Privacy and Security In Cloud Computing

Abstract

Cloud Computing has achieved broad acceptance in the market and academia in a very short period of time, as evident from its broad deployment in the information technology industry. On the other hand, the service providers and clients of cloud have experienced concerns over security and privacy of the data and applications running in cloud architecture. Entirely new dimensions of security vulnerabilities, threats and attacks have been witnessed with adoption of cloud model, in contrary to traditional security systems. Clients may resultantly suffer through un bearable loss if undue importance is rendered towards the security and privacy issues in cloud model. Any organization that is migrating towards cloud, or already operating in cloud environment, needs to refer towards a complete security and management framework. Security audit of the system is an important aspect, so the organization should also look into certain challenges posed to network forensics in cloud environment. This thesis work initially evaluates cloud architecture and security vulnerabilities and threats posed to it. A security feasibility has been conducted and a comprehensive security and management framework has been proposed for a sensitive organization operative in the cloud architecture. The thesis includes implementation of the proposal for which virtualized environment was setup as proof of concept. The framework, a layered security / management model, covers all essential security and management aspects for a sensitive organization to function in cloud environment. The stakeholders of cloud architecture need to know their roles and responsibilities in the model. The proposed framework is a guideline for both the clients and the cloud service providers towards their roles in the cloud computing model. The proposed framework, to the end, is compared with the existing security guidelines recommended by well recognized standard bodies in the area of cloud computing including CSCC, ISO/IEC and PCI-DSS.