CERIAS The Center for Education and Research in Information Assurance and Security Hans Vargas Silva, Temitope Toriola, and Melissa Dark This project is a comparison of Cloud Computing Security policies. We ex- plored threats, vulnerabilities, and controls in cloud computing, to gain a deeper understanding of cloud storage, accessibility, security, and threats. We examined security control models of three major cloud providers (Windows Azure, Google Drive, and Amazon Web Services S3). 2 34 35 38 39 53 x x x x x x x x x x x x x TO1 Script Kiddie x x x x x x x x x x x x x x x x x x x x TO2 Criminals x x x x x x x x x x x x x x x x x x x x x x x TO3 Na on State AC IA AC IR SC IA SC IA SC IA SC IA SC SA SC IR SC SA ACAC SC SC SC 3 1 2 4 2 6 12 6 12 6 12 4 12 2 4 8 6 2 1 3 2 5 3 14 2 7 7 13 7 13 7 13 7 13 7 5 6 5 27 5 Vulnerabili es Security Controls 6 8 9 11 10 1 18 28 CONTROLS CATEGORIZATION Access Control (AC) Awareness and Training (AT) Audit and Accountability (AU) Assessment and Authorization (CA) Configuration Management (CM) Contingency Planning (CP) Identification and Authentication (IA) Incident Response (IR) Maintenance (MA) Media Protection (MP) Physical and Environmental Protection (PE) Planning (PL) Personnel Security (PS) Risk Assessment (RA) System and Services Acquisition (SA) System and Communications Protection (SC) System and Information Integrity (SI) SELECTED VULNERABILITIES (SAAS) V1. AUTHENTICATION, AUTHORIZATION AND ACCOUNTING VULNERABILITIES V2. USER PROVISIONING VULNERABILITIES V6. LACK OF RESOURCE ISOLATION V8. COMMUNICATION ENCRYPTION VULNERABILITIES V9. LACK OF OR WEAK ENCRYPTION OF ARCHIVES AND DATA IN TRANSIT V10. IMPOSSIBILITY OF PROCESSING DATA IN ENCRYPTED FORM V11. POOR KEY MANAGEMENT PROCEDURES V18. POSSIBILITY THAT CO-RESIDENCE CHECKS WILL BE PERFORMED V28. NO POLICIES FOR RESOURCE CAPPING V34. UNCLEAR ROLES AND RESPONSIBILITIES V35. POOR ENFORCEMENT OF ROLE DEFINITIONS V38. MISCONFIGURATION V39. SYSTEM OR OS VULNERABILITIES V53. INADEQUATE OR MISCONFIGURED FILTERING RESOURCES Threats, Vulnerabilities, and Security Controls in Cloud Computing

Threats, Vulnerabilities, and Security Controls in Cloud Computing · · 2013-03-11This project is a comparison of Cloud Computing Security policies. We ex-plored threats, vulnerabilities,

Download PDF Report

Upload
phungdang
View
215
Download
2

Embed Size (px)

Citation preview

Page 1: Threats, Vulnerabilities, and Security Controls in Cloud Computing · · 2013-03-11This project is a comparison of Cloud Computing Security policies. We ex-plored threats, vulnerabilities,

CERIASThe Center for Education and Research in Information Assurance and Security

Hans Vargas Silva, Temitope Toriola, and Melissa Dark

This project is a comparison of Cloud Computing Security policies. We ex-plored threats, vulnerabilities, and controls in cloud computing, to gain a deeper understanding of cloud storage, accessibility, security, and threats.

We examined security control models of three major cloud providers (Windows Azure, Google Drive, and Amazon Web Services S3).

2 34 35 38 39 53x x x x x x x x x x x x x TO1 Script Kiddiex x x x x x x x x x x x x x x x x x x x TO2 Criminalsx x x x x x x x x x x x x x x x x x x x x x x TO3 Nation State

AC IA AC IR SC IA SC IA SC IA SC IA SC SA SC IR SC SA AC AC SC SC SC3 1 2 4 2 6 12 6 12 6 12 4 12 2 4 8 6 2 1 3 2 5 3

14 2 7 7 13 7 13 7 13 7 13 7 5 6 5 27 5

Vulnerabilities

Security Controls

6 8 9 11101 18 28

CONTROLS CATEGORIZATIONAccess Control (AC)Awareness and Training (AT)Audit and Accountability (AU)Assessment and Authorization

(CA)Configuration Management

(CM)Contingency Planning (CP)Identification and Authentication

(IA)Incident Response (IR)Maintenance (MA)

Media Protection (MP)Physical and Environmental

Protection (PE)Planning (PL)Personnel Security (PS)Risk Assessment (RA)System and Services Acquisition

(SA)System and Communications

Protection (SC)System and Information Integrity

(SI)

SELECTED VULNERABILITIES (SAAS)V1. AUTHENTICATION, AUTHORIZATION AND ACCOUNTING VULNERABILITIESV2. USER PROVISIONING VULNERABILITIESV6. LACK OF RESOURCE ISOLATIONV8. COMMUNICATION ENCRYPTION VULNERABILITIESV9. LACK OF OR WEAK ENCRYPTION OF ARCHIVES AND DATA IN TRANSITV10. IMPOSSIBILITY OF PROCESSING DATA IN ENCRYPTED FORMV11. POOR KEY MANAGEMENT PROCEDURESV18. POSSIBILITY THAT CO-RESIDENCE CHECKS WILL BE PERFORMEDV28. NO POLICIES FOR RESOURCE CAPPINGV34. UNCLEAR ROLES AND RESPONSIBILITIESV35. POOR ENFORCEMENT OF ROLE DEFINITIONSV38. MISCONFIGURATIONV39. SYSTEM OR OS VULNERABILITIESV53. INADEQUATE OR MISCONFIGURED FILTERING RESOURCES

Threats, Vulnerabilities, and Security Controls in Cloud Computing