Transcription
International Journal of Computer Trends and TechnologyISSN: 2231-2803 / 8Volume 67 Issue 3,146-150, March 2019 2019 Seventh Sense Research Group Review ArticleCloud Computing and Data SecurityChallenges: A Nepal CaseShailendra GiriExecutive Director, Personnel Training Academy, Ministry of Federal Affairs and General AdministrationKathmandu, NepalAbstract - Cloud computing is an alternate choice forcomputer and mobile users for data storage andaccess. Cloud computing and data security are bothmajor issues in Nepal. The author is exploring cloudcomputing and data security in the cloud. The contentanalysis method is used to conduct the study. Thestudy concludes that cloud computing is essential forNepal's data accessibility, regulation, and storage.Nepal is an underdeveloped country as well. It hasnot had sufficient technological know-how, sufficientfinancial resources, a huge digital divide, and skilledhuman resources, so the data security issue isgenuine. The storage, virtualization, and networksare the major security concerns in Cloud Computing.Virtualization allowing multiple users to share aphysical server is one of the key concerns for cloudusers and providers. Cloud networks target attacks,particularly while communicating with remote virtualequipment their target in data. It is clear that Nepal isfacing many challenges in cloud computing, aresecurities, storage, data center operation, costingmodel, charging model, service level agreement,locality, integrity, access, segregation, breaches, andconfidentiality. Nepal is one of the developingcountries, and it should start to use its server andsatellite for communication and data center or databank.Keywords - Cloud computing, data securitychallenges, security model, vulnerabilities, egovernment.I. INTRODUCTIONCloud computing is fast-growing and acceptedcomputing model for hosting large computingsystems and services [19]. Gartner [20] measuredCloud Computing as the first among the top 10 mostimportant technologies. It is changing the operationalexpenses in information and communicationtechnology (ICT) and has changed the wayinfrastructures reform the current computing age.Cloud computing has also massively removed start-upCosts for new companies and has influenced how westore and process data [17]. The use of cloudcomputing covers a large scope; floppy disks, harddisk, CDs, and USBs, were used as mass storage, buteveryone loves cloud computing. Big organizationsand individuals use it as a tool, as a means of file anddata sharing. Being fundamental assets, it has madefile and resource sharing easy and fast. Using theinternet and virtual space software, people could storetheir important data and secret information.It permits firms to avoid or minimize up-front ITinfrastructure prices and permits enterprises to urgetheir applications up and running more rapidly, withimproved flexibility and less maintenance, whichpermits IT, groups to faster regulate resources 3]. The provision of high-capacitynetworks, affordable computers, and storage devicesis still because the widespread adoption of nvoluntary and utility computing has crystal rectifierto growth in cloud computing [5]. Data is thefundamental asset that we need to secure [17]. Thereis no need to carry mass storage devices like harddisks, floppy disks, CDs, memory cards, USBs, etc.We can easily retrieve our files from anywhere in theworld because data are stored in the cloud. Hard disk,floppy disk, CD, and USB have limited storagecapacity, so cloud computing has been used. Cloudcomputing provides 5 Gb of free space to the user. Ifthey need more space, they should buy as they need.The importance of Cloud Computing is increasingand receiving growing attention in the scientific andindustrial community. Cloud Computing is obtainableanywhere, with suitable, on-demand network accessto a shared pool of configurable computing resources.Cloud Computing seems as a computational paradigmand a distribution structural design. Its main aim is toprovide secure, fast, suitable data storage and netcomputing service, with all computing resourcesvisualized as services and delivered over the internet[3],[21]. The cloud permit collaboration, agility,scalability, availability, ability to adapt to fluctuationsaccording to demand, and accelerate developmentwork. It provides the potential for cost reductionthrough optimized and efficient computing [10].There has been a rapid increase in cloudcommunication and data storage, and security in thelast few years. Still, there are many difficult andrigorous computation problems in data security incloud computing [4].IT is becoming a worldwide cloud, increasinglyembedding the computational and storage resourcesThis is an open access article under the CC BY-NC-ND license )
