloud storage. IoT network is a personal LAN and carries a lot of confidential data. If IoT data is moved to cloud without proper checks, then it may be risky at times because not all cloud services are appropriately secure.In order to mitigate security risks, cloud customers should have strong but simple and convenient mechanisms in place to assess the quality of security solutions. Metric-based assessment is worth using because it is easy to implement and provides quantitative results that enterprises can use for deciding whether they should opt for a cloud service or not.Security assessment metrics and security questions mentioned in Section5 are taken into account for constituting a security metrics-based assessment model for cloud computing services.There are a total of 10 metrics and 30 questions as part of the metrics given in Section5. Each question carries a weight of one point. While assessing a cloud service, customers have to answer all questions in a yes/no format. At the end of answering all questions, total score is summed up, and a grade is calculated on a percentage basis. There are four types of data/information, restricted or highly confidential, confidential, internal, and public or declassified. A calculated grade helps cloud customers in making a decision about what kind of information they can keep in cloud. According to the grade scored by a cloud service, customers will also be able to decide if they should opt for the given cloud service or not.Table3explains the grades and types of data that can be stored in cloud depending upon the grade scored.Table 3
Metric-based security assessment grades.
S. no.Percent points scored out of 30GradeGood for types of data stored191% and aboveARestricted, confidential, internal, and public281% to 90%BConfidential, internal, and public371% to 80%CInternal and public4Below 70%DPublic


## 7. Conclusion and Future Prospects

With the increasing demand for cloud computing services, security and privacy of the data are very important. Security is a continuous and ongoing process that must be audited and revised from time to time in order to keep customer’s data safe and secure.Cloud customers must assess the cloud service before moving their data and applications to cloud. Both CSPs and cloud customers should ensure that security solutions are able to address existing threats and able to predict future ones.It has been observed that intruders and hackers take advantage of glitches in security solutions and poor implementation of security policies (e.g., weak passwords, open ports, and unencrypted data).New developments in cloud for distributed computing like edge, fog, and Internet of Things (IoT) computing will bring new challenges from data security and user privacy’s perspective. Reviewing and updating security solutions and policies should be a consistent process along with the technological updates.In this paper, we presented a metric-based security assessment model for cloud services, where we took important security metrics that are calculated and are taken into account to make a decision about what kind of data they can move to cloud.



---

*Source: 4943225-2022-04-12.xml*