Prioritizing Cloud Security Controls

<div>Most cyber-attacks and data breaches in cloud</div><div>infrastructure are due to human errors and misconfiguration</div><div>vulnerabilities. Cloud customer-centric tools are lacking, and existing</div><div>security models do not efficiently tackle these security challenges.</div><div>Novel security mechanisms are imperative, therefore, we</div><div>propose Risk-driven Fault Injection (RDFI) techniques to tackle</div><div>these challenges. RDFI applies the principles of chaos engineering</div><div>to cloud security and leverages feedback loops to execute, monitor,</div><div>analyze and plan security fault injection campaigns, based on</div><div>a knowledge-base. The knowledge-base consists of fault models</div><div>designed from cloud security best practices and observations</div><div>derived during iterative fault injection campaigns. Furthermore,</div><div>the observations indicate security weaknesses and verify the</div><div>correctness of security attributes (integrity, confidentiality and</div><div>availability) and security controls. Ultimately this knowledge is</div><div>critical in guiding security hardening efforts and risk analysis.</div><div>We have designed and implemented the RDFI strategies including</div><div>various chaos algorithms as a software tool: CloudStrike. Furthermore,</div><div>CloudStrike has been evaluated against infrastructure</div><div>deployed on two major public cloud systems: Amazon Web Service</div><div>and Google Cloud Platform. The time performance linearly</div><div>increases, proportional to increasing attack rates. Similarly, CPU</div><div>and memory consumption rates are acceptable. Also, the analysis</div><div>of vulnerabilities detected via security fault injection has been</div><div>used to harden the security of cloud resources to demonstrate the</div><div>value of CloudStrike. Therefore, we opine that our approaches</div><div>are suitable for overcoming contemporary cloud security issues</div>

Download Full-text

Analysis of recommended cloud security controls to validate OpenPMF “policy as a service”

Information Security Technical Report ◽

10.1016/j.istr.2011.08.001 ◽

2011 ◽

Vol 16 (3-4) ◽

pp. 131-141 ◽

Cited By ~ 6

Author(s):

Ulrich Lang ◽

Rudolf Schreiner

Keyword(s):

Cloud Security ◽

Security Controls

Download Full-text

Cloudstrike: Chaos Engineering for Security and Resiliency in Cloud Infrastructure

10.36227/techrxiv.12456299.v1 ◽

2020 ◽

Author(s):

Kennedy Torkura

Keyword(s):

Knowledge Base ◽

Fault Injection ◽

Software Tool ◽

Cloud Security ◽

Cyber Attacks ◽

Cloud Infrastructure ◽

Security Issues ◽

Security Controls ◽

Security Models ◽

Consumption Rates

<div>Most cyber-attacks and data breaches in cloud</div><div>infrastructure are due to human errors and misconfiguration</div><div>vulnerabilities. Cloud customer-centric tools are lacking, and existing</div><div>security models do not efficiently tackle these security challenges.</div><div>Novel security mechanisms are imperative, therefore, we</div><div>propose Risk-driven Fault Injection (RDFI) techniques to tackle</div><div>these challenges. RDFI applies the principles of chaos engineering</div><div>to cloud security and leverages feedback loops to execute, monitor,</div><div>analyze and plan security fault injection campaigns, based on</div><div>a knowledge-base. The knowledge-base consists of fault models</div><div>designed from cloud security best practices and observations</div><div>derived during iterative fault injection campaigns. Furthermore,</div><div>the observations indicate security weaknesses and verify the</div><div>correctness of security attributes (integrity, confidentiality and</div><div>availability) and security controls. Ultimately this knowledge is</div><div>critical in guiding security hardening efforts and risk analysis.</div><div>We have designed and implemented the RDFI strategies including</div><div>various chaos algorithms as a software tool: CloudStrike. Furthermore,</div><div>CloudStrike has been evaluated against infrastructure</div><div>deployed on two major public cloud systems: Amazon Web Service</div><div>and Google Cloud Platform. The time performance linearly</div><div>increases, proportional to increasing attack rates. Similarly, CPU</div><div>and memory consumption rates are acceptable. Also, the analysis</div><div>of vulnerabilities detected via security fault injection has been</div><div>used to harden the security of cloud resources to demonstrate the</div><div>value of CloudStrike. Therefore, we opine that our approaches</div><div>are suitable for overcoming contemporary cloud security issues</div>

