Cloud computing security

Short description: Methods used to protect cloud-based assets

For cloud-hosted security software, see Security as a service.

This article is part of a series on

Computer hacking
History

* Phreaking
* Cryptovirology
* Hacking of consumer electronics
* List of hackers

Hacker culture & ethic

* Hacker Manifesto
* Black hat
* Grey hat
* White hat
* Hackerspace
* Hackathon
* Hacktivism
* Maker culture

Conferences

* Black Hat Briefings
* Chaos Communication Congress
* DEF CON
* Hackers on Planet Earth

Computer crime

* Crimeware
* List of computer criminals
* Script kiddie

Hacking tools

* Forensics OS
* Vulnerability
* Exploit
* Payload
* Social engineering

Practice sites

* HackThisSite
* Zone-H

Malware

* Rootkit
* Backdoor
* Trojan horse
* Virus
* Worm
* Spyware
* Ransomware
* Logic bomb
* Botnet
* Keystroke logging
* HIDS
* Web shell

Computer security

* Application security
* Network security

Groups

* Anonymous
* Chaos Computer Club
* Homebrew Computer Club (defunct)
* Legion of Doom (defunct)
* Masters of Deception (defunct)
* Red and Blue Teams

Publications

* 2600: The Hacker Quarterly
* Hacker News
* Nuts and Volts
* Phrack

* v
* t
* e

Cloud computing security or cloud security refers to a broad set of policies, technologies, applications, and controls used to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security and, more broadly, information security.

## Contents

* 1 Security issues associated with the cloud
* 2 Cloud security controls
* 3 Dimensions of cloud security
* 4 Security and privacy
* 4.1 Identity management
* 4.2 Physical security
* 4.3 Personnel security
* 4.4 Privacy
* 4.5 Penetration testing
* 4.6 Cloud vulnerability and penetration testing
* 4.7 Legal issues
* 4.8 Unauthorized Access to Management Interface
* 4.9 Data Recovery Vulnerabilities
* 4.10 Internet Vulnerabilities
* 4.11 Encryption Vulnerabilities
* 5 Misconfiguration Risks
* 6 Encryption
* 6.1 Attribute-based encryption (ABE)
* 6.1.1 Ciphertext-policy ABE (CP-ABE)
* 6.1.2 Key-policy ABE (KP-ABE)
* 6.2 Fully Homomorphic Encryption (FHE)
* 6.3 Searchable Encryption (SE)
* 7 Data Lifecycle Security - Data Security
* 8 Compliance
* 9 Legal and contractual issues
* 9.1 Public records
* 10 See also
* 11 References
* 12 Further reading
* 13 External links
* 13.1 Archive

## Security issues associated with the cloud

Cloud computing and storage provide users with the capability to store and process their data in third-party data centers.[1] Organizations use the cloud in a variety of service models (e.g., SaaS, PaaS, IaaS) and deployment models (private, public, hybrid, and community).[2]

Security concerns associated with cloud computing are typically divided into issues faced by cloud providers and those faced by their customers.[3] The responsibility is shared and is often described in a vendor's "shared responsibility model".[4][5][6] The provider must secure its infrastructure, while customers must secure their applications, identities, and configuration settings.[5][6]

Analyses of large-scale cloud incidents indicate that many breaches result from misconfigurations and long-unremediated exposures rather than solely from zero-day vulnerabilities.[citation needed]

When an organization stores data or hosts applications on the public cloud, it loses physical access to the hardware. As a result, potentially sensitive data may be at risk from insider attacks. According to a 2010 Cloud Security Alliance report, insider attacks rank among the top threats in cloud computing.[7] Cloud service providers must ensure that thorough background checks are conducted for employees with physical access to data centers.

To conserve resources and reduce cost, cloud providers often store multiple customers' data on the same server. As a result, one user's private data might be viewable by another without proper isolation.[2] Providers implement data isolation and logical segregation to mitigate these risks.

The extensive use of virtualization in cloud infrastructure brings unique security concerns.[8] Virtualization introduces an additional layer—the hypervisor—that must be secured and correctly configured.[9] A compromise of the hypervisor management system can impact an entire data center.[10]

## Cloud security controls

Cloud security architecture is effective only if the correct defensive implementations are in place. An efficient cloud security architecture should recognize the issues that will arise with security management and follow all the best practices, procedures, and guidelines to ensure a secure cloud environment. Security management addresses these issues with security controls. These controls protect cloud environments and are put in place to safeguard any weaknesses in the system and reduce the effect of an attack.

