I am currently writing a paper on the future security challenges of Cloud Computing, and possible solutions to these problems. After many hours of reading articles on the internet (my nearby library have no books available at the moment about the subject) I have certainly learned a lot, but also gotten a lot more confused about what I actually want to include in my paper. Since the theme/area of Cloud Computing is so broad: from services offered to private people vs big businesses - which require different security according to use and data stored etc. But also all the different types that are offered: SaaS, PaaS and IaaS... Private vs hybrid vs public cloud.
My problem might be that I am not very heavy on the tech-knowledge - and many articles seems to either target possible cloud customers(very reassuring about the security of the service) vs posts written and probably targeted on people whom know a lot about this technology and security from before. And I would need something in between that:)
Some of the challenges that I have listed so far are:
- Multitenancy & multi-instance architecture: several people/businesses storing their data or applications in the same place - keeping this separate
- The possibility that the cloud provider may give access to their customers data to law enforcement institutions, the government etc. Challenge lies in trust, law, agreement between provider and customer..
- More Data (possibly very private/confidential) in transit: network technology
- Encryption: to effectively search through the data in the cloud this requires unencrypting it - which gives the cloud provider(and possible attackers or instances with ability to effect the provider) to access the data
- Identity and access management: Some data should maybe be accessible to outsiders/customers/collaborateurs, while other data should stay confidential
- Hypervisor security
- Overall big issue: People/businesses no longer in charge of their own data, applications etc... Standard agreements, standards etc for the customer to know what to expect from the provider
So my questions are:
- Any recommended articles/pages/blogs to read about the topic
- Any important/interesting points I have not included here that might be worth to take a look at
- Pages/research or available products that solve or hope to solve in the future any of these challenges
Of solutions I have found so far there is things as Dome9 for cloud firewall management, homomorphic encryption.. So any tips/keywords on this would be amazing!
Sources I have looked at:
- Cloud Security Alliance Blog
- Bruce Schneiers Blog
- Wired: Cloudline Blog
- IBMs pages with products
- IBM Institute for Advanced Security Expert Blog
+++ other articles and sites that comment upon the subject
:)