Download Full-text

CLOUD SECURITY PRE-ASSESSMENT MODEL FOR CLOUD SERVICE PROVIDER BASED ON ISO/IEC 27017:2015 ADDITIONAL CONTROL

International Journal of Innovation and Industrial Revolution ◽

10.35631/ijirev.25001 ◽

2020 ◽

Vol 2 (5) ◽

pp. 01-17

Author(s):

Nur Ahada Kamaruddin ◽

Ibrahim Mohamed ◽

Ahmad Dahari Jarno ◽

Maslina Daud

Keyword(s):

Cloud Computing ◽

Service Provider ◽

Cost Effective ◽

Cloud Service ◽

Cloud Security ◽

Assessment Method ◽

Cloud Services ◽

Assessment Model ◽

Cloud Service Provider ◽

Security Controls

Cloud computing technology has succeeded in attracting the interest of both academics and industries because of its ability to provide flexible, cost-effective, and adaptable services in IT solution deployment. The services offered to Cloud Service Subscriber (CSS) are based on the concept of on-demand self-service, scalability, and rapid elasticity, which allows fast deployment of IT solutions, whilst leads to possible misconfiguration, un-patched system, etc. which, allows security threats to compromise the cloud services operations. From the viewpoint of Cloud Service Provider (CSP), incidents such as data loss and information breach, will tarnish their reputations, whilst allow them to conserve the issues internally, in which there is no transparency between CSP and CSS. In the aspects of information security, CSP is encouraged to practice cybersecurity in their cloud services by adopting ISO/IEC27017:2015 inclusive of all additional security controls as mandatory requirements. This study was conducted to identify factors that are influencing the CSP readiness level in the cybersecurity implementation of their cloud services by leveraging the developed pre-assessment model to determine the level of cloud security readiness. Approached the study is based on the combination of qualitative and quantitative assessment method in validating the proposed model through interview and prototype testing. The findings of this study had shown that factors that influence the CSP level of cloud security readiness are based on these domains; technology, organisation, policy, stakeholders, culture, knowledge, and environment. The contribution of the study as a Pre-Assessment Model for CSP which is suitable to be used as a guideline to provide a safer cloud computing environment.

Download Full-text

Web Based Application for Cloud Security and Compliance

Intelligent Systems and Computer Technology - Advances in Parallel Computing ◽

10.3233/apc200145 ◽

2020 ◽

Author(s):

Priyanka K ◽

Priya R

Keyword(s):

Web Application ◽

Service Providers ◽

Cloud Security ◽

Security Measures ◽

Web Based ◽

Security And Protection ◽

Cloud Data ◽

Security Issues ◽

Security Controls ◽

Client Data

cloud computing service is the most important services for many of the organizations. The service providers must ensure of their security and protection techniques to guarantee to protect the client data. There are some cloud security guidelines that supports the cloud data security are need to be followed by the vendors. Despite the fact, the vendors are facing the mess of security and protection controls and eventually leads to an confusion among the consumers on concerning the safety efforts and whether their measures satisfies the security measures. An inclusive report to survey the risk and security issues faced by cloud consumers have depicted to control the hazards. In light of this investigation, an ontology describing the cloud security controls, threats and compliances framed. a web based cloud application is designed to recommend the cloud security policies from the ontology such that it also helps the existing cloud providers. Security strategies can also be planned by the consumers by utilizing the web application that describing the ontology

Download Full-text