Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Security Issues in Cloud Computing
Jawaher Alharthi, Dr. Sabah Alzahrani
College of Computers and Information Technology, Taif University, Saudi Arabia
Email: [ S44181187@students.tu.edu.sa,
sa.sabah@tu.edu.sa ]
Introduction
Abstract
Cloud computing is defined as a new technology to deliver services through internet. This
technology became over traditional data processing system to store large data. Cloud
computing gives the user the ability to access information anytime from anywhere. Cloud is
definitely useful for business that cannot afford hardware and maintenance team to work 24
hours to keep the business on.Because the data is in the cloud not local in the company
private area. The data will be exposed for attacking from hackers. In this paper, we try to
demonstrate the security issue for the cloud.
Keywords: Security, Internet, Cloud, Business
1. Introduction
Cloud computing is the most important technology for companies and people.
In the past before cloud computing, companies had to use landlines to transfer data from
branch to branch, or from user to user. Companies would afford much cost and more time to
deal with its branches.
Cloud computing has come to ease the data transportation through internet instead of using
local network. Companies can have many users and branches working together in the cloud
without afford the cost of hardware at each location. Moreover, users can use their devices
like; mobiles, computers, or tablets to access the information.
www.ajrsp.com
118
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Cloud computing gives admittance to a colossal scope of utilizations without downloading or
introduce anything; applications can be gotten to from any PC, anyplace on the planet; they
can dodge costs on equipment and programming, just utilizing what they need. Subsequently
it speaks to as another norm for the dynamic provisioning of registering administrations
containing gatherings of arranged virtual machines. It is a circulating figuring component
that uses the rapid of the web to move work from private PC to the far-off PC groups
(enormous server farms own by the cloud specialist organizations) for information preparing
[1].
To accomplish effective usage of assets, cloud supplier needs to upgrade their asset use while
diminishing expense. Simultaneously end client needs to utilize asset to the extent required
while being ready to increment or reduction assets utilization dependent on genuine requests.
2. Background
2.1 Cloud overview
Cloud facilitating arrangement models are characterized by the ownership, size and access. It
tells about the idea of the cloud. The greater part of the associations are eager to execute
cloud since it decreases the consumption and controls cost of activity.
Cloud computing began its base in the mid of 2007 and is developing quickly till this time. It
has different highlights that make clients need to change to the distributedcomputing
environment. Some of these highlights are examined beneath:
Convenience:
There is no compelling reason to claim and look after equipment, programming and different
assets by the cloud client. The cloud administrations are straight forwardly gotten to utilizing
an internet browser. No additional assets are expected to run and execute cloud
administrations. A basic work area with typical web network is adequate.
www.ajrsp.com
119
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Diminished expense:
For making a passage into a business, cost needed for framework is decreased by moving to
the cloud. As registering power, storage and different assets are utilized from cloud; cost to
buy just as oversee them is incredibly influenced. It is beneficial for the associations if the
assets are required by them just for little span. So as opposed to possessing them cloud is a
superior choice.
Multi-Tenure:
A single information server, computing and different assets are shared among numerous
clients by utilizing virtualization and separation. This element named as Multi-tenancy,
allows productive usage of assets.
Hardware and location independency:
The cloud services are hosted in the web and can be access through web browsers. So, it
means people can benefit from the services anytime from anywhere. Moreover, companies
can maintain the resource remotely through internet.
Reliability:
Numerous assets are accessible like figuring power, Storage and so forth for offering types of
assistance to the clients. Likewise, the information might be put away at numerous areas by
supplier. This excess as far as information stock piling and other asset empowers
arrangement for debacle recuperation and accomplishes unwavering quality and accessibility
of information just as administrations.
2.2 Types of cloud
2.2.1 Public cloud
It is a kind of cloud facilitating in which the cloud administrations are conveyed over an
organization that is open for public use.
www.ajrsp.com
120
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
This model is in reality evident portrayal of cloud facilitating. In this the cloud model
specialist organization offers types of assistance and framework to different customers.
