Cloud computing security: Difference between revisions

Revision as of 20:52, 4 March 2024

Latest revision as of 12:06, 28 August 2025

(23 intermediate revisions by 18 users not shown)

Line 2:

{{for|cloud-hosted security software|Security as a service}}

{{Computer hacking|expanded=Computer security}}

'''Cloud computing security''' or, more simply, '''cloud security''', refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of [[cloud computing]]. It is a sub-___domain of [[computer security]], [[network security]], and, more broadly, [[information security]].

==Security issues associated with the cloud==

Cloud [[Cloud computing]] and storage provide users with the capabilities to store and process their data in third-party [[data center]]s.<ref name="cloudid">{{cite journal |last1=Haghighat |first1=Mohammad |last2=Zonouz |first2=Saman |last3=Abdel-Mottaleb |first3=Mohamed |title=CloudID: Trustworthy cloud-based and cross-enterprise biometric identification |journal=Expert Systems with Applications |date=November 2015 |volume=42 |issue=21 |pages=7905–7916 |doi=10.1016/j.eswa.2015.06.025 |s2cid=30476498 }}</ref> Organizations use the cloud in a variety of different service models (with acronyms such as [[Software as a service|SaaS]], [[Platform as a service|PaaS]], and [[Infrastructure as a service|IaaS]]) and deployment models ([[Cloud computing#Private cloud|private]], [[Cloud computing#Public|public]], [[Cloud computing#Hybrid|hybrid]], and [[community cloud|community]]).<ref name="Srinivasan">{{cite book |doi=10.1145/2345396.2345474 |chapter=State-of-the-art cloud computing security taxonomies |title=Proceedings of the International Conference on Advances in Computing, Communications and Informatics - ICACCI '12 |year=2012 |last1=Srinivasan |first1=Madhan Kumar |last2=Sarukesi |first2=K. |last3=Rodrigues |first3=Paul |last4=Manoj |first4=M. Sai |last5=Revathy |first5=P. |pages=470–476 |isbn=978-1-4503-1196-0 |s2cid=18507025 }}</ref>

Security concerns associated with cloud computing are typically categorized in two ways: as security issues faced by cloud providers (organizations providing [[Software as a service|software-]], [[Platform as a service|platform-]], or [[Infrastructure as a service|infrastructure-as-a-service]] via the cloud) and security issues faced by their customers (companies or organizations who host applications or store data on the cloud).<ref>{{cite news|url=http://security.sys-con.com/node/1231725|title=Swamp Computing a.k.a. Cloud Computing|publisher=Web Security Journal|date=2009-12-28|access-date=2010-01-25|archive-date=2019-08-31|archive-url=https://web.archive.org/web/20190831163708/http://security.sys-con.com/node/1231725|url-status=dead}}</ref> The responsibility is shared, however, and is often detailed in a cloud provider's "shared security responsibility model" or "shared responsibility model."<ref name="CSACloudCont4">{{cite web |url=https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4/ |format=xlsx |title=Cloud Controls Matrix v4 |publisher=Cloud Security Alliance |date=15 March 2021 |access-date=21 May 2021}}</ref><ref name="AWSShared20">{{cite web |url=https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/shared-security-responsibility-model.html |title=Shared Security Responsibility Model |work=Navigating GDPR Compliance on AWS |publisher=AWS |date=December 2020 |access-date=21 May 2021}}</ref><ref name="TozziAvoid20">{{cite web |url=https://www.paloaltonetworks.com/blog/prisma-cloud/pitfalls-shared-responsibility-cloud-security/ |title=Avoiding the Pitfalls of the Shared Responsibility Model for Cloud Security |author=Tozzi, C. |work=Pal Alto Blog |publisher=Palo Alto Networks |date=24 September 2020 |access-date=21 May 2021}}</ref> The provider must ensure that their infrastructure is secure and that their clients’clients' data and applications are protected, while the user must take measures to fortify their application and use strong passwords and authentication measures.<ref name="AWSShared20" /><ref name="TozziAvoid20" />

