A Survey on Cloud Computing Security Issues, Vendor Evaluation and Selection Process: World Future Society

Int. J. Advanced Networking and Applications
Volume: 5 Issue: 6 Pages: 2129-2134 (2014) ISSN : 0975-0290
2129
A Survey on Cloud Computing Security
Issues, Vendor Evaluation and Selection
Process: World Future Society
Arun Sangwan
Department of Computer Science & Engineering, Deenbnadhu ChotuRam University of Science & Technology, Haryana, India.
er.arunsangwan12@gmail.com
Kavita Rathi
Department of Computer Science & Engineering, Deenbnadhu ChotuRam University of Science & Technology, Haryana, India.
kavita1217@gmail.com
----------------------------------------------------------------------ABSTRACT-----------------------------------------------------------
Cloud computing is an emerging technology which could replace long-established IT systems. Cloud computing
made big strides forward in 2013, and if a host of industry experts proves correct, it will make even bigger
advances in 2014. As Forbes, CxoToday, GigaOM, and other news services that cover technology report, the
experts forecast many more companies joining clouds or creating their own; new professional services emerging
to manage the clouds and the data within them; and the clouds’ expansion transforming IT and work life in
general trough out the world. Cloud computing makes it possible for an organizations’ IT to be more malleable,
save costs and process information and data faster than with long-established IT. Cloud computing is the
operating of programs and storage of data and files in an online network, not on physical disks and hardware’s.
Cloud computing arises from the IT technicians desire to add another layer of separation in processing
information. Cloud Vendor Evaluation & Selection offering leverages the database to accelerate the identification
and screening of candidate vendors in four-step vendor evaluation and selection process.
Keywords - Cloud Computing, Cloud vendors, cloud risk, SAAS, PAAS, and IAAS.
------------------------------------------------------------------------------------------------------------------------------------------------
1. INTRODUCTION
loud computing is not an revolution per se, but a
means to constructing IT services that use advanced
computational power and improved storage
capabilities. The main concern of cloud computing from
the provider's view as extraneous hardware connected to
support downtime on any device in the network, nothing
to change in the users' perspective [1]. Cloud computing
provides thus a combination of economic and
performance benefits. The economic benefit lies in the
costs that have to be made whenever an organization
needs additional IT services, and this relates to the
performance benefits. The cloud computing security
issues can in general be divided into seven different
categories according to Brodkin [9]. These risks are
from the customer's point of view [5]. The risks can be
divided into two areas; these areas are privacy related
risks and (data) security related risks. While cloud
computing presents several economic and business
benefits, in practice it also presents challenges that can
diminish those advantages. It’s easy for business
managers to acquire and deploy cloud services outside
the guidance of IT and the context of an enterprise
architecture. This increases the risk of cloud stretch,
resulting in an IT landscape littered with redundant and
isolated services. The visualized productivity gains can
be diminished by the often error-prone and lagging
manual integration of data with other business tools. At
some point, IT is brought in to address these issues
through automated integrations at increased complexity
and cost that further diminishes the envisioned benefits
[2].
Business owners are attracted to cloud computing
concept because of several features [3, 4].These are as
follows:
• Lower initial investment
• Easier to manage
• Scalability
• Deploy faster
• Location independent
• Device independent
• Reliability
• Security
2. BACKGROUND
Cloud computing is fairly new and has thus no long
history. In general it originates from the late nineties and
has been further developed in the next millennium, the
name was created because the data send couldn’t be
tracked anymore when moving towards it destination. The
term cloud was created because you could not determine
the path a certain data package followed. The term cloud
computing changed over time (Well 2009). In the early
years of cloud computing, the organization Amazon was
active in the area of cloud computing. They were already
a large organization investing in cloud computing. They
had huge data centers which normally only use about 8 to
12% of their computing power. The rest was reserved for
whenever peak usage was necessary. They started to use
C

