An Introduction to Cloud Computing | Ethical Hacking

Cloud computing has become one of the most deliberated topics among cybersecurity experts and IT professionals. And more recently, cloud computing in ethical hacking has taken up the spotlight. With the rise of cloud crimes, experts are looking into how ethical hacking principles can curb security issues and boost forensic investigations as well.

Cloud computing presents new paths for malicious hackers to leverage vulnerabilities, thus increasing the new categories of vulnerability and cloud security concerns. Moreover, investigating crimes in the cloud can be somewhat demanding.

This article serves as an introduction to cloud computing and its benefits. It also explains how cloud computing in ethical hacking can be useful.

What Is Cloud Computing?

Cloud computing describes the on-demand delivery of IT competencies like storage, databases, servers, intelligence, analytics, networking, and others through metered services. This lets you customize, create, and configure applications either offline or online. The word ‘cloud’ refers to a network.

Previously, you could only store information locally. An on-premises data center required organizations to manage everything — procuring and virtualization, installation of an operating system, setting up network and storage for data, and maintenance.

Cloud computing dramatically altered this state of affairs by off-shoring or outsourcing ICT duties to third-party services. They are not only responsible for procurement and maintenance, but they also offer a wide range of platforms and software as a service. Some cloud computing service providers include Amazon Web Services, IBM Cloud, Google Cloud Platform, Microsoft Azure, VMware, DigitalOcean, RackSpace, etc.

4 Types of Cloud Computing

There are four popular types of cloud computation:

◉ Hybrid cloud: Describes combined computing, services environment, and storage, which includes Private cloud services, on-premises infrastructure, and public cloud such as Microsoft Azure or Amazon Web Services (AWS). The company may manage some applications on the public cloud, while other critical applications are hosted on the private cloud.

◉ Public cloud: It is an IT model where computing infrastructure and services are hosted by the cloud vendor and shared with several organizations through the public internet. This cloud computing type makes computing resources accessible to people for purchase and is shared by multiple users.

◉ Private cloud: This is defined as a computing infrastructure or services dedicated to a specific organization, which isn’t shared with the general public. They are offered over a private internal network or Internet and need the same management, workforce, and maintenance expenditures as customary data center ownership. As such, they are more costly and secure than public clouds.

◉ Community cloud: Describes the sharing of computing infrastructure and services to a restricted set of organizations or staff like heads of trading firms or banks.

What Is Cloud Computing Used For?

This categorization is based on the types of services offered:

◉ Platform as a Service (PaaS): Or otherwise application platform as a service, involves providing a platform that lets consumers develop, manage, and run applications. This excludes the complications of sustaining the infrastructure usually connected with launching an app. Popular examples are Microsoft’s Azure, Google Application Engine, and Salesforce.

◉ Infrastructure as a Service (IaaS): This is a type of cloud computing that offers virtualized computing resources over the internet. It involves presenting abstracted hardware, virtual machines, and operating systems through the concepts of cloud computing. However, you purchase the infrastructure while retaining the software. Examples of vendors that provide this service are Flexiscale, Amazon S3, Amazon EC2, and Rackspace Cloud Servers.

◉ Software as a Service (SaaS): This offers wide-ranging software features on the cloud. What this means is that you access applications through the internet rather than downloading software on your PC, desktop, or business network. You can implement on-demand bases, such as Google, Salesforce, and Microsoft’s online version of Office, .

The Benefits of Cloud Computing

Cloud computing is highly valuable:

◉ Extremely fast: You can assess your resources in minutes with a few clicks.

◉ Saves you money: Cloud computing minimizes the enormous capital cost of procuring software and hardware. You need less personal training and personnel.

◉ Increases productivity: You put in less operational effort with cloud computing. You don’t have to apply patches and there’s no need to sustain hardware and software. By doing so, IT professionals and the cybersecurity team can be more productive and attend to more pressing business needs.

◉ Highly scalable: The requirements of resources can be decreased or increased based on your business demands.

◉ More secure than its alternatives: Storing data on the cloud is relatively secure when compared to storing data on your hard drives and other storage options. Cloud vendors often provide a broad range of controls, technologies, and policies that strengthen the security of your data.

◉ More dependable: You can forget about unnecessary data loss when you use the cloud. Backup and recovery are faster and more cost-effective for business continuity.

Most Common Cloud Computing Threats and Attacks

One of the major issues with cloud computing is security and privacy concerns over the infrastructure and services provided by a third party. While vendors try to ensure secure networks, a data breach could affect consumers and their businesses. Another concern is the need for private data to be stored separately. If another customer falls victim to an attack, the availability and integrity of the data might be compromised. Some of the common threats and attacks which can affected cloud computing are:

◉ Natural disasters

◉ Malicious insiders

◉ Deletion without backups

◉ Hardware failures

◉ Unknown risk profile

◉ Denial-of-service (DoS) attacks

◉ Compliance risks

◉ VM level attacks

◉ Authentication attacks

◉ Loss of coding key

◉ Vulnerable co-existents

◉ Man-in-the-middle attacks

◉ Cryptanalysis attacks

◉ DNS attacks

◉ Social engineering attacks

◉ Cross-site scripting (XSS)

◉ SQL injection attacks

◉ Account, service, and traffic hijacking

◉ Unauthorized access

◉ Insecure or incomplete data deletion

Cloud Computing in Ethical Hacking

Cloud computing services make business applications mobile and cooperative. However, there is always the risk of security and privacy breach when handling sensitive data to vendors or a third party. The fundamental ethical principles of IT remains unaffected even with the emergence of cloud computing infrastructure and services.

It is critical to reconsider these principles. Particularly since most of what used to be completely internal deliberations of operations and risk management has been assigned to vendors and persons who sit beyond immediate organizational control. These vendors become the main keepers of customer data, risk mitigation, and functional operation. Therefore, they must understand the operational risks they are undertaking on behalf of their clients.

Similarly, these clients also have an obligation, since it’s possible they are also providing services to other clients. It is important to have an in-depth knowledge of the technology employed and its associated risks. The easiest way is to undertake due diligence when considering a third-party provider for cloud computing services.

At the end of the day, it all boils down to certain basic concepts: accountability, honesty, respect for privacy, and “do unto others what you would like to be done unto you.” Cloud computing can be maximized only if true, long-term trust is established between clients and providers. This can only be achieved through a definite system of ethics. As such, the storing of client data in the cloud should follow stricter regulations.

Source: eccouncil.org