When an organization elects to store data or host applications on the public cloud, it loses its ability to have physical access to the servers hosting its information. As a result, potentially sensitive data is at risk from insider attacks. According to a 2010 [[Cloud Security Alliance]] report, insider attacks are one of the top seven biggest threats in cloud computing.<ref name="Top Threats to Cloud Computing v1.0">{{cite web|date=March 2010|title=Top Threats to Cloud Computing v1.0|url=http://www.itsecure.hu/library/file/Biztons%C3%A1gi%20%C3%BAtmutat%C3%B3k/Felh%C5%91%20szolg%C3%A1ltat%C3%A1sok/Top%20threats%20to%20cloud%20computing%20v1_0.pdf|access-date=2020-09-19|publisher=Cloud Security Alliance}}</ref> Therefore, cloud service providers must ensure that thorough background checks are conducted for employees who have physical access to the servers in the data center. Additionally, data centers are recommended to be frequently monitored for suspicious activity.

Line 21:

;Deterrent controls

:These controls are administrative mechanisms intended to reduce attacks on a cloud system and are utilized to ensure compliance with external controls. Much like a warning sign on a fence or a property, deterrent controls typically reduce the threat level by informing potential attackers that there will be adverse consequences for them if they proceed.<ref>Andress,{{cite J.book (2014)|doi=10. Deterrent Control 1016/B978-0-12-800744-0.00009-9 an|chapter=Physical overviewSecurity |title=The ScienceDirectBasics Topics.of RetrievedInformation OctoberSecurity 14,|date=2014 2021,|last1=Andress from|first1=Jason https://www.sciencedirect.com/topics/computer|pages=131–149 |isbn=978-science/deterrent0-control12-800744-0 }}</ref> (Some consider them a subset of preventive controls.) Examples of such controls could be considered as policies, procedures, standards, guidelines, laws, and regulations that guide an organization towards security. Although most malicious actors ignore such deterrent controls, such controls are intended to ward off those who are inexperienced or curious about compromising the IT infrastructure of an organization.

;Preventive controls

:The main objective of preventive controls is to strengthen the system against incidents, generally by reducing if not actually eliminating vulnerabilities, as well as preventing unauthorized intruders from accessing or entering the system.<ref>Virtue,{{cite T.,book & Rainey, J|doi=10. (2015)1016/B978-0-12-802043-2.00006-9 Preventative|chapter=Information ControlRisk -Assessment an|title=HCISPP overviewStudy Guide |date=2015 ScienceDirect|last1=Virtue Topics.|first1=Timothy Retrieved|last2=Rainey October|first2=Justin 13,|pages=131–166 2021, from https://www.sciencedirect.com/topics/computer|isbn=978-science/preventative0-control12-802043-2 }}</ref> This could be achieved by either ''adding'' software or feature implementations (such as firewall protection, endpoint protection, and multi-factor authentication), or ''removing'' unneeded functionalities so that the attack surface is minimized (as in [[unikernel]] applications). Additionally, educating individuals through security awareness training and exercises is included in such controls due to human error being the weakest point of security. Strong authentication of cloud users, for instance, makes it less likely that unauthorized users can access cloud systems, and more likely that cloud users are positively identified. All in all, preventative controls affect the likelihood of a loss event occurring and are intended to prevent or eliminate the systems’systems' exposure to malicious action.

;Detective controls

:Detective controls are intended to detect and react appropriately to any incidents that occur. In the event of an attack, a detective control will signal the preventative or corrective controls to address the issue. Detective security controls function not only when such an activity is in progress and after it has occurred. System and network security monitoring, including intrusion detection and prevention arrangements, are typically employed to detect attacks on cloud systems and the supporting communications infrastructure. Most organizations acquire or create a dedicated security operations center (SOC), where dedicated members continuously monitor the organization’sorganization's IT infrastructure through logs and Security Information and Event Management (SIEM) software. SIEMs are security solutions that help organizations and security teams analyze “log"log data in real-time for swift detection of security incidents.”"<ref>Marturano, G. (2020b, December 4). Detective Security Controls. Retrieved December 1, 2021, from https://lifars.com/2020/12/detective-security-controls/</ref> SIEMS are not the only examples of detective controls. There are also Physical security controls, Intrusion detection systems, and anti-virus/anti-malware tools, which all have different functions centered around the exact purpose of detecting security compromises within an IT infrastructure.