Shailendra Giri / IJCTT, 67(3), 146-150, 2019that can meet the requirements of emergingapplications [16]. With the constant developments oftechnology in computing and networks, thevirtualization capabilities allow a new approach. [8].Cloud computing proposes to rework the manner it'sconsumed and managed with guarantees ofimproved price efficiencies, accelerated innovation,quicker time-to-market, and, therefore, the ability toscale applications on-demand [29]. It helps meet theemerging demands of open innovation and flexibilityrequired for global service platforms [28]. The mainprinciple of cloud computing is computing, storage,and software as a Service (SaaS), platform as aService (PaaS), Infrastructure as a Service (IaaS), oras a utility, data as a Service (Daas) [4].The objective of this study is to secure data incloud computing. This article provides a detaileddescription of data security in cloud computing. Thearticle will further analyze how data could be madesecure in the cloud in the case of Nepal. This writingexamines the types of cloud, cloud computing servicemodels, data security and issues in cloud computing,data security challenges, and vulnerabilities in cloudcomputing.configurable computing resources (e.g., networks,servers, storage, applications, and services) that canbe rapidly provisioned and released with minimalmanagement effort or service provider interaction"[20].All cloud computing approaches are not the same,and several deployment models, while different, arestill considered clouds computing are [14]:Private cloud: The cloud infrastructure is owned orleased by a single organization and is operated onlyfor that organization.Community cloud: The cloud infrastructure is sharedby several organizations and supports fix communitythat has shared concerns.Public cloud: The cloud infrastructure is owned byan organization selling cloud services to the generalpublic or a large industry group.Hybrid cloud: The cloud infrastructure comprisestwo or more clouds (internal, community, or public)that remain unique entities but are bound together bystandardized or proprietary technology that enablesdata and application portability.A. Cloud Computing Service ModelsAccording to the NIST [20] definition, cloudcomputing services can be classified based on theservice model they use to create the services. Thereare three cloud computing service models. They are:II. LITERATURE REVIEWAs a metaphor for the internet, the term cloud hasbeen used historically. This concept dates back to1961 when Professor John McCarthy suggested thatcomputer time-sharing technology might lead to afuture. This idea became very popular in the late1960s. It became clear that the IT-relatedtechnologies of the day were unable to sustain suchan artistic movement computing model. In the mid1970s, this idea became out of date. Cloud computingbegan to emerge in technology circles during thistime [13]. The vision of using and sharing computersand data as a utility has been inspired by constantlyincreasing computing needs faced by researchers inscience and can be traced back to the 1960s to theinternet. Different names are used for this platform,including utility computing, on-demand platform, andplatform as a service [18].Cloud computing is the dynamic delivery ofinformation technology resources and capabilitiesover the internet. According to Gartner Group [30],the attributes of cloud computing are service-based,scalable and elastic, shared, and metered by use, useof Internet technologies. The advantages of cloudcomputing are that it is agile, with ease and speed ofdeployment, its cost is use-based and will likely bereduced, in-house IT costs are reduced, capitalinvestment is reduced, the latest technology is alwaysdelivered, the use of standard technology isencouraged and facilitated [7[, [30].One of the most popular ones is from the NationalInstitute of Standard and Technology (NIST), whichdefines cloud computing. "Cloud computing is amodel for enabling ubiquitous, convenient, ondemand network access to a shared pool of1. Infrastructure as a Service (IaaS)The services provided in this model allow thecloud user to interact directly with the hardwareresources. The consumer is provided the capability toprovision computing power, storage, and networkresources. The consumer also has the responsibility ofsupplying software to run on the hardware resources,including operating systems and application software.As a result, although the user does not manage theunderlying cloud resources, it controls operatingsystems security and application security whilehaving limited control over network security [20].2. Platform as a Service (PaaS)In the PaaS model, the user is provided with adevelopment environment with tools, services, andlibraries. The user can create cloud services using theprovided environment while bound by the limitationsof the environment. In this service model, the usercontrols the applications/services that it creates butnot the underlying hardware or software.3. Software as a Service (SaaS)The SaaS model provides software to a clouduser that it may need. It frees the user from resourcemaintenance to a large extent while providing therequired functionality. This model offers the leastamount of control to the user. It may providecustomizability of the software to fit the user's needbut no control over the software, the platform, or theinfrastructure.147