2130
cloud computing in order to save costs in these huge
datacenters. After this they were the first to provide cloud
computing to the outside world (the customers). This
happened in the year of 2006 according to Computer
Weekly (2009)[5]. Not much later IBM and Google
showed interest into cloud computing and started to
invest. It seemed that cloud computing showed potential.
Cloud computing is stated into different definitions. There
are definitions that define a cloud as a some what updated
version of utility computing (Buyya et al 2009).[11] The
other, and broader, side states that anything you can
access outside your firewall is cloud computing, even
outsourcing (Knorr 2008).
In general there are three main components in cloud
computing, these are the servers, the datacentres and the
clients (Velte et al 2009). They all connect through the
internet with each other and can be seen as a network.
Fig 1: Cloud computing Architecture
3. CALSSIFICATION
Cloud computing is mainly classified in two ways [7]:
1. Location of the cloud computing
2. Type of services offered
1. Location of the cloud computing
1.1 Private Cloud.
The business implements its own server and storage
hardware but can shift workloads among servers as usage
spikes or it deploys new applications.
1.2 Public cloud
The business uses (via an online portal) a pre-constructed
platform for computing, storage, and other utilities.
Amazon Web services (AWS) is an immensely popular
public cloud platform best Buy and other e-commerce
companies implement it, and Netflix is building its entire
infrastructure on it.
1.3 Hybrid cloud.
The platform includes both private and public cloud
services. The business would run its app primarily on a
private cloud but rely on a public cloud under certain
conditions, such as when usage spear. AWS struck a
hybrid deal in 2011 with Eucalyptus, an open-source
cloud-building software program, by which Eucalyptus
might connect companies’ (Eucalyptus-supported)[16]
private clouds with AWS, so that the companies may be
move their data and programs to and from either platform.
Fig 2. Private, Public and hybrid cloud services.
2. Type of services offered
Based upon the services offered, clouds are defined in the
following ways:
2.1 Infrastructure as a service (IaaS)
IT involves offering hardware related services using the
principles of cloud computing. These could include some
type of storage services (database or disk storage) or
virtual servers. Root vendors that provide Infrastructure as
a service are Amazon EC2, Amazon S3, Rack space
Cloud Servers and Flexi scale.
2.2 Platform as a Service (PaaS)
It involves offering a development platform on the cloud.
Platforms provided by different vendors are mostly not
compatible. Typical players in PaaS are Google’s
Application Engine, Microsoft Azure, and
Salesforce.com’s force.com.
2.3 Software as a service (SaaS)
It includes a complete software offering on the cloud.
Users can run a software application hosted by the cloud
vendor on pay-per-access basis. This is a well-established
SaaS
SaaS
PaaSIaaS
PaaS
IaaS
Hybrid
Map services
ArcGS online Services
ArcGS mobile ArcGS Server ArcGS Explore ArcGS desktop ArcGS Map
Private cloud
On-Premises/Internal
Public cloud
Off-Premises/External
Internet
Distributed server
Data center
Client computers