;Corrective controls

Line 43:

==Security and privacy==

Any service without a "hardened" environment is considered a "soft" target. Virtual servers should be protected just like a physical server against [[Data leakage prevention|data leakage]], [[malware]], and exploited vulnerabilities. "Data loss or leakage represents 24.6% and cloud related malware 3.4% of threats causing cloud outages”outages".<ref name=JA_1>{{cite journal| title=Limitations and challenges on Security Cloud Testing| author1=Ahmad Dahari Bin Jarno| author2=Shahrin Bin Baharom| author3=Maryam Shahpasand| url=https://www.apu.edu.my/ejournals/jati/journal/JATI-VOLUME_1-ISSUE_2-2017.pdf| journal=Journal of Applied Technology and Innovation| volume=1| issue=2| pages=89–90| date=2017}}</ref>

===Identity management ===

Every enterprise will have its own [[identity management system]] to control access to information and computing resources. Cloud providers either integrate the customer's identity management system into their own infrastructure, using [[Federated identity management|federation]] or [[Single sign-on|SSO]] technology or a biometric-based identification system,<ref name="cloudid"/> or provide an identity management system of their own.<ref name=DR_1>{{cite web| title=Identity Management In The Cloud| author=Chickowski, E.| url=https://www.darkreading.com/cybersecurity-analytics/identity-management-in-the-cloud| publisher=Informa PLC| date=25 October 2013| access-date=6 December 2013}}</ref> CloudID,<ref name="cloudid"/> for instance, provides privacy-preserving cloud-based and cross-enterprise biometric identification. It links the confidential information of the users to their biometrics and stores it in an encrypted fashion. Making use of a searchable encryption technique, biometric identification is performed in the encrypted ___domain to make sure that the cloud provider or potential attackers do not gain access to any sensitive data or even the contents of the individual queries.<ref name="cloudid"/>

Line 57:

Providers ensure that all critical data (credit card numbers, for example) are [[data masking|masked]] or encrypted and that only authorized users have access to data in its entirety. Moreover, digital identities and credentials must be protected as should any data that the provider collects or produces about customer activity in the cloud.

=== Penetration testing ===

[[Penetration test]]ing is the process of performing offensive security tests on a system, service, or [[computer network]] to find security weaknesses in it. Since the cloud is a shared environment with other customers or tenants, following penetration testing rules of engagement step-by-step is a mandatory requirement. Scanning and penetration testing from inside or outside the cloud should be authorized by the cloud provider. Violation of acceptable use policies can lead to termination of the service.<ref>{{cite book |doi=10.1145/3026724.3026728 |chapter=Penetration Testing on Virtual Environments |title=Proceedings of the 4th International Conference on Information and Network Security - ICINS '16 |year=2016 |last1=Guarda |first1=Teresa |last2=Orozco |first2=Walter |last3=Augusto |first3=Maria Fernanda |last4=Morillo |first4=Giovanna |last5=Navarrete |first5=Silvia Arévalo |last6=Pinto |first6=Filipe Mota |pages=9–12 |isbn=978-1-4503-4796-9 |s2cid=14414621 }}</ref>

=== Cloud vulnerability and penetration testing ===

Scanning the cloud from outside and inside using free or commercial products is crucial because without a hardened environment your service is considered a soft target. Virtual servers should be hardened just like a physical server against [[Data leakage prevention|data leakage]], malware, and exploited vulnerabilities. "Data loss or leakage represents 24.6% and cloud-related malware 3.4% of threats causing cloud outages”outages"

Scanning and penetration testing from inside or outside the cloud must be authorized by the cloud provider. Since the cloud is a shared environment with other customers or tenants, following penetration testing rules of engagement step-by-step is a mandatory requirement. Violation of acceptable use policies can lead to the termination of the service. Some key terminology to grasp when discussing penetration testing is the difference between application and network layer testing. Understanding what is asked of you as the tester is sometimes the most important step in the process. The network-layer testing refers to testing that includes internal/external connections as well as the interconnected systems throughout the local network. Oftentimes, social engineering attacks are carried out, as the most vulnerable link in security is often the employee.

Line 67:

'''White-box testing'''

Testing under the condition that the “attacker”"attacker" has full knowledge of the internal network, its design, and implementation.

'''Grey-box testing'''

Testing under the condition that the “attacker”"attacker" has partial knowledge of the internal network, its design, and implementation.