Shailendra Giri / IJCTT, 67(3), 146-150, 2019The ISO standard ISO/IEC 1728 identifies theseservice models as cloud capabilities. It defines sevencloud service categories[17] are CaaS:Communications as a Service, CompaaS: Compute asa Service, DSaaS: Data Storage as a Service, IaaS:Infrastructure as a Service, NaaS: Network as aService, PaaS: Platform as a Service, SaaS: Softwareas a Service.storage. Virtual machines need to be stored in aphysical infrastructure which may cause a securityrisk.3. Data Center OperationIn case of data transfer bottlenecks and disaster,organizations using cloud computing applicationsneeds to protect the user's data without any loss. Ifdata is not managed properly, there is an issue withdata storage and access. In case of disaster, the cloudproviders are responsible for data loss.B. Data Security and Security Issues in CloudComputingCloud computing is a new model of resourcesharing. Many of us are already using cloudcomputing in our daily lives for personal use [25].Data security is a common concern for anytechnology now. It is becoming a major challengewhen SaaS users have to rely on their providers forproper security [24],[26], [27]. The main ambition ofsecurity is to limit access only to those approved, letthose with approval see and/or modify only the datathey are entitled to see and no other data, and ensurethat no one can demand resources [25]. Whenentrusting an organization's critical information togeographically dispersed cloud platforms not underthe direct control of that organization, the principalconcern is security.Data backup is a serious task to store and maintain itssecurity to facilitate recovery in a disaster [26]. Nowits attention to cloud computing environments anddescribes the methodology for guaranteeing datasecurity. The major concern is how cloud resourcesshould be protected in the PaaS),andInfrastructure-as-a-Service (IaaS) environments andoffers Security best practices for service providers[23].In SaaS, organizational data is oftenprocessed in plaintext and stored in the cloud. TheSaaS provider is responsible for the security of thedata in the cloud. When it is being processed andstored in the cloud [15]. Today, cloud computingusers are looking toward horizons to expand their onpremises infrastructure and cannot afford the risk ofcompromising the security of their applications anddata. Data security is the greatest challenge or issue ofcloud computing [12]. Cloud providers preservesubcontract other services such as backup from thirdparty service providers. [24].4. Costing ModelDuring migrating to the cloud can significantlyreduce the infrastructure cost, it does raise the cost ofdata communication. The cost of data integration canbe substantial as different clouds often use proprietaryprotocols and interfaces. This requires the cloudconsumer to interact with various clouds using cloudprovider-specific. The splitting and mixing of data notonly add substantial extra financial cost but can alsoseverely affect the system performance [1]5. Charging ModelThis includes re-design and re-development ofthe software originally used for single-tenancy, thecost of providing new features that allow for cement for concurrent user access, and dealingwith complexities induced by the above changes.6. Service Level AgreementAlthough cloud consumers do not have controlover the underlying computing resources, they needto ensure the quality, availability, reliability, andperformance of these resources when they havemigrated their core business functions onto theirentrusted cloud. In other words, consumers need toobtain guarantees from providers on service delivery.In addition, different cloud offerings (IaaS, PaaS,SaaS, and DaaS) will need to define different SLAmeta specifications.7. What to migratePeripheral functions such as IT managementand personal applications are the easiest IT systems tomove. Organizations are traditional in employingIaaS compared to SaaS. This is partly becausemarginal functions are often outsourced to the cloud,and core activities are kept in-house.C. Data Security Challenges in Cloud Computing1. SecurityIt is known that the security issue has played akey role in hindering cloud computing. The multitenancy model and the pooled computing resources incloud computing have introduced security challenges[31].8. LocalityIn cloud computing, the facts are distributed overa wide variety of areas, and discovering theinformation region is difficult. When the statistics aremoved to special geographic locations, the legalguidelines governing that data also can trade. So theremay be an issue with compliance and statistics legalprivacy guidelines in cloud computing. Customers2. StorageThe data stored in virtual machines have manyissues. One such issue is the reliability of data148