Deterrent controls
Administrative mechanisms intended to reduce attacks by informing attackers of consequences.[11]

Preventive controls
Controls designed to reduce vulnerabilities and prevent unauthorized access.[12]

Detective controls
Controls that detect and respond to security events. Includes monitoring, SIEM, IDS/IPS, malware detection.[13]

Corrective controls
Controls that reduce the impact of an incident and restore systems.[14]

## Dimensions of cloud security

Cloud security engineering is characterized by the security layers, plan, design, programming, and best practices that exist inside a cloud security arrangement. Cloud security engineering requires the composed and visual model (design and UI) to be characterized by the tasks inside the Cloud. This cloud security engineering process includes such things as access to the executives, techniques, and controls to ensure applications and information. It also includes ways to deal with and keep up with permeability, consistency, danger stance, and by and large security. Processes for imparting security standards into cloud administrations and activities assume an approach that fulfills consistent guidelines and essential foundation security parts.[15]

Though the idea of cloud computing is not new, organizations are increasingly adopting it because of its flexible scalability, relative trustability, and cost-effectiveness of services. However, despite its rapid adoption in some sectors and disciplines, research and statistics indicate that security-related pitfalls remain a major barrier to its full adoption.Cite error: Invalid `<ref>` tag; refs with no name must have content

It is generally recommended that information security controls be selected and implemented in proportion to the risks, typically by assessing the threats, vulnerabilities and impacts. Cloud security concerns can be grouped in various ways; Gartner identified seven, while the Cloud Security Alliance identified twelve areas of concern.[16][17] Cloud access security brokers (CASBs) are software that sits between cloud users and cloud applications to provide visibility into cloud application usage, data protection and governance to monitor all activity and enforce security policies.[18]

## Security and privacy

Any service without a "hardened" environment is considered a "soft" target. Virtual servers should be protected just like a physical server against data leakage, malware, and exploited vulnerabilities. "Data loss or leakage represents 24.6 % and cloud-related malware 3.4 % of threats causing cloud outages".[19]

### Identity management

Every enterprise will have its own identity management system to control access to information and computing resources. Cloud providers either integrate the customer's identity management system into their own infrastructure, using federation or SSO technology or a biometric-based identification system,[1] or provide an identity management system of their own.

### Physical security

Cloud service providers physically secure the IT hardware (servers, routers, cables etc.) against unauthorized access, interference, theft, fire, flood etc., and ensure that essential supplies (such as electricity) are sufficiently robust to minimise the possibility of disruption.

### Personnel security

Various information security concerns relating to personnel involved in cloud services are typically handled through screening, security-awareness training, and role-based access controls.

### Privacy

Providers ensure that all critical data (credit-card numbers, for example) are masked or encrypted and that only authorised users have access to data in its entirety. Moreover, digital identities and credentials must be protected as must any data that the provider collects or produces about customer activity in the cloud.

### Penetration testing

Penetration testing is the process of performing offensive security tests on a system, service, or computer network to find security weaknesses in it. Since the cloud is a shared environment with other customers or tenants, following penetration-testing rules of engagement step-by-step is a mandatory requirement. Scanning and penetration-testing from inside or outside the cloud should be authorised by the cloud provider.[20]

### Cloud vulnerability and penetration testing

Scanning the cloud from outside and inside using free or commercial tools is crucial. Without a hardened environment, your service is considered a soft target. Virtual servers should be hardened just like a physical server against data leakage, malware, and exploited vulnerabilities. "Data loss or leakage represents 24.6 % and cloud-related malware 3.4 % of threats causing cloud outages".

### Legal issues

Privacy legislation often varies by country. By having information stored via the cloud it is difficult to determine under which jurisdiction the data falls. Trans-border clouds are popular given that the largest companies transcend several countries. Legal dilemmas from the ambiguity of the cloud refer to how there is a difference in data-sharing law between and inside organisations.[21]

### Unauthorized Access to Management Interface

Due to the autonomous nature of the cloud, consumers are often given management interfaces to monitor their databases. By having controls in one central location and by having the interface be easily accessible for user convenience, there is a possibility that a single actor could gain access to the cloud's management interface; giving them control over much of the system.[22]

### Data Recovery Vulnerabilities

The cloud's use of resource pooling means memory or storage resources may be recycled to another user. It is possible for current users to access information left by previous ones.[22]

### Internet Vulnerabilities

Cloud services require internet connectivity and use internet protocols, making them subject to attacks such as man-in-the-middle attacks. Furthermore, heavy reliance on internet connectivity means service disruptions or outages can cut off users entirely.[22]

### Encryption Vulnerabilities

As encryption algorithms age, vulnerabilities arise. Cloud providers must stay current with encryption standards and transition older systems before they become compromised.[23]

