Cloud Computing - Presentation
Transcript: Alshamaileh, Y. (2013). An Empirical Investigation Of Factors Affecting Cloud Computing Adoption Among SMEs In The North East Of England. Ph.D. Newcastle University Business School. Avram, M. (2014). Advantages and Challenges of Adopting Cloud Computing from an Enterprise Perspective.Procedia Technology, 12, pp.529--534. Avram, M. (2014). Advantages and Challenges of Adopting Cloud Computing from an Enterprise Perspective.Procedia Technology, 12, pp.529--534. Cloutage, (2010). Cloutage - Tracking Cloud Incidents, Security, and Outages. [online] Available at: http://cloutage.org/ [Accessed 10 Apr. 2014]. Dekker, M. (2014). Critical Cloud Computing. Version 1,0. European Network and Information Security Agency (ENISA). Dorey, P. and Leite, A. (2011). Commentary: Cloud computing--A security problem or solution?. information security technical report, 16(3), pp.89--96. European Network and Information Security Agency (ENISA), (2009). An SME perspective on Cloud Computing - Survey. European Network and Information Security Agency (ENISA), (2009). Cloud Computing: Benefits, risks and recommendations for information security. European Network and Information Security Agency (ENISA), (2009). Information Assurance Framework. Gartner, (2013). Gartner Says Cloud Computing Will Become the Bulk of New IT Spend by 2016. [online] Available at: http://www.gartner.com/newsroom/id/2613015 [Accessed 13 Apr. 2014]. Mather, T., Kumaraswamy, S. and Latif, S. (2009). Cloud security and privacy. 1st ed. Beijing: O'Reilly. Oracle, (2012). Oracle’s Cloud Solutions for Public Sector. Rasheed, H. (2013). Data and infrastructure security auditing in cloud computing environments. International Journal of Information Management. Ryan, M. (2013). Cloud computing security: The scientific challenge, and a survey of solutions. Journal of Systems and Software, 86(9), pp.2263--2268. Sridhar, D., Ganapriya, V. and Srivanitha, M. (2014). E-Commerce Applications Security Aspects in Cloud Computing. INTERNATIONAL JOURNAL OF ENGINEERING SCIENCES & RESEARCH TECHNOLOGY, 3(2)(2277-9655). Steiner, T. (2012). An Introduction To Securing a Cloud Environment. SANS Institute InfoSec Reading Room. Cloud Security-Risk Assessment Data Security - Concerns and Measures to Protect Aim and Objectives [Aim] To understand security-related factors in cloud computing services that motivates/discourages enterprises to adopt services over the cloud. Initiatives to track security incidents: - Open Security Foundation Project -Cloutage.org -ENISA [Objectives] Define cloud computing Outline security-related factors in the cloud - Awareness - Risks unique to cloud services - Data security in focus Review Data Security measures in cloud services - Encryption - Standardization How to Enhance security measures for cloud service - Incident Reporting Is it a new technology? No. Is it a technology? No Mather et al. (2009) in their book Cloud security and privacy provided "definition of benefits". National Institute of Standards and Technology (NSIT) provides a comprehensive definition Service models | Deployment models | Benefits ENISA survey of cloud adoption (2009) Exploring security factors in cloud computing adoption - An enterprise perspective ENISA report (cloud computing: benefits, and risk assessment 2009) Data are the major unit for cloud services. Concerns: - Data at Rest, Data in Transit - Data Lineage - Data Remanence Encryption, does not solve the problem: - Symmetric encryption [Key management is an issue!] - Fully homomorphic (IBM) Classic security measures: Protocols, Firewalls, IDS, Isolation and virtualization Standards: quiet few, needs more though! - NIST, ENISA, ISO 27001/27002, ITIL - Focus on access control & management, other processes need to have more attention. SPI service model as presented in Mather et.al (2009, p.11) Incident reporting is very important for security measures' evolution! Definitions Keywords: Cloud Computing, Cloud Security, Data Security, Cloud incident reporting, Encryption in cloud computing Conclusions Is it all "risks and threats"? Not at all! How is it different than threats to the classic information systems? Four security threats that make the difference! Multi-tenancy | Exposure | Provider Access | Limited Auditing "Awareness is the first step towards change". Are enterprises aware of the threats? "A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” - NIST Special Publication 800-145 (2011 as cited in Oracle White paper (2012,p.5)) References Security is a major factor when adopting cloud computing is considered. Enterprises pay attention to data privacy and confidentiality Despite continuous incidents, there is still a considerable move into the clouds service. Cost and efficiency