Shailendra Giri / IJCTT, 67(3), 146-150, 2019need to know their facts vicinity, and it's far to beintimated through the service provider.can be intruded upon by injecting a client code orusing any application. So there is necessary to storedata separately from the remaining customer data.Vulnerabilities with data segregation can be detectedor found using the tests such as SQL injection, Datavalidation, and insecure storage.9. IntegrityThe system must preserve security such that theauthorized man or woman may only change statistics.In cloud-primarily based surroundings, facts integrityneeds to be maintained efficaciously to avoidmisplaced statistics. In prefer, each transaction incloud computing should follow ACID houses topreserve statistics integrity. Most internet offeringsface many issues with transaction managementregularly because it uses HTTP offerings. HTTPcarriers no longer aid transactions or assure transport.It can be dealt with by enforcing transaction controlinside the API itself.D. Vulnerabilities in Cloud ComputingWe mainly focus on technology-basedvulnerabilities, but there are other vulnerabilities inall organizations. Some of these vulnerabilities are:Lack of employee screening and poor hiringpractices [6]– some cloud providers might notperform background screening of their employees.Private users such as cloud administrators usuallyhave unlimited access to the cloud data.10. AccessData access mainly refers to data securitypolicies. In an organization, the employees will begiven access to the data section based on theircompany security policies. The same data cannot beaccessed by the other employee working there.Various encryption techniques and key managementmechanisms ensure that data is shared only with validusers. The key is distributed only to the authorizedparties using various mechanisms. To secure the datafrom unauthorized users, the data security policiesmust be strictly followed. Since access is giventhrough the internet for all cloud users, it is necessaryto provide privileged user access. Users can use dataencryption and protection mechanisms to avoidsecurity risks.Lack of customer background checks– many cloudproviders do not check their customer's environment,and more or less anyone can open an account with avalid credit card and email [6].Lack of security education– citizens continue to be aweak point in information safety [22]. This is true inany institute, though; in the cloud, it has a superiorimpact because many people network with the cloud:cloud providers, third-party providers, suppliers,organizational customers, and end-users.Cloud Computing has been existing technologiessuch as web services, web browsers, andvirtualization, which contribute to the evolution ofcloud environments. So, any vulnerability associatedwith these technologies affects the cloud, and it caneven significantly impact data security in the cloud[11].11. ConfidentialityData is stored on remote servers by the cloudusers, and content such as data, videos, etc. It can bestored with single or multi-cloud providers. Whendata is stored on a remote server, data confidentialityis one of the important requirements. To maintain theconfidentiality of data understanding and itsclassification, users should know which data is storedin the cloud and its accessibility.III. DISCUSSIONCloud computing services contain extremelyoptimized virtualized data centers providing hardware,software, and information resources wheneverrequired. Still, data and information securitychallenges in the cloud are a big issue. More cloudsystems are developed, and new concepts areintroduced while cloud computing technologyemerges. Highly available cloud applications can beconstructed, for example, by deploying them on twocompetitive cloud offerings, e.g., Google's AppEngine [9] and Amazon's EC2 [2]. Cloud computingoffers a massive pool of resources and services thatcloud user's can utilize for storing and processingtheir data. However, cloud computing has manybenefits as well as demerits too. Data security is oneof the top concerns of data owners when movingoperations to the cloud. Most of these cloud-specificissues arise due to the new attack vector. Encryptiondecryption techniques have been used for a long timeto secure important data. A digital signature andfirewall could also protect data on the cloud ifmaintained properly. Nepal's government also12. BreachesData Breaches are another important securityissue to be concentrated on in the cloud. Since largedata from various users are stored in the cloud, thereis a possibility of the malicious user entering thecloud such that the entire cloud environment is proneto a high-value attack. A breach can occur due tovarious accidental transmission issues or insiderattacks.13. SegregationOne of the major characteristics of cloudcomputing is multi-tenancy. Since multi-tenancyallows data storage by multiple users on cloudservers, there is a possibility of data intrusion. Data149