## Misconfiguration Risks

Cloud environments are extremely vulnerable, particularly when it comes to hackers and attackers, due to cloud misconfigurations, which are one of the most prevalent and dangerous security flaws. Cloud platforms are complicated; even a minor configuration error, like excessively permissive access or inappropriate storage, can provide attackers with entry points. Cloud breaches are frequently caused by misconfigurations because attackers can obtain unauthorized access by taking advantage of incorrectly configured settings. [24]

Security misconfigurations occur when security settings are not fully implemented or are set up incorrectly. Weak passwords, misconfigured databases, unprotected cloud storage, incorrectly configured firewalls or network settings, and out-of-date software or firmware are just a few of the many possible causes. These errors frequently result from system design flaws, human error, or gaps in knowledge regarding security procedures. As the article Security Misconfiguration Vulnerabilities: Risks, Impacts, and Prevention explains, "Security misconfigurations are errors that occur when security settings are not configured or implemented properly. Misconfigurations can arise from a range of sources, including weak passwords, improperly configured databases, unsecured cloud storage, misconfigured firewalls or network settings, and outdated software or firmware. They can happen due to various reasons, including poor design, lack of understanding of security concepts, and human error"(Kiteworks, 2025). [25]This quote highlights the variety of ways misconfigurations can occur and emphasizes why organizations must identify and correct them to protect against potential security breaches.

The article "The Common Cloud Misconfigurations That Lead to Cloud Data Breaches" explains: "Cloud misconfigurations — the gaps, errors and vulnerabilities that occur when security settings are poorly chosen or neglected entirely — provide adversaries with an easy path to infiltrate the cloud. Multi-cloud environments are complex, and it can be difficult to tell when excessive account permissions are granted, improper public access is configured or other mistakes are made"(Ashwood, 2024).[26] The article also emphasizes that "cloud security posture management should be a key component of your security strategy if you want to avoid becoming the next victim of a cloud data breach"(Ashwood, 2024). [27], showing why strong security measures and backups are essential.

Additionally, another article, 8 Common Cloud Misconfiguration Types (and How to Avoid Them), offers practical solutions: "Access to storage buckets should be granted only within the organization… Security teams should enable strong encryption by default for crucial data in storage buckets, monitor all storage nodes labeled as public, and eliminate unnecessary permissions or exposed access"(Lee, 2025c). [28] This highlights how businesses can lower the risk of misconfiguration by implementing simple, doable measures like restricting access, encrypting private information, keeping an eye on public resources, and eliminating superfluous permissions. To safeguard data and stop breaches, cloud settings must be actively managed.[29]

## Encryption

Some advanced encryption algorithms applied to cloud computing increase the protection of privacy. In a practice called crypto-shredding, encryption keys can be deleted when data is no longer used.

### Attribute-based encryption (ABE)

Attribute-based encryption is a form of public-key encryption in which the user's secret key and the ciphertext depend on attributes (e.g., the country the user lives in, or their subscription type). In such systems, access to decryption depends not simply on identity but on attributes.

Some of the strengths of ABE are that it bypasses the need for explicit key sharing (as in traditional PKI) and identity-based encryption (IBE). However, ABE suffers from key-redistribution complexity: since decryption keys depend on attributes rather than identities, malicious users might leak attribute information, enabling unauthorized access.[30]

#### Ciphertext-policy ABE (CP-ABE)

In CP-ABE, the encryptor controls the access policy for the ciphertext. The process includes Setup, Encrypt, KeyGen, and Decrypt algorithms; the encryptor defines an access structure that must match a user's attributes before decryption is allowed.[31]

#### Key-policy ABE (KP-ABE)

In KP-ABE, the sender encrypts under a set of attributes, and the user's private key is issued to match a policy describing which ciphertexts they may decrypt. KP-ABE shifts access-control responsibility partially to the key-issuer rather than the encryptor. While it provides flexibility, the policy disclosure may weaken privacy guarantees.[32]

### Fully Homomorphic Encryption (FHE)

Fully Homomorphic Encryption allows arbitrary computation on ciphertext without decryption. It is emerging as a high-security option for cloud environments, including voting systems. While promising, it remains largely experimental.[33]

### Searchable Encryption (SE)

Searchable encryption enables secure search on encrypted data. It has symmetric and public-key variants. While it supports functionality over encrypted data, it introduces extra attack surfaces, especially when attribute indexing is involved.[34]

## Data Lifecycle Security - Data Security

Similar to a computer's motherboard or heart, Data is the foundation of life and operation. Basic memory holds extremely important data to enable the user and computer to pick up where they left off.[35]

When delving into the details of the data lifecycle and security, it's critical to strengthen security protocols and make sure that security strategies are strong enough to reduce the likelihood of access or decryption. The Harvard University data lifecycle essay made it apparent that "the best time to secure information in your project is before you even collect it." This statement reinforces the notion that data should be stored and safeguarded before a user or computer even acts.[36]

