Cloud and MEC Security 387
Several possibilities of attacks exist in this realm. One of the most threatening is the
insider attack; this is considered as one of the largest threats in cloud computing as a
whole [34]. Insiders in this context are the CSP staff with access to the physical servers
on which user data is stored. Possible ways to mitigate this risk is for the CSP to ensure
well coordinated routine background checks for such employees. Other related security
threats are:
● Abuse and nefarious use of cloud: where CSPs offer cloud access to anonymous users
who may turn out to be criminals or malicious code authors;
● Insecure interfaces and APIs: where CSPs provide customers with porous APIs, e.g.
APIs that allow for anonymous access or clear‐text authentication;
● Shared infrastructure: where different CSPs share common infrastructures such as
CPU caches and GPUs, hence extending user data security risks beyond the
actual CSP;
● Data loss or leakage: could be in the form of deletion or alteration of data without
adequate backup facilities for recovery [34].
16.4.4 Cloud Intrusion
Cloud intrusion affects the availability, confidentiality and integrity of cloud resources
and services. Intrusion could come in various forms, depending on the level of
sophistication of the intruder and the nature of loopholes and weak links on the cloud
environments. Intrusion may range from hobbyist hackers, to organized crime, to
corporate espionage, or even nation‐state sponsored intrusions.
The most conventional means to mitigating the possibilities of cloud intrusion is by
building intrusion detection systems (IDS) and other control mechanisms in the cloud
computing environment. The IDS monitors the cloud environment for malicious
activities and policy violations. IDS could be attached to any of the cloud service
models – IaaS, SaaS, PaaS; it can also be extended to network hosts as well as the
hypervisor. In [35], Cox discussed evolving and advanced IDSs required in the cloud
environment; these include the hypervisor‐based intrusion detection system,
traditional host intrusion detection system (HIDS), and network intrusion detection
system (NIDS), and he recommends HIDS to be deployed on both the front and back
end of the cloud architecture, while NIDS and hypervisor‐based intrusion detection
system should be completely left to the back‐end where the CSPs operate. Another
workable but rather passive approach to addressing such challenges is building intrusion‐tolerant cloud applications, which are capable of ignoring potential malevolent
requests. The limitation to this approach is that intruders could easily circumvent the
mechanisms of such controls over time; hence the CSP will need to keep pace with
evolving intrusion patterns.
16.4.5 Access Control
The cloud environment is a large open distributed system; therefore migrating to cloud
technologies implies certain levels of access sharing on both data and network infrastructures. The main function of access control is to ensure that only authorized users
are granted access to data and network infrastructure. Additional functions may include
Several possibilities of attacks exist in this realm. One of the most threatening is the
insider attack; this is considered as one of the largest threats in cloud computing as a
whole [34]. Insiders in this context are the CSP staff with access to the physical servers
on which user data is stored. Possible ways to mitigate this risk is for the CSP to ensure
well coordinated routine background checks for such employees. Other related security
threats are:
● Abuse and nefarious use of cloud: where CSPs offer cloud access to anonymous users
who may turn out to be criminals or malicious code authors;
● Insecure interfaces and APIs: where CSPs provide customers with porous APIs, e.g.
APIs that allow for anonymous access or clear‐text authentication;
● Shared infrastructure: where different CSPs share common infrastructures such as
CPU caches and GPUs, hence extending user data security risks beyond the
actual CSP;
● Data loss or leakage: could be in the form of deletion or alteration of data without
adequate backup facilities for recovery [34].
16.4.4 Cloud Intrusion
Cloud intrusion affects the availability, confidentiality and integrity of cloud resources
and services. Intrusion could come in various forms, depending on the level of
sophistication of the intruder and the nature of loopholes and weak links on the cloud
environments. Intrusion may range from hobbyist hackers, to organized crime, to
corporate espionage, or even nation‐state sponsored intrusions.
The most conventional means to mitigating the possibilities of cloud intrusion is by
building intrusion detection systems (IDS) and other control mechanisms in the cloud
computing environment. The IDS monitors the cloud environment for malicious
activities and policy violations. IDS could be attached to any of the cloud service
models – IaaS, SaaS, PaaS; it can also be extended to network hosts as well as the
hypervisor. In [35], Cox discussed evolving and advanced IDSs required in the cloud
environment; these include the hypervisor‐based intrusion detection system,
traditional host intrusion detection system (HIDS), and network intrusion detection
system (NIDS), and he recommends HIDS to be deployed on both the front and back
end of the cloud architecture, while NIDS and hypervisor‐based intrusion detection
system should be completely left to the back‐end where the CSPs operate. Another
workable but rather passive approach to addressing such challenges is building intrusion‐tolerant cloud applications, which are capable of ignoring potential malevolent
requests. The limitation to this approach is that intruders could easily circumvent the
mechanisms of such controls over time; hence the CSP will need to keep pace with
evolving intrusion patterns.
16.4.5 Access Control
The cloud environment is a large open distributed system; therefore migrating to cloud
technologies implies certain levels of access sharing on both data and network infrastructures. The main function of access control is to ensure that only authorized users
are granted access to data and network infrastructure. Additional functions may include