'''Black-box testing'''

Testing under the condition that the “attacker”"attacker" has no prior knowledge of the internal network, its design, and implementation.

== Data security ==

There are numerous security threats associated with cloud data services. This includes traditional threats and non-traditional threats. Traditional threats include: [[network eavesdropping]], illegal invasion, and denial of service attacks, but also specific cloud computing threats, such as side channel attacks, virtualization vulnerabilities, and abuse of cloud services. In order to mitigate these threats security controls often rely on monitoring the three areas of the CIA triad. The CIA Triad refers to confidentiality (including access controllability which can be further understood from the following.<ref>{{cite journal |last1=Tang |first1=Jun |last2=Cui |first2=Yong |last3=Li |first3=Qi |last4=Ren |first4=Kui |last5=Liu |first5=Jiangchuan |last6=Buyya |first6=Rajkumar |date=28 July 2016 |title=Ensuring Security and Privacy Preservation for Cloud Data Services |journal=ACM Computing Surveys |volume=49 |issue=1 |pages=1–39 |doi=10.1145/2906153 |s2cid=11126705}}</ref>), integrity and availability.

It is important to note that manyMany effective security measures cover several or all of the three categories. Encryption for example can be used to prevent unauthorized access, and also ensure integrity of the data). Backups on the other hand generally cover integrity and availability and firewalls only cover confidentiality and access controllability.<ref>{{cite web|date=2018-08-04|title=Confidentiality, Integrity and Availability - The CIA Triad|url=https://www.certmike.com/confidentiality-integrity-and-availability-the-cia-triad/|access-date=2021-11-27|website=CertMike|language=en-US}}</ref>

=== Confidentiality ===

Data confidentiality is the property in that data contents are not made available or disclosed to illegal users. Outsourced data is stored in a cloud and out of the owners' direct control. Only authorized users can access the sensitive data while others, including CSPs, should not gain any information about the data. Meanwhile, data owners expect to fully utilize cloud data services, e.g., data search, data computation, and [[data sharing]], without the leakage of the data contents to CSPs or other adversaries. Confidentiality refers to how data must be kept strictly confidential to the owner of said data

An example of security control that covers confidentiality is encryption so that only authorized users can access the data. Symmetric or asymmetric key paradigm can be used for encryption.<ref>{{Citecite journal |last1=Tabrizchi |first1=Hamed |last2=Kuchaki Rafsanjani |first2=Marjan |date=2020-12-01 |title=A survey on security challenges in cloud computing: issues, threats, and solutions |url=https://doi.org/10.1007/s11227-020-03213-1 |journal=The Journal of Supercomputing |languagedate=enDecember 2020 |volume=76 |issue=12 |pages=9493–9532 |doi=10.1007/s11227-020-03213-1 |s2cid=255070071 |issnurl=1573-0484http://elartu.tntu.edu.ua/handle/lib/39663 }}</ref>

=== Access controllability ===

Line 104:

=== Unauthorized Access to Management interface ===

Due to the autonomous nature of the cloud, consumers are often given management interfaces to monitor their databases. By having controls in such a congregated ___location and by having the interface be easily accessible for convenience for users, there is a possibility that a single actor could gain access to the cloud's management interface; giving them a great deal of control and power over the database.<ref name="Grobauer Walloschek & Stocker 2011">{{cite journal |last1=Grobauer |first1=Bernd |last2=Walloschek |first2=Tobias |last3=Stocker |first3=Elmar |title=Understanding Cloud Computing Vulnerabilities |journal=IEEE Security & Privacy |date=March 2011 |volume=9 |issue=2 |pages=50–57 |doi=10.1109/MSP.2010.115 |s2cid=1156866 }}</ref>

=== Data Recovery Vulnerabilities ===

Line 121:

There are several different types of attacks on cloud computing, one that is still very much untapped is infrastructure compromise. Though not completely known it is listed as the attack with the highest amount of payoff.<ref>{{cite book |doi=10.1145/2484313.2484357 |chapter=Towards preventing QR code based attacks on android phone using security warnings |title=Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security - ASIA CCS '13 |year=2013 |last1=Yao |first1=Huiping |last2=Shin |first2=Dongwan |page=341 |isbn=9781450317672 |s2cid=1851039 }}</ref> What makes this so dangerous is that the person carrying out the attack is able to gain a level of privilege of having essentially root access to the machine. It is very hard to defend against attacks like these because they are so unpredictable and unknown, attacks of this type are also called [[zero day exploits]] because they are difficult to defend against since the vulnerabilities were previously unknown and unchecked until the attack has already occurred.