Numerous factors influence data security and data life-cycle security, beginning with:[37]

Data creation

It is the initial output that the user provides in these forms, such as software or hardware, and it creates a space where information is found and finally kept. From there, it can be altered and safeguarded once both the user and the software have validated it. The creation of new data is beneficial because it enhances performance over time on various security alternatives and allows for innovation to You can continue to add to it once it has been stored and secured, etc. We have a better framework for how it is carried out, thanks to Why Accurate Data is Important for Business Operations. Let's utilize the safe data business lens of security as an example, which lowers risk and facilitates consistent outcomes. The knowledge is currently available and preserved; you can simply return to it and continue working on it, which increases engagement and boosts productivity. In any format where an audience may review it, the quality of the data simply improves over time. This is true not just when data is imported but also when new sources of information are created to enhance certain regions. It reduces risk, increases worker productivity, and promotes more consistent results. Accurate and well-managed data improves business operations. Properly saved and updated data makes it easier to review, expand upon, and enhance, improving performance and creating more space for fresh concepts and superior solutions.[38]

Data Storage

Data storage is the output that the computer produces from the input that the user provides. Depending on the model of the computer, this will determine how the information is presented. If the RAM is full, it means that the data is being disseminated because the computer is overheated or overloaded with data, which requires a lot of power from the computer, particularly from its hardware. The requirements for data storage are broken down in the IBM article What is Data Storage? Examining the benefits and drawbacks of data storage and its significance. [39]

Data Storage's Importance

keeps information accessible and well-organized when needed. enables consumers or businesses to monitor progress and make more informed decisions. prevents the loss or damage of crucial data. facilitates long-term initiatives by centralizing records.[40]

Pros of Data Storage:

Facilitate the access and reuse of information Since everything is kept in one system, productivity can be increased. Enables data backup for security. Supports updates, expansion, and new ideas over time. [41]

Cons of Data Storage:

Requires extra storage as data quantities grow, can take up space, and requires security measures to prevent unauthorized access. Maintaining accuracy and organization requires regular updating. Misunderstandings or outdated information could be the outcome of poor management. [42]

The users' directory contains files and folders that store data. Alternatively, if you're using a personal computer, you can locate storage or extra storage on the hard drive as a stand-in if your computer isn't big enough. [43]Another type of object storage that divides data into metadata and particular identifiers. It's fantastic because it can be this type of storage and used in public cloud servers, which gives some of these providers, like AWS (Amazon Web Services), emails, social media content, etc., scalability and flexibility. It also works well with APIs (application programming interfaces).[44]

Data transmission

Due to its connection to the communication component of syncing devices, this has a significant impact on data lifecycle security. Cables, wireless, wifi, and channels can all be used to transfer these types of communication. Some excellent illustrations of how digital data transmissions operate are message commands. Both synchronous and asynchronous use are possible. Additionally, bandwidth and latency are important aspects of these data transmission methods, which offer effective accuracy in terms of speed and overall accuracy.[45]

HTTPS (Hypertext Transfer Protocol Secure) is a security protocol that is used during data transmission. This works by encrypting the data being transferred between websites, which makes it an excellent example. As a sign that it is being watched over or managed by a human, it will transmit the TLS version and a cipher of random values behind the scenes to guarantee authenticity from the recipient's end. Because the data is actively shielded from vulnerable attacks, this is beneficial. [46]

Data processing

It serves as the fundamental basis for data collection and is essentially a substantial amount of analysis that, if the device has enough storage, may be processed all at once; otherwise, it must be divided, which is where hard drives come into play. Additionally, it offers a range of sources that offer feedback, which is the analytical component. [47]

However, how is the cycle's operation protected? According to the article How to Ensure Secure Data Processing, utilizing a data virtualization platform reduces risk and data breaches even with multiple collaborators by providing a data architecture, basically a template that doesn't change the user's data storage option, and then creating a layout or an analytics report in custom datasets.[48]

Archival & deletion (secure deletion is often overlooked)[49]

In essence, archival data is information that is not regularly used but is kept in file storage so that it can be found and used at a later time if necessary. Deletion is when the data is no longer needed, so it's permanently deleted from the server/ storage. [50]This is critical because it not only creates space due to the removal of data. However, it's important to know that when deleting, it's good to make sure that it's securely deleted because it can still be traceable and recoverable. How to properly ensure that your deletion is properly secured by using cryptographic measures or physically destroying the storage media, the best one is erasing, which basically wipes out which make the data completely unrecoverable/no longer traceable.[49]

## Compliance

Numerous laws and regulations govern the storage and use of data. In the US these include privacy and data-protection laws, the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), the Sarbanes-Oxley Act, the Federal Information Security Management Act of 2002 (FISMA), and the Children's Online Privacy Protection Act of 1998. Similar standards exist in other jurisdictions (e.g., Singapore's Multi-Tier Cloud Security Standard).

