Cloud Security in cloud computing 1.pptx

Security

1. Unit IV Cloud Security Multitenancy issues, Cloud security threats and risks, attacks in cloud environment, virtual machine security: hypervisor attack, guest-hopping attack, DDoS attacks, packet sniffing, man-in-the-middle attack, data privacy and availability in cloud computing.

2. Multitenancy issues Multitenancy refers to the ability of a cloud provider to serve multiple clients or tenants using a shared infrastructure. However, this shared infrastructure can lead to various security issues, such as: Data Leakage: If tenants' data is not properly isolated, it can lead to data leakage. This can happen due to various reasons such as a misconfigured network or access controls, or vulnerabilities in the hypervisor layer. Co-Mingling of Data: The sharing of resources and services can lead to the co-mingling of data belonging to different tenants. This can happen due to data being stored in the same location or accidentally being routed to the wrong location. Privilege Escalation: Privilege escalation occurs when a tenant gains unauthorized access to resources or data belonging to another tenant. This can happen due to weak authentication and access control mechanisms. Service Level Agreements: Service level agreements (SLAs) can be difficult to enforce in a multitenant environment, as service disruptions or data breaches can affect multiple tenants simultaneously. To mitigate these issues, cloud providers need to implement strong security controls such as isolation, access controls, encryption, and monitoring .

3. Cloud security threats and risks Cloud security threats and risks refer to the potential dangers and vulnerabilities that can affect cloud computing systems and the data stored within them. Some common cloud security threats and risks include: Data breaches: Unauthorized access to confidential data or sensitive information. DDoS attacks: Distributed Denial of Service attacks that can cause network outages or service disruptions. Malware and viruses: Malicious software that can infect cloud systems and compromise security. Insider threats: Malicious or negligent insiders who have access to the cloud system. Account hijacking: Unauthorized access to user accounts and privileges. Insecure APIs: Insecure Application Programming Interfaces that can be exploited by attackers. Lack of encryption: Lack of encryption in data transmission and storage can lead to data breaches. Data loss or deletion: Accidental or intentional deletion of data or loss of data due to system failures or cyber-attacks. To mitigate these risks and threats, cloud providers and users need to implement proper security measures and practices such as access controls, encryption, monitoring, and backup and recovery procedures.

4. attacks in cloud environment In a cloud environment, various types of attacks can occur due to the complexity of the cloud infrastructure and the large number of users accessing the cloud resources. Some common attacks in cloud environments include: Hypervisor attack: Hypervisor is a critical component of virtualization technology used in cloud environments. An attacker who gains access to the hypervisor can potentially control all the virtual machines running on that host, compromising the entire cloud environment. Guest-hopping attack: This attack occurs when an attacker gains access to a virtual machine and then uses that access to jump to other virtual machines running on the same host, potentially accessing sensitive information or causing damage. DDoS attacks: Distributed Denial of Service ( DDoS ) attacks can be launched against cloud services, overwhelming the servers and causing service disruption. Packet sniffing: An attacker can intercept and capture network traffic between cloud resources, potentially gaining access to sensitive information. Man-in-the-middle attack: This type of attack occurs when an attacker intercepts communication between two cloud resources, potentially modifying or stealing data. It is important for cloud providers to implement strong security measures to protect against these types of attacks and to regularly monitor the cloud environment for any suspicious activity.

5. virtual machine security: hypervisor attack A hypervisor is a software layer that allows multiple virtual machines to run on a single physical machine. It provides a level of abstraction between the physical resources and the virtual machines. However, if the hypervisor is compromised, it can lead to a range of security threats. A hypervisor attack can occur in two ways: VM escape attack: An attacker can exploit a vulnerability in the virtual machine to break out of the virtual environment and gain access to the host system. Hypervisor-level attack: An attacker can directly target the hypervisor layer to gain control of the host system or other virtual machines running on the same physical machine. To mitigate hypervisor attacks, it is important to regularly patch and update the hypervisor software and implement access control measures to restrict unauthorized access to the hypervisor layer. Additionally, implementing security measures such as encryption and access control for virtual machine images can also help protect against hypervisor attacks.

6. guest-hopping attack A guest-hopping attack is a type of virtual machine (VM) escape attack that allows an attacker to move from one guest VM to another on the same physical host. This type of attack takes advantage of vulnerabilities in the hypervisor or VM monitor that manages multiple VMs on a single physical host. The attacker can exploit these vulnerabilities to gain unauthorized access to other VMs and potentially compromise sensitive data or applications running in those VMs. The guest-hopping attack is considered a serious threat to the security of cloud environments, especially in multi-tenant environments where multiple users share the same physical resources. To prevent guest-hopping attacks, it is important to keep the hypervisor and VM software up to date with the latest security patches and to implement strict access controls and monitoring for VM-to-VM communications. Additionally, using hardware-assisted virtualization can help to isolate VMs and prevent guest-hopping attacks.