[[Denial-of-service attack|DoS]] attacks aim to have systems be unavailable to their users. Since cloud computing software is used by large numbers of people, resolving these attacks is increasingly difficult. Now with cloud computing on the rise, this has left new opportunities for attacks because of the virtualization of data centers and cloud services being utilized more.<ref>{{cite journal |last1=Iqbal |first1=Salman |last2=Mat Kiah |first2=Miss Laiha |last3=Dhaghighi |first3=Babak |last4=Hussain |first4=Muzammil |last5=Khan |first5=Suleman |last6=Khan |first6=Muhammad Khurram |last7=Raymond Choo |first7=Kim-Kwang |title=On cloud security attacks: A taxonomy and intrusion detection and prevention as a service |journal=Journal of Network and Computer Applications |date=October 2016 |volume=74 |pages=98–120 |doi=10.1016/j.jnca.2016.08.016 |s2cid=9060910 }}</ref>

With the global pandemic that started early in 2020 taking effect, there was a massive shift to remote work, because of this companies became more reliant on the cloud. This massive shift has not gone unnoticed, especially by cybercriminals and bad actors, many of which saw the opportunity to attack the cloud because of this new remote work environment. Companies have to constantly remind their employees to keep constant vigilance especially remotely. Constantly keeping up to date with the latest security measures and policies, mishaps in communication are some of the things that these cybercriminals are looking for and will prey upon.

Moving work to the household was critical for workers to be able to continue, but as the move to remote work happened, several security issues arose quickly. The need for data privacy, using applications, personal devices, and the internet all came to the forefront. The pandemic has had large amounts of data being generated especially in the healthcare sector. Big data is accrued for the healthcare sector now more than ever due to the growing coronavirus pandemic. The cloud has to be able to organize and share the data with its users securely. Quality of data looks for four things: accuracy, redundancy, completeness and consistency.<ref>{{cite journal |last1=Alashhab |first1=Ziyad R. |last2=Anbar |first2=Mohammed |last3=Singh |first3=Manmeet Mahinderjit |last4=Leau |first4=Yu-Beng |last5=Al-Sai |first5=Zaher Ali |last6=Abu Alhayja’aAlhayja'a |first6=Sami |title=Impact of coronavirus pandemic crisis on technologies and cloud computing applications |journal=Journal of Electronic Science and Technology |date=March 2021 |volume=19 |issue=1 |pages=100059 |doi=10.1016/j.jnlest.2020.100059 |doi-access=free |pmc=7664361 }}</ref>

Users had to think about the fact that massive amounts of data are being shared globally. Different countries have certain laws and regulations that have to be adhered to. Differences in policy and jurisdiction give rise to the risk involved with the cloud. Workers are using their personal devices more now that they are working from home. Criminals see this increase as an opportunity to exploit people, software is developed to infect people's devices and gain access to their cloud. The current pandemic has put people in a situation where they are incredibly vulnerable and susceptible to attacks. The change to remote work was so sudden that many companies simply were unprepared to deal with the tasks and subsequent workload they have found themselves deeply entrenched in. Tighter security measures have to be put in place to ease that newfound tension within organizations.

Line 131:

The attacks that can be made on cloud computing systems include [[Man-in-the-middle attack|man-in-the middle]] attacks, [[phishing]] attacks, authentication attacks, and malware attacks. One of the largest threats is considered to be malware attacks, such as [[Trojan horse (computing)|Trojan horses]].