Similar laws may apply in different legal jurisdictions and may differ markedly from those in the US. Cloud service users must often understand the legal and regulatory differences between the jurisdictions. For example, data stored by a cloud service provider (CSP) may be located in, say, Singapore and mirrored in the US.[51]

Business continuity and data recovery
Cloud providers have business continuity and data recovery plans in place to ensure service continuity and data protection.[52]

Log and audit trail
In addition to producing logs and audit trails, cloud providers work with their customers to secure these logs and ensure they're accessible for forensic investigation (e.g., eDiscovery).

Unique compliance requirements
In addition to the requirements on customers, data centers used by cloud providers may be subject to additional compliance obligations. Using a cloud service provider (CSP) can lead to extra security concerns around data jurisdiction since customer or tenant data may not remain in the same location or provider's cloud.[53]

## Legal and contractual issues

Cloud providers' security and privacy agreements must align to customer requirements and regulation

Aside from the security and compliance issues already discussed, cloud providers and their customers negotiate terms around liability (stipulating how incidents involving data loss or compromise will be resolved, for example), intellectual property, and end-of-service (when data and applications are ultimately returned to the customer). These issues are typically addressed in service-level agreements (SLAs).[54]

### Public records

Legal issues may also include records-keeping requirements in the public sector, where agencies must retain and make available electronic records in a specific fashion.