7. DDoS attacks DDoS (Distributed Denial of Service) attacks are a type of cyber attack that involves overwhelming a targeted network or website with a flood of internet traffic from multiple sources, making the service unavailable to legitimate users. In a cloud environment, DDoS attacks can target the cloud service provider's infrastructure, as well as the applications and services of cloud customers. DDoS attacks are typically launched using a botnet, which is a network of compromised computers that are under the control of the attacker. The botnet is used to generate a high volume of traffic that overwhelms the targeted network or website. This can cause a range of problems, including service disruption, slow response times, and in some cases, complete system failure. Cloud service providers typically have measures in place to detect and mitigate DDoS attacks, such as traffic filtering and traffic diversion to absorb the traffic. However, cloud customers also need to take steps to protect themselves from DDoS attacks, such as using a content delivery network (CDN) or a DDoS protection service. It's also important to have a response plan in place in case of a successful DDoS attack.

8. packet sniffing Packet sniffing is a technique used to intercept and capture network traffic in order to gain access to sensitive information such as passwords, usernames, and credit card numbers. This is accomplished by using software or hardware tools that can analyze network packets as they are transmitted across a network. Packet sniffing can be used for both legitimate and illegitimate purposes. Legitimate uses include network monitoring and troubleshooting, while illegitimate uses include stealing sensitive information and launching attacks. To prevent packet sniffing, it is recommended to use encryption protocols such as SSL or TLS. Additionally, it is important to use secure passwords and avoid sending sensitive information over unsecured networks.

9. Man-in-the-Middle Attack Man-in-the-middle (MITM) attack is a type of cyber attack where an attacker intercepts communication between two parties to steal or modify information exchanged between them. In cloud computing, MITM attacks can occur in the communication between the cloud service provider and the customer or between different cloud services. MITM attacks can be performed through various techniques, such as ARP spoofing, DNS spoofing, and SSL stripping. The attacker can intercept and modify the data transmitted between the parties, leading to the compromise of sensitive information or unauthorized access to cloud resources. To prevent MITM attacks, the use of encryption and digital certificates is recommended, along with proper network configuration and monitoring.

10. Data Privacy in Cloud Computing Data privacy is a major concern in cloud computing as it involves storing sensitive data on remote servers. Here are some ways to ensure data privacy in cloud computing: Encryption: Encrypting sensitive data before storing it in the cloud is one way to protect it from unauthorized access. Access controls: Implementing access controls like multi-factor authentication, identity and access management (IAM), and role-based access control (RBAC) can ensure that only authorized personnel can access sensitive data. Secure protocols: Using secure protocols like HTTPS and SSL/TLS for data transfer and communication can also prevent data breaches. Data classification: Classifying data based on its sensitivity and implementing different levels of protection based on the classification can also help in ensuring data privacy. Examples of data privacy breaches in cloud computing include the 2014 iCloud celebrity photo leak and the 2017 Equifax data breach, which compromised the personal information of millions of customers.

11. Data Availability in Cloud Computing Data availability is another critical aspect of cloud computing. Here are some ways to ensure data availability in cloud computing: Redundancy: Storing data in multiple locations or using redundant servers can ensure that data is available even if one server or location goes down. Disaster recovery: Having a disaster recovery plan in place can help in quickly recovering data in case of natural disasters, cyber attacks, or other emergencies. Service level agreements (SLAs): Negotiating and including SLAs in cloud computing contracts can ensure that service providers guarantee a certain level of data availability. Backups: Regularly backing up data and storing it in secure locations can also help in ensuring data availability. Examples of data availability issues in cloud computing include the 2017 AWS S3 outage, which affected major websites and services, and the 2020 Microsoft Office 365 outage, which impacted users worldwide.

12. Questions What are some of the common multitenancy issues in cloud computing? What are the major cloud security threats and risks that organizations should be aware of? What are some of the common attacks that occur in a cloud environment? What is a hypervisor attack and how does it compromise virtual machine security? Explain the guest-hopping attack and how it can be prevented in cloud computing. How do DDoS attacks work and what are some strategies for mitigating them in a cloud environment? What is packet sniffing and how does it pose a threat to data security in the cloud? What is a man-in-the-middle attack and how can it be prevented in a cloud environment?

13. Unit III Questions Explain the difference between Direct-Attached Storage (DAS) and Networked Attached Storage (NAS). What are the attributes, components, and topologies of a Storage Area Network (SAN)? Describe the different connectivity options and zoning techniques used in SANs. Discuss the FC protocol stack, addressing, and flow control used in Storage Area Networks. What are the components, protocols, and architecture of IP Storage Area Network (IP SAN)? Explain the differences between iSCSI , FCIP, and FCoE in IP SAN architecture. Describe the elements and processes involved in Content Addressed Storage (CAS). Discuss the different server architectures, including stand-alone, blades, stateless, and clustering, used in cloud storage infrastructure.