Recent research conducted in 2022 has revealed that the Trojan horse injection method is a serious problem with harmful impacts on cloud computing systems. A Trojan attack on cloud systems tries to insert an application or service into the system that can impact the cloud services by changing or stopping the functionalities. When the cloud system identifies the attacks as legitimate, the service or application is performed which can damage and infect the cloud system.<ref>{{Citecite journal |lastlast1=Kanaker |firstfirst1=Hasan |last2=Abdel Karim |first2=Nader Abdel |last3=A.B. Awwad |first3=Samer |last4=H.A. B. |last4=Ismail |first4=Nurul H. A. |last5=Zraqou |first5=Jamal |last6=Ali |first6=Abdulla M. F. Al ali |datefirst6=2022-12-20Abdulla |title=Trojan Horse Infection Detection in Cloud Based Environment Using Machine Learning |url=https://online-journals.org/index.php/i-jim/article/view/35763 |journal=International Journal of Interactive Mobile Technologies (iJIM) |languagedate=en20 December 2022 |volume=16 |issue=24 |pages=81–106 |doi=10.3991/ijim.v16i24.35763 |issn=1865-7923|doi-access=free }}</ref>

==Encryption==

Line 144:

==== Ciphertext-policy ABE (CP-ABE) ====

Ciphertext-policy ABE (CP-ABE) is a type of public-key encryption. In the CP-ABE, the encryptor controls the access strategy. The main research work of CP-ABE is focused on the design of the access structure. A Ciphertext-policy attribute-based encryption scheme consists of four algorithms: Setup, Encrypt, KeyGen, and Decrypt.<ref name="Bethencourt2007">{{cite conference |last1=Bethencourt |first1=John |last2=Sahai |first2=Amit |last3=Waters |first3=Brent |title=2007 IEEE Symposium on Security and Privacy (SP '07) |chapter=Ciphertext-Policy Attribute-Based Encryption |conference=2007 IEEE Symposium on Security and Privacy (SP '07) |date=May 2007 |pages=321–334 |doi=10.1109/SP.2007.11 |isbn=978-0-7695-2848-9 |s2cid=6282684 |chapter-url=https://hal.archives-ouvertes.fr/hal-01788815/file/cp-abe.pdf }}</ref> The Setup algorithm takes security parameters and an attribute universe description as input and outputs public parameters and a master key. The encryption algorithm takes data as input. It then encrypts it to produce ciphertext that only a user that possesses a set of attributes that satisfies the access structure will decrypt the message. The KeyGen algorithm then takes the master key and the user's attributes to develop a private key. Finally, the Decrypt algorithm takes the public parameters, the ciphertext, the private key, and user attributes as input. With this information, the algorithm first checks if the users’users' attributes satisfy the access structure and then decrypts the ciphertext to return the data.

==== Key-policy ABE (KP-ABE) ====

Key-policy Attribute-Based Encryption, or KP-ABE, is an important type of [[Attribute-based encryption|Attribute-Based Encryption]]. KP-ABE allows senders to encrypt their messages under a set of attributes, much like any Attribute Based Encryption system. For each encryption, private user keys are then generated which contain decryption algorithms for deciphering the message and these private user keys grant users access to specific messages that they correspond to. In a KP-ABE system, [[ciphertext]]s, or the encrypted messages, are tagged by the creators with a set of attributes, while the user's private keys are issued that specify which type of ciphertexts the key can decrypt.<ref>{{cite journal |last1=Wang |first1=Changji |last2=Luo |first2=Jianfa |title=An Efficient Key-Policy Attribute-Based Encryption Scheme with Constant Ciphertext Length |journal=Mathematical Problems in Engineering |date=2013 |volume=2013 |pages=1–7 |doi=10.1155/2013/810969 |s2cid=55470802 |doi-access=free }}</ref> The private keys control which ciphertexts a user is able to decrypt.<ref>{{cite book |last1=Wang |first1=Chang-Ji |last2=Luo |first2=Jian-Fa |title=2012 Eighth International Conference on Computational Intelligence and Security |chapter=A Key-policy Attribute-based Encryption Scheme with Constant Size Ciphertext |date=November 2012 |pages=447–451 |doi=10.1109/CIS.2012.106 |isbn=978-1-4673-4725-9 |s2cid=1116590 }}</ref> In KP-ABE, the attribute sets are used to describe the encrypted texts and the private keys are associated to the specified policy that users will have for the decryption of the ciphertexts. A drawback to KP-ABE is that in KP-ABE the encryptor does not control who has access to the encrypted data, except through descriptive attributes, which creates a reliance on the key-issuer granting and denying access to users. Hence, the creation of other ABE systems such as Ciphertext-Policy Attribute-Based Encryption.<ref>{{cite conference |last1name=Bethencourt |first1=John |last2=Sahai |first2=Amit |last3=Waters |first3=Brent |title=2007 IEEE Symposium on Security and Privacy (SP '07) |chapter=Ciphertext-Policy Attribute-Based Encryption |conference=2007 IEEE Symposium on Security and Privacy (SP '07) |date=May 2007 |pages=321–334 |doi=10.1109/SP.2007.11 |isbn=978-0-7695-2848-9 |s2cid=6282684 |chapter-url=https://hal.archives-ouvertes.fr/hal-01788815/file/cp-abe.pdf"Bethencourt2007" }}</ref>