Shailendra Giri / IJCTT, 67(3), 146-150, 2019concentrates on data security policy, acts, and plans indays to come. The government should start to developits data bank in the country, and an integrated datastore system should apply to government agenciesand other concerned stakeholders at the right time.Cyber attract, threat, hacking, cracking, and highjacking are increasing daily. All of the above focus ondata.[8]IV. CONCLUSION[13][9][10][11][12]Cloud computing has become a fundamental partof the computing world. It provides IT services overthe internet where cloud users do not know where thedata or information is stored and where theinfrastructure is located. Cloud users receive serviceswithout knowing how it's provided and from where.The countries' commitment to maintaining thesecurity of the cloud is essential at present. Safe cloudcomputing environments guarantee data security incloud computing. These models could be fit in thecase of Nepal for data protection in the cloud is theSoftware-as-a-Service (SaaS), Platform-as-a-Service(PaaS), and Infrastructure-as-a-Service (IaaS). It isclear that Nepal is facing many challenges in cloudcomputing, is security, storage, data center operation,costing model, charging model, service levelagreement, locality, integrity, access, segregation,breaches, and confidentiality. The study concludesthat storage, virtualization, and networks are themajor security concerns in Cloud Computing.Virtualization allowing multiple users to share aphysical server is one of the key concerns for cloudusers and providers. The other challenges aredifferent types of virtualization in technologies.Virtual networks target attacks, particularly whilecommunicating with remote virtual equipment. Theirtarget is data security. Nepal is one of the developingcountries; it should start to use its server and satellitefor communication and data 4]REFERENCES[25][1][2][3][4][5][6][7]A.Leinwand, (2009)."The Hidden Cost of the Cloud:Bandwidth Charges," -cloud-bandwidthchargesAmazon Elastic Compute Cloud. http://aws.amazon.com/ec2/Baburajan, R. (2011). "The Rising Cloud Storage MarketOpportunity Strengthens Vendors ."http://it.tmcnet.com.Bele, S. B (2018). A Comprehensive Study on CloudComputing. International Journal of Information Researchand Review. Vol. 05, Issue, 03, pp.5310-5313Cloud Computing: Clash of the clouds", 2009. TheEconomist. www.economist.com.Cloud Security Alliance (2010). Top Threats to alliance.org/research/top-threatsConti, Marco, (2011)."Research challenges towards theFuture Internet," Computer Communications, 34(18), 2115–2134[26][27][28][29][30]150For a detailed analysis of NRENs in Europe and their role,see the documents (in particular the TERENA compendium),http: / /www.terena.org/publications/Google App Engine. http://code.google.com/appengine.Retrieved: 9 February 2019.Grumman, G. (2008). What cloud computing means".InfoWorld. Retrieved: 10 February 2019.Hashizume (2013). An analysis of security issues for cloudcomputing. Journal of Internet Services and iggest-cloud-challengesecurity, retrieved 29 Feb of-john-mccarthy,retrieved 5 Jan ng/index.htmlJu J, Wang Y, Fu J, Wu J, Lin Z (2010). Research on KeyTechnology in SaaS. In: International Conference onIntelligent Computing and Cognitive Informatics (ICICCI),Hangzhou, China. IEEE Computer Society, Washington, DC,USA, pp 384–387Koslovski G., Huu T. T., Montagnat J., & Primet P. V.-B,2009. First International Conference, CloudComp 2009.Munich, Germany, October 19-21.Kumar., V., Chaisiri, S. ,Ko.R.(2017). Data Security in CloudComputing. The Institution of Engineering and Technology.Published by The Institution of Engineering and Technology,London, United Kingdom.Li Henry (2009). Introduction to Windows Azure AnIntroduction to Cloud Computing Using Microsoft WindowsAzur. Printed and bound in the United States of (AmericaMustafa S.2015). Resource management in cloud computing:Taxonomy, prospects, and challenges. Computer ElectricalEngineering, http://dx.doi.org/ 10.1016/j.National Institute of Standards and Technology, (2011). gov/itl/cloud/ upload/cloud-def-v15.pdfOestreich, Ken, (2010). "Converged Infrastructure". CTOForum. Thectoforum.com.Popovic K, Hocenski Z. (2010). Cloud Computing Securityissues and challenges. In: Proceedings of the 33rdInternational Convention MIPRO. IEEE Computer SocietyWashington DC, USA, pp 344–349Rittinghouse John W. & Ransom James F. (2010). CloudComputing Implementation, Management, and Security. CRCPress Taylor & Francis Group. Boca Raton London- NewYorkRittinghouse JW, Ransome JF (2009). Security in the Cloud.In: Cloud Computing. Implementation, Management, andSecurity, CRC PressSarana David E.Y. Implementing and Developing CloudComputing Applications. CRC Press. Auerbach PublicationsTaylor & Francis Group. USASubashini S, Kavitha V. (2011). A survey on security issuesin service delivery models of Cloud Computing. NetwComput Appl 34(1):1–11Viega J.(2009) Cloud Computing and the Common Man.Computer 42(8):106–108Villasante Jesus (2009). Cloud Computing Enabling theFuture Internet. First International Conference, CloudComp2009. Munich, Germany, October 19-21.Walther Dane S.(2009). Akamai and Cloud Computing. FirstInternational Conference, CloudComp 2009. Munich,Germany, October -computing.jsp.Y. Chen, V. Paxson, and R. Katz, (2010). "What’s NewAbout Cloud Computing Security?
Community cloud: The cloud infrastructure is shared by several organizations and supports fix community that has shared concerns. Public cloud: The cloud infrastructure is owned by an organization selling cloud services to the general public or a large industry group. Hybrid cloud: The cloud infrastructure comprises