2131
sector. The pioneer in this field has been Salesforce.com’s
offering in the online Customer Relationship Management
(CRM) space. Other examples are online email providers
like Google’s Gmail and Microsoft Hotmail, Google docs
and Microsoft online version of office called BPOS
(Business Productivity Online Standard Suite).
4.POPULAR METHODOLOGY
Cloud computing mainly has characteristics of all these
technologies [6]:
1. Grid computing
2. Virtualization
3. Utility Computing
A quick overview of these technologies is given here.
1. Grid Computing
Grid Computing involves a network of computers that are
utilized together to gain large supercomputing type
computing resources. Using this network of computers at
very large and complex computing operations can be
implemented. In grid computing these network of
computers may be present in different area. A famous
Grid Computing project is Folding@Home.
2. Virtualization
Virtualization introduces a layer between Hardware and
operating system. During the sixties mainframe started
supporting many users using virtual machines. These
virtual machines imitate behaviour of an operating system
for each user. VMWare introduced a product called
VMware Workstation in 1999 that allows multiple
operating systems to run on personal computers.
Typically server utilization in data centres can be as low
as ten percent. Virtualization can help in incredibly
improving server utilization.
3. Utility Computing
Utility Computing defines a "pay-per-use" model for
using computing utilities. In utility computing, billing
model of computing resources is similar to how utilities
like electricity are long-established billed. When we
procure electricity from a vendor, the starting cost
required is minimal. Target upon the usage of electricity,
electricity companies bills the customer (typically
monthly). In utility computing billing is made using a
similar protocol.
5. IDENTIFYING CLOUD COMPUTING RISKS
The risks can be divided into two areas; these areas are
privacy related risks and (data) security related risks.
1. Privacy and classified risk
The users and clients of cloud computing are dependent
on their cloud provider when it comes to their privacy or
classified. The provider of the cloud computing services
determines what policies are held. Imagine that these
providers also have the ability to make changes in their
policies. It could completely change the privacy for
clients. (For example when the data inserted by the cloud
users is protected in the preliminary made up policy being
used). Changing policies which will allow insight in this
data for third parties could be a serious risk depending on
the importance of data that is being used (Gellman 2009).
2. Security risks
There are several risks to be found in this area, but we
will only discuss the most relevant and important ones.
2.1 Attacks
The web in general is haunted by attacks on XML
signatures. XML is a web based language and as cloud
computing could also be web based, they are exposed to
this problem. These forms of hack are usually used to
obtain data without having the rights to access them.
2.2 Non attack risks
First there is the Lock in effect. This means that, in this
scenario, an organization cannot move its IT around to
different service providers (Arthur, 1989)[8]. Cloud
computing is fairly new so there are not yet many
standardized formats. Also a cloud provider could try to
make it difficult for a client to move away to another
source. This means that the client will be “locked in” to
that particular provider.
6. VENDOR EVALUATION AND SELECTION
PROCESS
The cloud computing vendor pool and product
capabilities are constantly evolving [2].
• How do you ensure your evaluation of cloud products
was based on an up-to-date view of the market?
• How do you distinguish marketing hype from real
capabilities?
• How do you wade through dozens of competing
products to hone in on their key differentiators within a
reasonable timeframe?
1. Cloud Vendor Evaluation & Selection
Cloud Vendor Evaluation & Selection offering leverages
the database to accelerate the identification and screening
of candidate vendors in our four-step vendor evaluation
and selection process:
1.1 Prepare:
Capture and prioritize the evaluation criteria, including
functional, non-functional, implement ability,
supportability and cost requirements.

2132
1.2 Narrow:
Identify a candidate list of vendors. Screen out obvious
mismatches with evaluation criteria. Optionally perform
an RFI and further screen the candidate vendor list to a
manageable list of 2-5 for more detailed evaluation.
1.3 Evaluate:
Analyse and score each vendor solution’s ability to meet
each evaluation criterion individually. Optionally perform
a bake-off to further vet a solution’s fit as necessary.
1.4 Select:
Based on the priority-weighted score of each solution’s fit
and anecdotal analysis notes, select the desired solution.
Optionally perform a proof-of-concept to validate the
selection.
2. Benefits include:
• Provides detailed traceability and due diligence that
clearly and confidently justifies your conclusions
• Leverages a scientific approach that separates
evaluation criteria priorities from evaluation scoring
reducing evaluation bias and facilitating what-if
analysis by adjusting priorities after the completed
evaluation
• Perficient’s cloud computing vendor database
accelerates solution identification and evaluation
while ensuring the evaluation is based on the most
up-to-date market information and Perficient insight
3. Cloud computing providers:
Some of the top cloud computing providers:
• Google
• IBM
• AMAZON web services
• SALESFORCE
• MICROSOFT
• VMware
• HP
Fig 3. Graph shows which vendor is best suited for
cloud computing needs
4. Cloud storage vendors:
Two main cloud storage vendors are as follows:
1. Google App
With the online creation and sharing features, Google app
has become a major player in the cloud services market
for customer and business. Google unveiled its cloud
storage services earlier this year as part of its Google App
business offering. For $50 per user per month, business
get all the features of Google apps, including 25 GB of
cloud storage per employee. [23]
2. Amazon simple storage services
Amazon s3 from amazon web services offers potentially
unlimited cloud storage that also connect with various
client and appliances from other vendors. Pricing based
on amount of data stored and data transfer bandwidth
used. The purpose is to provide cloud storage services at
commodity prices [20].
7. CLOUD COMPUTING SECURITY ISSUES
Seven issues that need to be addressed before enterprises
consider switching to the cloud computing model is
identified by Gartner.[14] They are as follows:
1. Privileged user access
Information transmitted from the client through the
Internet poses a certain degree of risk, because of issues
of data ownership; enterprises should spend time getting
to know their providers and their regulations as much as
possible before assigning some trivial applications first to
test the water
2. Regulatory compliance
0%
2%
4%
6%
8%
10%
12%
14%
16%
18%
20%
Microsoft
Amazon
IBM
Google
Salesforce.com
Vmware
HP
Oracle/Sun
Citrix
EMC
others