## See also

* Computer security
* Common Vulnerabilities and Exposures

## References

1. ↑ 1.0 1.1 Haghighat, Mohammad; Zonouz, Saman; Abdel-Mottaleb, Mohamed (November 2015). "CloudID: Trustworthy cloud-based and cross-enterprise biometric identification". Expert Systems with Applications 42 (21): 7905–7916. doi:10.1016/j.eswa.2015.06.025.
2. ↑ 2.0 2.1 Srinivasan, Madhan Kumar; Sarukesi, K.; Rodrigues, Paul; Manoj, M. Sai; Revathy, P. (2012). "State-of-the-art cloud computing security taxonomies". Proceedings of the International Conference on Advances in Computing, Communications and Informatics - ICACCI '12. pp. 470–476. doi:10.1145/2345396.2345474. ISBN 978-1-4503-1196-0.
3. ↑ "Swamp Computing a.k.a. Cloud Computing". Web Security Journal. 2009-12-28. http://security.sys-con.com/node/1231725.
4. ↑ "Cloud Controls Matrix v4" (xlsx). Cloud Security Alliance. 15 March 2021. https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4/.
5. ↑ 5.0 5.1 "Shared Security Responsibility Model". Navigating GDPR Compliance on AWS. AWS. December 2020. https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/shared-security-responsibility-model.html.
6. ↑ 6.0 6.1 C. Tozzi (24 September 2020). "Avoiding the Pitfalls of the Shared Responsibility Model for Cloud Security". Palo Alto Networks Blog. https://www.paloaltonetworks.com/blog/prisma-cloud/pitfalls-shared-responsibility-cloud-security/.
7. ↑ "Top Threats to Cloud Computing v1.0". Cloud Security Alliance. March 2010. http://www.itsecure.hu/library/file/Biztonsági útmutaták/Felhő szolgáltatások/Top threats to cloud-computing v1_0.pdf.
8. ↑ Winkler, Vic. "Cloud Computing: Virtual Cloud Security Concerns". Technet Magazine, Microsoft. https://technet.microsoft.com/en-us/magazine/hh641415.aspx.
9. ↑ Hickey, Kathleen (18 March 2010). "Dark Cloud: Study finds security risks in virtualization". Government Security News. http://gcn.com/articles/2010/03/18/dark-cloud-security.aspx.
10. ↑ Winkler, Joachim R. (2011). Securing the Cloud: Cloud Computer Security Techniques and Tactics. Elsevier. p. 59. ISBN 978-1-59749-592-9.
11. ↑ Andress, Jason (2014). "Physical Security". The Basics of Information Security. pp. 131–149. doi:10.1016/B978-0-12-800744-0.00009-9. ISBN 978-0-12-800744-0.
12. ↑ Virtue, Timothy; Rainey, Justin (2015). "Information Risk Assessment". HCISPP Study Guide. pp. 131–166. doi:10.1016/B978-0-12-802043-2.00006-9. ISBN 978-0-12-802043-2.
13. ↑ "Detective Security Controls". 2020-12-04. https://lifars.com/2020/12/detective-security-controls/.
14. ↑ "What are Security Controls?". 2019-08-22. https://www.f5.com/labs/articles/education/what-are-security-controls.
15. ↑ "Cloud Security Architecture". GuidePoint Security LLC. 2023. https://www.guidepointsecurity.com/education-center/cloud-security-architecture.
16. ↑ "Gartner: Seven cloud-computing security risks". InfoWorld. 2008-07-02. http://www.infoworld.com/d/security-central/gartner-seven-cloud-computing-security-risks-853. Retrieved 2010-01-25.
17. ↑ "Top Threats to Cloud Computing Plus: Industry Insights". Cloud Security Alliance. 2017-10-20. https://cloudsecurityalliance.org/artifacts/top-threats-cloud-computing-plus-industry-insights/.
18. ↑ "What is a CASB (Cloud Access Security Broker)?". CipherCloud. https://www.ciphercloud.com/what-is-a-casb.
19. ↑ Ahmad Dahari Bin Jarno; Shahrin Bin Baharom; Maryam Shahpasand (2017). "Limitations and challenges on Security Cloud Testing". Journal of Applied Technology and Innovation 1 (2): 89–90. https://www.apu.edu.my/ejournals/jati/journal/JATI-VOLUME_1-ISSUE_2-2017.pdf.
20. ↑ Guarda, Teresa; Orozco, Walter; Augusto, Maria Fernanda; Morillo, Giovanna; Navarrete, Silvia Arévalo; Pinto, Filipe Mota (2016). "Penetration Testing on Virtual Environments". Proceedings of the 4th International Conference on Information and Network Security – ICINS '16. pp. 9–12. doi:10.1145/3026724.3026728. ISBN 978-1-4503-4796-9.
21. ↑ Svantesson, Dan; Clarke, Roger (July 2010). "Privacy and consumer risks in cloud computing". Computer Law & Security Review 26 (4): 391–397. doi:10.1016/j.clsr.2010.05.005.
22. ↑ 22.0 22.1 22.2 Grobauer, Bernd; Walloschek, Tobias; Stocker, Elmar (March 2011). "Understanding Cloud Computing Vulnerabilities". IEEE Security & Privacy 9 (2): 50–57. doi:10.1109/MSP.2010.115. Bibcode: 2011ISPri...9b..50G.
23. ↑ Rukavitsyn, Andrey N.; Borisenko, Konstantin A.; Holod, Ivan I.; Shorov, Andrey V. (2017). "A cloud computing security solution based on fully homomorphic encryption". 2017 XX IEEE International Conference on Soft Computing and Measurements (SCM). pp. 272–274. doi:10.1109/SCM.2017.7970558. ISBN 978-1-5386-1810-3.
24. ↑ "Top 11 Cloud Security Vulnerabilities and How to Fix Them | Wiz" (in en-us). 2025-08-12. https://www.wiz.io/academy/common-cloud-vulnerabilities.
25. ↑ "Security Misconfiguration Vulnerabilities: Risks, Impacts, and Prevention" (in en-US). https://www.kiteworks.com/risk-compliance-glossary/security-misconfigurations/.
26. ↑ Ashwood, Paul. "The Common Cloud Misconfigurations That Lead to Cloud Data Breaches" (in en-US). https://www.crowdstrike.com/en-us/blog/common-cloud-security-misconfigurations/.
27. ↑ Ashwood, Paul. "The Common Cloud Misconfigurations That Lead to Cloud Data Breaches" (in en-US). https://www.crowdstrike.com/en-us/blog/common-cloud-security-misconfigurations/.
28. ↑ Horev, Roy (9 April 2024). "8 Common Cloud Misconfiguration Types | CSA". https://vulcan.io/blog/cloud-misconfiguration/.