Clients don't have any power over the area of the foundation. There might be almost no or no
distinction among public and private mists basic plan aside from the degree of security that
are offered for different administrations given to the public cloud supporters by the cloud
facilitating suppliers. Public cloud is appropriate for business which require overseeing load.
Because of the diminishing capital overheads and operational cost, thepublic cloud model is
conservative. Sellers may offer the free assistance or permit strategy like compensation per
client.
The expense is shared by all the clients in broad daylight cloud. It benefits the clients by
accomplishing economies of scale. Public cloud offices might be accessible for nothing a for
example of a public cloud is Google[2].
2.2.2 Private cloud
It is otherwise called inside cloud. This stage for distributed computing is executed on cloudbased secure climate and it is protected by a firewall which is administered by the IT office
that has a place with a specific corporate. Private cloud allows just the approved clients and
gives the association more prominent power over their information. The actual PCs might be
facilitated inside or remotely they give the assets from a particular pool to the private cloud
administrations. Organizations having unforeseen or dynamic needs, tasks which are basic
administration requests and up time necessities are more qualified to receive private cloud. In
private cloud there is no requirement for extra security guidelines and data transfer capacity
constraints that can be available in a public cloud climate. Customers and Cloud suppliers
have control of the framework and improved security, since client's entrance and the
organizations utilized are confined. Probably the best model is Eucalyptus Frameworks.
www.ajrsp.com
121
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
2.2.3 Hybrid Cloud
It is a kind of distributed computing, which is coordinated. It could comprise a course of
action of at least two cloud workers, for example both of the blend of private, public or
network cloud that is bound together yetstay singular substances. Halfbreed mists are
equipped for intersection disconnection and defeating limits by the supplier; hence, it can't be
just classified into public, private or network cloud. It permits the client to expand the limit
just
as
the
ability
by
osmosis,
total
and
customization
with
another
cloud
bundle/administration. In a half and half cloud, the assets are overseen either in-house or by
outside suppliers. It is a variation between two stages wherein the remaining task at hand
trades between the private cloud and the public cloud according to the requirements and
request of association. Assets which are non-basic like turn of events and test remaining
tasks at hand can be housed in the public cloud that has a place with an outsider supplier.
While the remaining burdens that are basic or touchy ought to be housed inside. Associations
may utilize the crossover cloud model for preparing large information. Half and half cloud
facilitating has highlights like adaptability, adaptability and security.
2.3 Cloud computing as services
Figure 1 Cloud services models [1].
www.ajrsp.com
122
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
2.3.1 Software as services
Software as services (SaaS) is developing quickly. SaaS makes utilizes the web to give
applications which are overseen by an outsider seller and whose interface is gotten to on the
customer side. SaaS applications can be run from an internet browser without the need to
download or establishment, however these require modules. The cloud supplier furnishes the
customer with the capacity to send an application on a cloud framework.Because of this web
conveyance model SaaS eliminates the need to introduce and run applications on singular
PCs. In this model it is simple for undertakings to improve their upkeep and backing, since
everything can be overseen by merchants: applications, runtime, information, center product,
operating system, virtualization, and workers, stockpiling and systems administration.
Famous SaaS administrations incorporate email and cooperation, medical services related
application. SaaS suppliers typically offer program-based interfaces. APIs are likewise
typically made accessible for engineers. The critical advantage of SaaS is that it requires no
development interest in workers or authorizing of programming. The application
designerneeds to keep up one application for various customers.
2.3.2 Infrastructure as a Service (IaaS)
Foundation as an Assistance are utilized for checking, and overseeing distant datacenter
frameworks, for example, process (virtualized or exposed metal), stockpiling, Clients can
buy IaaS dependent on utilization, like other utility charging. IaaS clients have the duty to be
in control applications, information, runtime and middleware. Suppliers can at present
oversee virtualization, workers, stockpiling, and systems administration. IaaS suppliers offer
information bases, informing lines, and different administrations over the virtualization layer
also.