2133
Clients are accountable for the security of their solution,
as they can choose between providers that allow to be
audited by 3rd party organizations that check levels of
security and providers that don’t.
3. Data location
Depending on contracts, some clients might never know
what country or what jurisdiction their data is located.
4. Data segregation
Encrypted information from multiple companies may be
stored on the same hard disk, so a mechanism to separate
data should be deployed by the provider.
5. Recovery
Every provider should have a disaster recovery protocol
to protect user data.
6. Investigative support
If a client suspects faulty activity from the provider, it
may not have many legal ways pursue an investigation
7. Long-term viability
refers to the ability to retract a contract and all data if the
current provider is bought out by another firm Given that
not all of the above need to be improved depending on the
application at hand, it is still paramount hat consensus is
reached on the issues regarding standardization.
8. CONCLUSIONS
Cloud security issues and the risks of cloud computing are
not well understood today and are one of the biggest
barriers to adoption of these services. This section helps
CIOs and IT managers assess the security risks of cloud
computing with the latest information on cloud security
standards; how to manage data security in the cloud, data
privacy in the cloud and the regulatory and compliance
implications of moving to a cloud model. This topic also
covers auditing cloud computing service providers and
cloud computing risk management. More about Security.
We found that IT organizations using cloud computing
will be able to perform better, faster, more flexible and
have lower costs compared to traditional IT. Cost
calculations made in the interview chapters indeed
showed financial benefits. Actual flexibility and higher
performance were not measured with these interviews.
From the literature we can say, that flexibility and
performance increase compared with traditional IT. This
is because cloud computing allocates services to where it
is needed, so whenever a client request more processing
power, the cloud assigns this to him.
Cloud applications allow companies to eliminate the need
to install, run and maintain an application in house by
outsourcing it to an application provider in the cloud. The
most well-known of these providers today is
Salesforce.com which sells CRM software as a service.
The use of cloud computing is growing as for example
Rackspace has shown. The human mind has no physical
limits. Imagination and creativity run as far as a person
wills them to go. Computer software can doubtless go
toward far greater use of it, too, frees itself from space
and time. Therein lies the promise of cloud computing:
Computational power that is infinitely vast and
ubiquitous. Forward-thinking organizations and
businesses have begun exploring cloud computing in
earnest, and many more appear poised to join them in the
year ahead. They and we can hope for great things to
follow.
REFERENCES
[1] Armbrust, M., Fox, A., Griffith, R., Joseph, A., Katz,
R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A.,
Stoica, A., and Zaharia, M. Above the clouds: A
berkeley view of cloud computing. UC Berkeley
Reliable Adaptive distributed systems Laboratory.
Technical Report No. UCB/EECS-2009-28.
[2] Cloud computing vendor pool and product
capabilities are from
https://www.perficient.com/Solutions-and-
Services/Cloud-Services /Cloud-Architecture-
Services.
[3] Cloud computing features
http://www.thesmallbusines s.org/software/benefits-
of-cloud computing.
[4] cloud computing features
http://www.allthingscrm.com
/cloudComputing/understanding -cloudcomputing-
applications.html
[5] Mohiuddin Ahmed1, Abu Sina Md. Raju
Chowdhury2, Mustaq Ahmed3, Md. Mahmudul
Hasan Rafee4 an Advanced Survey on Cloud
Computing and State-of-the-art, Research Issues.
IJCSI International Journal of Computer Science
Issues, Vol. 9, Issue 1, No 1, January 2012 ISSN
(Online): 1694-0814 [9]
[6] Cloud computing technologies http://thecloudtutorial
.com/related.html
[7] Cloud computing classification
http://thecloudtutorial .com/cloudtypes.html
[8] Brian Arthur, W., (1989) Competing Technologies,
Increasing Returns, and Lock-In by Historical Events.
The Economic Journal. 116-131.
[9] Brodkin, J. (2008) Gartner: Seven cloud-computing
securityrisks.Networkworld.Availableat:
http://folk.ntnu.no/oztarman/tdt60/cloud%20computi
ng/3%20Cloud_Computing_Security_Risk.pdf[Visite
d 06-04-2011]
[10] H.J. Braun, T. D.and Siegel, N. Beck, L.L. Blni, M.
Maheswaran, A.I.Reuther, J.P. Robertson, M.D.
Theys, and B. Yao, 2001 “A comparison of eleven
static heuristics for mapping a class of independent
tasks onto heterogeneous distributed computing
systems,” Journal of Parallel and Distributed
Computing, vol. 61, no. 6.
[11]Buyva, R., Murshed, M. GridSim: A Toolkit for the