29. ↑ Horev, Roy (9 April 2024). "8 Common Cloud Misconfiguration Types | CSA". https://vulcan.io/blog/cloud-misconfiguration/.
30. ↑ Xu, Shengmin; Yuan, Jiaming; Xu, Guowen; Li, Yingjiu; Liu, Ximeng; Zhang, Yinghui; Ying, Zuobin (October 2020). "Efficient ciphertext-policy attribute-based encryption with black-box traceability". Information Sciences 538: 19–38. doi:10.1016/j.ins.2020.05.115. https://ink.library.smu.edu.sg/sis_research/5179.
31. ↑ Bethencourt, John; Sahai, Amit; Waters, Brent (May 2007). "2007 IEEE Symposium on Security and Privacy (SP '07)". pp. 321–334. doi:10.1109/SP.2007.11. ISBN 978-0-7695-2848-9.
32. ↑ Wang, Chang-Ji; Luo, Jian-Fa (November 2012). "A Key-Policy Attribute-Based Encryption Scheme with Constant Size Ciphertext". 2012 Eighth International Conference on Computational Intelligence and Security. pp. 447–451. doi:10.1109/CIS.2012.106. ISBN 978-1-4673-4725-9.
33. ↑ Armknecht, Frederik; Katzenbeisser, Stefan; Peter, Andreas (2012). "Shift-Type Homomorphic Encryption and Its Application to Fully Homomorphic Encryption". Progress in Cryptology – AFRICACRYPT 2012. Lecture Notes in Computer Science. 7374. pp. 234–251. doi:10.1007/978-3-642-31410-0_15. ISBN 978-3-642-31409-4. https://ris.utwente.nl/ws/files/5322305/andreas.pdf.
34. ↑ Naveed, Muhammad; Prabhakaran, Manoj; Gunter, Carl A. (2014). "Dynamic Searchable Encryption via Blind Storage". 2014 IEEE Symposium on Security and Privacy. pp. 639–654. doi:10.1109/SP.2014.47. ISBN 978-1-4799-4686-0.
35. ↑ Privacy and Data Mining, Advances in Information Security, 19, Springer US, 2006, pp. 1–5, doi:10.1007/978-0-387-29489-6_1, ISBN 978-0-387-25886-7, https://doi.org/10.1007/978-0-387-29489-6_1, retrieved 2025-11-30
36. ↑ Privacy and Data Mining, Advances in Information Security, 19, Springer US, 2006, pp. 1–5, doi:10.1007/978-0-387-29489-6_1, ISBN 978-0-387-25886-7, https://doi.org/10.1007/978-0-387-29489-6_1, retrieved 2025-11-30
37. ↑ Singh, Prakash J. (2008-05-28), "What is Operations Management and Why is it Important?", Operations Management (Cambridge University Press): pp. 3–36, doi:10.1017/cbo9781139150002.002, ISBN 978-0-521-70077-1, https://doi.org/10.1017/cbo9781139150002.002, retrieved 2025-11-30
38. ↑ Singh, Prakash J. (2008-05-28), "What is Operations Management and Why is it Important?", Operations Management (Cambridge University Press): pp. 3–36, doi:10.1017/cbo9781139150002.002, ISBN 978-0-521-70077-1, https://doi.org/10.1017/cbo9781139150002.002, retrieved 2025-11-30
39. ↑ "Intelligent controllers for IBM storage". Data Processing 27 (4): 52. 1985. doi:10.1016/0011-684x(85)90076-0. ISSN 0011-684X. https://doi.org/10.1016/0011-684x(85)90076-0.
40. ↑ "Intelligent controllers for IBM storage". Data Processing 27 (4): 52. 1985. doi:10.1016/0011-684x(85)90076-0. ISSN 0011-684X. https://doi.org/10.1016/0011-684x(85)90076-0.
41. ↑ "Intelligent controllers for IBM storage". Data Processing 27 (4): 52. 1985. doi:10.1016/0011-684x(85)90076-0. ISSN 0011-684X. https://doi.org/10.1016/0011-684x(85)90076-0.
42. ↑ Identification cards. Integrated circuit card programming interfaces, BSI British Standards, doi:10.3403/30163725, https://doi.org/10.3403/30163725, retrieved 2025-11-30
43. ↑ Nutanix (2022-10-24). "What is Data Storage? Definition and Types | Nutanix" (in en-US). https://www.nutanix.com/blog/types-of-data-storage.
44. ↑ "What is an API? - Application Programming Interface Explained - AWS" (in en-US). https://aws.amazon.com/what-is/api/.
45. ↑ "What is data transmission?" (in en). https://www.pubnub.com/learn/glossary/data-transmission/.
46. ↑ "NATO and Intermediate Force Capabilities: Why Human Effects Matter". Connections: The Quarterly Journal 21 (2): 123–134. 2022. doi:10.11610/connections.21.2.09. ISSN 1812-1098. https://doi.org/10.11610/connections.21.2.09.
47. ↑ Rahul (2025-01-24). "Steps Involved in Business Data Processing" (in en-US). https://www.askdataentry.com/blog/steps-involved-in-business-data-processing/.
48. ↑ Intertrust, Team (2023-05-03). "How to ensure secure data processing" (in en-US). https://www.intertrust.com/blog/how-to-ensure-secure-data-processing/.
49. ↑ 49.0 49.1 "Electronic Data Removal Procedures | UVA Information Security". https://security.virginia.edu/electronic-data-removal-procedures.
50. ↑ "What Is Data Erasure? Secure Deletion Explained | Fortra's Data Classification" (in en). https://dataclassification.fortra.com/blog/what-data-erasure-secure-deletion-explained.
51. ↑ "Managing legal risks arising from cloud computing". DLA Piper. 29 August 2014. http://www.technologyslegaledge.com/2014/08/29/managing-legal-risks-arising-from-cloud-computing/.
52. ↑ "It's Time to Explore the Benefits of Cloud-Based Disaster Recovery". Dell.com. http://content.dell.com/us/en/enterprise/d/large-business/benefits-cloud-based-recovery.aspx.
53. ↑ Winkler, Joachim R. (2011). Securing the Cloud: Cloud Computer Security Techniques and Tactics. Elsevier. pp. 65,68,72,81,218–219,231,240. ISBN 978-1-59749-592-9.
54. ↑ Adams, Richard (2013). "The emergence of cloud storage and the need for a new digital forensic process model". in Ruan, Keyun. Cybercrime and Cloud Forensics: Applications for Investigation Processes. Information Science Reference. pp. 79–104. ISBN 978-1-4666-2662-1. https://researchrepository.murdoch.edu.au/id/eprint/19431/1/emergence_of_cloud_storage.pdf.