2.3.3 Platform as service
Platform as service (PaaS) is a sort of distributed computing administrations that gives a
stage that permits clients to create, run, and oversee applications without the issue of building
and keeping up the framework.
www.ajrsp.com
123
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
One need not be worried about lower level components of Foundation, Organization
Geography, Security this is accomplished for us by the Cloud Specialist co-op.
With this innovation, outsider suppliers can oversee operating system, virtualization, and the
PaaS programmingitself. Designers deal with the applications. Applications utilizing PaaS
acquire cloud trademark, for example, adaptability, multi-occupancy, SaaS enablement, highaccessibility and that's just the beginning. Endeavors profit by this model since it diminishes
the measure of coding, robotizes business strategy, and help in moving applications to cross
breed model.
3. Security on cloud
The information housed on the cloud is habitually seen as imperative to individuals with
noxious point. There is a huge load of individual information and possibly secure data that
people store on their PCs, and this information is as of now being moved to the cloud. This
makes it fundamental for us to appreciate the wellbeing endeavors that our cloud provider
has set up, and it is comparably basic to avoid any and all risks to ensure about our data.
The essential thing we ought to research is the security endeavors that our cloud provider
starting at now has set up. These vary from provider to provider and among the various kinds
of fogs. What encryption methodologies do the providers have set up? What methodologies
for confirmation do they have set up for the real gear that our data will be taken care of on?
Will they have fortifications of my data? Do they have firewalls set up? In case we have an
organization cloud, what impediments are set up to keep our information separate from
various associations? Many cloud providers have standard terms and conditions that may
react to these requests, anyway the home customer will probably have near nothing trade
room in their cloud contract. A free organization customer may have fairly more space to
analyze the arrangements of their concurrence with the provider and will have the choice to
represent these requests during that time. There are various requests that we can present,
anyway it is basic to pick a cloud provider that ponders the security of our data as a huge
concern.
www.ajrsp.com
124
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Despite how wary we are with our own data, by purchasing into the cloud we will give up
some control to an external source. This detachment among us and the actual territory of our
data makes a block. It may in like manner make more space for an outcast to get to our
information. Regardless, to misuse the benefits of the cloud, we ought to purposefully give
up direct control of our data. On the inverse, recollect that most cloud providers will have a
great deal of data on the most capable technique to secure our data. A provider probably has
a greater number of resources and dominance than the ordinary customer to ensure about
their PCs and associations.
3.1 Threats in cloud computing
3.1.1 Authentications
Associations/organizations on occasion battle with personality the board as they attempt to
allow consents suitable to the client's employment job. They in some cases neglect to
eliminate client access when an occupation work changes, or a client leaves the association.
The Song of devotion penetrate uncovered in excess of million of client records, was the
after effect of taken client qualifications. If software engineers had neglected to send
multifaceted validation, so when the assailants acquired the accreditations, it was all finished.
Numerous designers have wrongly embedded certifications and cryptographic keys in source
code and have them openly confronting storehouses.
3.1.2 Data sections
Cloud conditions face a significant number of similar dangers as conventional corporate
organizations, however since a lot of information is put away on cloud workers, suppliers
have become an appealing objective. The seriousness of the harm will in general rely upon
the affectability of the information that is uncovered. Individual budgetary data snatches the
features, however, penetrates including government data, proprietary advantages can be all
the more destroying. At the point when an information penetrate happens, an organization
might be exposed to lawful activity.
www.ajrsp.com
125
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Penetrate examinations and client warnings can pile up critical expenses. Circuitous impacts
may incorporate brand harm and loss of business can affect associations’ future for quite a
long time.
3.1.3 Application APIs
Today every cloud administration and application presently offer APIs. IT groups utilize
these interfaces and APIs to oversee and communicate with cloud administrations, including
those that offer cloud provisioning, the executives and checking. The security and
accessibility of cloud administrations rely upon the security of the Programming interface.
