Traditional Security

These concerns involve computer and network intrusions or attacks that will be made possible or at least easier by moving to the cloud. Cloud providers respond to these concerns by arguing that their security measures and processes are more mature and tested than those of the average company.  Another argument, made by the Jericho Forum is:  "It could be easier to lock down information if it's administered by a third party rather than in-house, if companies are worried about insider threats… In addition, it may be easier to enforce security via contracts with online services providers than via internal controls".

Concerns in this category include:

Traditional security Threat #1. VM-level attacks

VM-Level Attacks

 Potential vulnerabilities in the hypervisor or VM technology used by cloud vendors are a potential problem in multi-tenant architectures.  Vulnerabilities have appeared in VMWare, Xen, and Microsoft’s Virtual PC and Virtual Server. Vendors such as Third Brigade mitigate potential VM-level vulnerabilities through monitoring and firewalls.

Traditional security Threat #2. Cloud provider vulnerabilities

 These could be platformlevel, such as an SQL-injection or cross-site scripting vulnerability in salesforce.com. For instance, there have been a couple of recent Google Docs vulnerabilities and the Google response to one of them is here: There is nothing new in the nature of these vulnerabilities; only their setting is novel.  In fact, IBM has repositioned its Rational AppScan tool, which scans for vulnerabilities in web services as a cloud security service (see Blue Cloud Initiative).

Traditional security Threat #3. Phishing cloud provider

 Phishers and other social engineers have a new attack vector, as the Salesforce phishing incident shows.

Traditional security Threat #4. Expanded network attack surface

Expanded Network Attack Surface

 The cloud user must protect the infrastructure used to connect and interact with the cloud, a task

complicated by the cloud being outside the firewall in many cases. For instance, shows an example of how the cloud might attack the machine connecting to it.

Traditional security Threat #5. Authentication and Authorization

 The enterprise authentication and authorization framework does notnaturally extend into the cloud. How does a company meld its existing framework to include cloud resources?  Furthermore, how does an enterprise merge cloud security data (if even available) with its own security metrics and policies?

Authentication and Authorization

Traditional security Threat #6. Forensics in the cloud

Forensics in the cloud

 Traditional digital forensic methodologies permit investigators to seize equipment and perform detailed analysis on the media and data recovered. The likelihood therefore, of the data being removed, overwritten, deleted or destroyed by the perpetrator in this case is low. More closely linked to a CC environment would be businesses that own and maintain their own multi-server type infrastructure, though this would be on a far smaller scale in comparison. However, the scale of the cloud and the rate at which data is overwritten is of concern.