## Further reading

* Mowbray, Miranda (15 April 2009). "The Fog over the Grimpen Mire: Cloud Computing and the Law". SCRIPT-ed 6 (1): 132–146. doi:10.2966/scrip.060109.132.
* Mather, Tim; Kumaraswamy, Subra; Latif, Shahed (2009). Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance. O'Reilly Media, Inc.. ISBN 978-0-596-80276-9.
* Winkler, Vic (2011). Securing the Cloud: Cloud Computer Security Techniques and Tactics. Elsevier. ISBN 978-1-59749-592-9.
* Ottenheimer, Davi (2012). Securing the Virtual Environment: How to Defend the Enterprise Against Attack. Wiley. ISBN 978-1-118-15548-6.
* BS ISO/IEC 27017: "Information technology. Security techniques. Code of practice for information security controls based on ISO/IEC 27002 for cloud services." (2015)
* BS ISO/IEC 27018: "Information technology. Security techniques. Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors." (2014)
* BS ISO/IEC 27036-4: "Information technology. Security techniques. Information security for supplier relationships. Guidelines for security of cloud services" (2016)

## External links

* DoD Cloud Computing Security Requirements Guide (CC SRG)

### Archive

* v
* t
* e

Cloud computing

As a service|

* Content as a service
* Data as a service
* Desktop as a service
* Function as a service
* Infrastructure as a service
* Mobile backend as a service
* Network as a service
* Platform as a service
* Security as a service
* Software as a service

Technologies|

* Cloud database
* Cloud storage
* Data centers
* Distributed file system for cloud
* Hardware virtualization
* Internet
* Native cloud application
* Networking
* Security
* Structured storage
* Virtual appliance
* Web APIs
* Virtual private cloud

Applications|

* Box
* Dropbox
* Google
* G Suite
* Docs, Sheets and Slides
* HP Cloud (closed)
* Microsoft Online
* Oracle Cloud
* Rackspace
* Salesforce
* Workday
* Zoho

Platforms|

* Alpha7
* Amazon Web Services
* AppScale
* Box
* Bluemix
* CloudBolt
* Cloud Foundry
* Cocaine (PaaS)
* Engine Yard
* Helion
* GE Predix
* Google App Engine
* GreenQloud
* Heroku
* Inktank
* Jelastic
* Mendix
* Microsoft Azure
* MindSphere
* Netlify
* Oracle Cloud
* OutSystems
* openQRM
* OpenShift
* PythonAnywhere
* RightScale
* Scalr
* Force.com
* SAP Cloud Platform
* VMware vCloud Air
* WaveMaker

Infrastructure|

* Amazon
* Abiquo Enterprise Edition
* CloudStack
* Citrix Cloud
* CtrlS
* DigitalOcean
* EMC Atmos
* Eucalyptus
* Fujitsu
* GoGrid
* Google Cloud Platform
* GreenButton
* GreenQloud
* IBM Cloud
* iland
* Joyent
* Lunacloud
* Mirantis
* Nimbula
* Nimbus
* OpenIO
* OpenNebula
* OpenStack
* Oracle Cloud
* OrionVM
* Rackspace Cloud
* Safe Swiss Cloud
* SoftLayer
* Zadara Storage
* libvirt
* libguestfs
* OVirt
* Virtual Machine Manager
* Wakame-vdc
* Virtual Private Cloud OnDemand

* Category
* Commons

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Cloud computing security. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Cloud_computing_security&oldid=4227270"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template