Danger is expanded with outsiders who depend on APIs and expand on these interfaces, as
associations may need to uncover more administrations and accreditations. APIs and Feeble
interfaces may open associations to security related issues, for example, privacy,
responsibility, accessibility APIs and interfaces are the especially uncovered piece of the
framework since they can be gotten to from open Web.
3.1.4 Account logins
Misrepresentation, Phishing, and programming abuses are exceptionally pervasive today, and
cloud administrations add another measurement to the danger since aggressors can listen in
on work, control exchanges, and alter information. Aggressors might have the option to
utilize the cloud application to dispatch different attacks. Associations must disallow sharing
of record accreditations among clients and benefits and should empower multifaceted
validation plans where accessible. Records must be observed with the goal that each
exchange ought to be followed to a human proprietor. The key is to shield account
certifications from being taken
3.1.5 Dos attack
DoS attack have been around for quite a while and have picked up noticeable quality again
on account of distributed computing since they frequently influence accessibility.
Frameworks may run moderate or essentially break.
www.ajrsp.com
126
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
These DoS attacks burn-through a lot of handling power, a bill the client may at last need to
pay. High-volume DDoS attacks are extremely normal, yet associations ought to likewise
know about deviated and application-level DoS attacks, which target Web worker and
information base weaknesses. Cloud suppliers are better ready to deal with DoS attacks than
their clients. The key here is to have an arrangement to alleviate the attack before it happens,
so overseers approach those assets when they need them.
3.1.6 Cloud services abuse
Cloud administrations might be utilized to help exercises like utilizing distributed computing
assets to break an encryption key so as to dispatch an attack. Instances of these attacks
incorporate dispatching DDoS attacks, sending spam and phishing messages. Suppliers need
to perceive sort of maltreatment to perceive DDoS attacks and offer instruments for clients to
screen the wellbeing of their cloud surroundings. Clients should ensure that suppliers offer
them a system for announcing misuse. Despite the fact that clients may not be immediate
prey for malevolent activities, cloud administration misuse can even now bring about
inaccessibility of administration and information misfortune.
3.1.7 System bugs
Weaknesses in framework, exploitable bugs in programs have become a more serious issue
with the coming of multitenancy in distributed computing. Associations share memory,
information bases and assets in nearness to each other, making new attack surfaces. The
expenses of moderating framework weaknesses are moderately little contrasted with other IT
consumptions. The cost of setting up IT cycles to discover and fix weaknesses is little when
contrasted with the expected harm.
3.1.8 Inadequate diligence
Associations tolerating distributed computing without having total comprehension of the
climate and dangers related with it might experience an incredible number of business,
www.ajrsp.com
127
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
monetary, specialized, legitimate, and consistence chances. Ingenuity is required whether the
association is attempting to relocate to the cloud or converging with another organization in
the cloud. For instance, associations that neglect to inspect an agreement may not know
about the supplier's risk in the event of information misfortune or break. Operational and
building issues could emerge if an association advancement group is curious about with
cloud advances as applications are conveyed to a specific cloud. An association ought to do
satisfactory exploration prior to moving to distributed computing as a result of the danger
related with it.
3.1.9 Database security
Programmers have in the past have forever erased information from cloud to cause hurt
organizations and cloud server farms are as defenseless against catastrophic events as any
office. Cloud suppliers may suggest disseminating applications and information over various
zones for better assurance. Sufficient information reinforcement measures and fiasco
recuperation are significant. Everyday information reinforcement and off-site stockpiling are
significant with utilization of cloud conditions. The weight of forestalling information
misfortune isn't just of cloud specialist co-op, yet additionally of information supplier. A
client may scramble information prior to transferring it on the cloud, at that point that client
must be mindful so as to ensure the encryption key. On the off chance that the key is lost, at
that point the information will likewise be lost. Consistence strategies numerous multiple
times indicate how long associations must hold records of review and different archives.
Losing such delicate information may have genuine outcomes.
4. Security challenges of cloud computing
4.1 Malicious attacking
Security dangers can happen from both outside of and inside associations. In a cloud
situation, an insider can annihilate entire foundations or control or take information.
www.ajrsp.com
128
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
Frameworks that rely exclusively upon the cloud specialist co-op for security are at most
serious danger [3].