=== Fully homomorphic encryption (FHE) ===

Line 171:

;Unique compliance requirements

:In addition to the requirements to which customers are subject, the data centers used by cloud providers may also be subject to compliance requirements. Using a cloud service provider (CSP) can lead to additional security concerns around data jurisdiction since customer or tenant data may not remain on the same system, in the same data center, or even within the same provider's cloud.<ref name="Securing the Cloud Winkler">{{cite book |last1=Winkler |first1=Joachim R. |title=Securing the Cloud: Cloud Computer Security Techniques and Tactics |date=2011 |publisher=Elsevier |isbn=978-1-59749-592-9 |pages=65, 68, 72, 81, 218–219, 231, 240 }}</ref>

:The European Union’sUnion's [[General Data Protection Regulation|GDPR]] has introduced new compliance requirements for customer data.

==Legal and contractual issues==

[[File:Supply_and_demandSupply and demand-stacked5-law.png|thumb|325px|right|Cloud suppliers security and privacy agreements must be aligned to the demand(s) requirements and requlations]]

Aside from the security and compliance issues enumerated above, cloud providers and their customers will negotiate terms around liability (stipulating how incidents involving data loss or compromise will be resolved, for example), [[intellectual property]], and end-of-service (when data and applications are ultimately returned to the customer). In addition, there are considerations for acquiring data from the cloud that may be involved in litigation.<ref name="adams">{{cite book |last1=Adams |first1=Richard |chapter=The emergence of cloud storage and the need for a new digital forensic process model |pages=79–104 |chapter-url=https://researchrepository.murdoch.edu.au/id/eprint/19431/1/emergence_of_cloud_storage.pdf |editor1-last=Ruan |editor1-first=Keyun |title=Cybercrime and Cloud Forensics: Applications for Investigation Processes |date=2013 |publisher=Information Science Reference |isbn=978-1-4666-2662-1 }}</ref> These issues are discussed in [[service-level agreement]]s (SLA).

Line 190:

== Further reading ==

* {{cite journal |last1=Mowbray |first1=Miranda |title=The Fog over the Grimpen Mire: Cloud Computing and the Law |journal=SCRIPT-ed |date=15 April 2009 |volume=6 |issue=1 |pages=132–146 |doi=10.2966/scrip.060109.132 |doi-access=free }}

* {{cite book|title=Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance|first1=Tim|last1=Mather|first2=Subra|last2=Kumaraswamy|first3=Shahed|last3=Latif|publisher=O'Reilly Media, Inc.|year=2009|isbn=9780596802769}}

* {{cite book|title=Securing the Cloud: Cloud Computer Security Techniques and Tactics|first1=Vic|last1=Winkler|publisher=Elsevier|year=2011|isbn=9781597495929}}

* {{cite book|title=Securing the Virtual Environment: How to Defend the Enterprise Against Attack|first1=Davi|last1=Ottenheimer|publisher=Wiley|year=2012|isbn=9781118155486}}

* [http://www.iso.org/iso/catalogue_detail?csnumber=43757 BS ISO/IEC 27017]: "Information technology. Security techniques. Code of practice for information security controls based on ISO/IEC 27002 for cloud services." (2015)

* [http://www.iso.org/iso/catalogue_detail.htm?csnumber=61498 BS ISO/IEC 27018]: "Information technology. Security techniques. Code of practice for protection of [[personally identifiable information]] (PII) in public clouds acting as PII processors." (2014)

* [http://www.iso.org/iso/catalogue_detail.htm?csnumber=59689 BS ISO/IEC 27036-4]: "Information technology. Security techniques. Information security for supplier relationships. Guidelines for security of cloud services" (2016)