2134
Modeling and Simulation of Distributed Resource
Management and Scheduling for Grid Computing.
Concurrency and computation: Practice and
experience. 14(13-15)1175-1220 (2003).
[12]Buyya, Cloud computing and emerging IT platforms:
Vision, hype, and reality for delivering computing as
the 5th utility. Future Generation Computer Systems.
25(6) 599-616 (2009).
[13]R. Kakerow, “Low power design methodologies for
mobile communication,” in Proceedings of IEEE
International Conference on Computer Design: VLSI
in Computers and Processors, pp. 8, January 2003.
[14] Seven issues of cloud computing Gartner(2008)
http://www.cse.wustl.edu/~jain/cse571-9/ftp/cloud/
[15] J. W. Davis, “Power benchmark strategy for systems
employing power management,” in Proceedings of
the IEEE International Symposium on Electronics
and the Environment, pp. 117, August 2002.
[16]Eucalyptus, 2008, http://eucalyptus.cs.ucsb.edu/
[17]A.Rudenko, P. Reiher, G. J. Popek, and G. H.
Kuenning, “Saving portable computer battery power
through remote process execution,” Journal of ACM
SIGMOBILE on Mobile Computing and
Communications Review, vol. 2, no. 1, January 1998.
[18]E. Cuervo, A. Balasubramanian, Dae-ki Cho, A.
Wolman, S. Saroiu, R. Chandra, and P. Bahl, “MAUI:
Making Smartphones Last Longer with Code
ofﬂoad,” in Proceedings of the 8th International
Conference on Mobile systems, applications, and
services, pp. 49-62, June 2010.
[19]A.Garcia and H. Kalva, “Cloud transcoding for
mobile video content delivery,” in Proceedings of the
IEEE International Conference on Consumer
Electronics (ICCE), pp. 379, March 2011.
[20] Amazon Simple Storage Service (Amazon S3),
http://aws.amazon.com/s3, 2008.
[21] Private, Public and hybrid cloud services
architecture from http://www.giscloud.com/
[22] Google cloud storage vendor from , “Google app
Engine,” http://code.google.com/appengine/.
[23] Salesforce, “CRM”,http://www.salesforce.com/.

A Survey on Cloud Computing Security Issues, Vendor Evaluation and Selection Process: World Future Society

More Related Content

What's hot (19)

Similar to A Survey on Cloud Computing Security Issues, Vendor Evaluation and Selection Process: World Future Society (20)

More from Eswar Publications (20)

Recently uploaded (20)

A Survey on Cloud Computing Security Issues, Vendor Evaluation and Selection Process: World Future Society