4.2 Database backup
The cloud merchant ought to guarantee that standard backup of information is executed that
even guarantee security with all measures.
However, the backup information is commonly found in decoded structure which can prompt
abuse of the information by unapproved individuals.
In this way information backups lead to different security dangers. More the worker
virtualization builds, a very troublesome issue with backup and capacity is made.
Information reduplication is one of the answers for diminish backup and disconnected
stockpiling volumes[4].
4.3 Unencrypted data
Data encryption is a cycle that assists with illuminating different outside and malicious
dangers. Decoded information is truly powerless for defenseless information, as it doesn't
give any security system. Decoded information can undoubtedly be gotten to by unapproved
clients and the client information which prompts cloud worker to get away from different
information data to unapproved clients. For instance, the well-known document sharing help
Drop box was denounced for utilizing a solitary encryption key for all client information the
organization put away. These decoded, uncertain information urge the noxious clients to
abuse the information either way.
4.4 Flooding requests
In this sort of attack the intruder sends huge number of requests for assets on the cloud
quickly so the cloud gets overflowed with the huge number of requests. This delays the cloud
server on responding to clients.
www.ajrsp.com
129
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
4.5 SQL injection attack
These attacks are known to be pernicious follow up on the distributed computing wherein a
malicious code is embedded into a SQL code. This attack permits the intruder to increase
unapproved admittance to a data set and to other private data. SQL infusion can be utilized to
attack any kind of SQL information base. The explanation that SQL infusion and different
endeavors are conceivable is on the grounds that security is deficiently accentuated being
developed.
4.6 Internet browser
Users use web browsers to send the data on network. These programs use SSL innovation to
scramble client's identity and credentials. Unfortunately, hackers from the middleware may
acquire these qualifications by utilizing sniffing bundles introduced on the delegate and
damage the system[4].
5. Conclusion
Cloud computing has gigantic possibilities, but the security dangers installed in cloud
computing approach are legitimately corresponding for its offered potential benefits. Cloud
computing is an extraordinary opportunity and worthwhile choice both to the organizations
and the assailants – either gatherings can have their own personal preferences from Cloud
computing. The immense prospects of Cloud computing can't be overlooked exclusively for
the security issues reason – the continuous examination and exploration for hearty, reliable
and coordinated security models for Cloud computing could be the main way of inspiration.
Security for Cloud computing climate is a non-trading off prerequisite. It is unavoidable to
turn into the ideal (and perhaps a definitive) way to deal with business processing in spite of
the fact that the security boundaries alongside different issues should be settled for cloud
computing to make it more reasonable.
www.ajrsp.com
130
Academic Journal of Research and Scientific Publishing | Vol 2 | Issue21
Publication Date: 5-1-2021 ISSN:2706-6495
However, given its aggregate preferences and dynamism and gave it is sent inside a
coordinated and made sure about infrastructural structure, cloud computing can offer virtual
possession and admittance to 'super PCs' without obtaining them truly.
7. References
[1]
R. Jathanna and D. Jagli, “Cloud computing and security issues,” Int. J. Eng. Res.
Appl., vol. 7, no. 6, pp. 31–38, 2017.
[2]
A. Huth and J. Cebula, “The basics of cloud computing,” United States Comput.,
2011.
[3]
A. K. Pandey et al., “Trends in Malware Attacks: Identification and Mitigation
Strategies,” in Critical Concepts, Standards, and Techniques in Cyber Forensics, IGI
Global, 2020, pp. 47–60.
[4]
R. Hackworth, “Data encryption,” Itnow, vol. 37, no. 5, pp. 12–13, 1995, doi:
10.1093/combul/37.5.12.
Copyright © 2020 Jawaher Alharthi, Dr. Sabah Alzahrani, AJRSP. This is an open-access article
distributed under the terms of the Creative Commons Attribution License (CC BY NC).
www.ajrsp.com
131