Assignment 1: Network Security

Great Essays
to an extent through the encryption of data and proper access control management. Still even with these security measures in place, dubious attackers can breach the security measures and gain access to the data in the following ways [4].
• Cross-site scripting
• Cross-site request forgery
• Cookie manipulation
• OS and SQL injection
• Insecure storage
• Hidden field manipulation
Due to the vulnerabilities listed above, achieving data security in cloud remains a mammoth task.
1) Network Security: When using SaaS, the client transfer sensitive information to the application over the network. Hence, it is essential to secure the connection and provide proper network security. Currently, a majority of the SaaS vendor using Secure Socket Layer
…show more content…
As SaaS applications are available in a distributed environment, data integrity becomes an important issue. In distributed systems, the data integrity is achieved through a central transaction manager. But SaaS applications tend to be multi-tenant and run as services. These services often expose their functionality through an interface and serve data in the form of XML. Hence, the lack of clear transaction management and data integrity checks on these services can create serious vulnerabilities and provide unauthorized access to private data resulting in huge financial losses. Therefore, it is of utmost importance to ensure data integrity is not violated through the use of SaaS …show more content…
This can also be a source of security risk.
In addition to the above mentioned security flaws, PaaS inherits all the security risks present in SaaS model such as data security, network security etc.
B. Security challenges in Infrastructure as a Service
In IaaS, the vendor provides the customer with all the infrastructure necessary such as servers, storage, network and other computing resources primarily in the form of virtualized resources. Thus, provider is responsible for security only till the hypervisor and any other security issues above in the OS or application level should be handled by the customer. Thus, in IaaS the customers have greater control over the security policies implemented compared to other service models. However, this does not mean IaaS is not susceptible to security flaws. Some of sources of security flaws which are a cause for concern in IaaS are discussed

Related Documents

  • Improved Essays

    In case a specific cloud is under attack, the cooperative IDS alert all other components in the system. Trustworthiness of a cloud is decided by voting, so that the overall system performance is not compromised. C) Cookie Poisoning It is method of modifying the contents of cookie by an attacker to gain unauthorized information about the user for the purpose of identity theft. Attacker…

    • 745 Words
    • 3 Pages
    Improved Essays
  • Improved Essays

    Port Scanning Policy

    • 729 Words
    • 3 Pages

    Roles and Responsibilities: Chief security Officer: Developing test proce-dures, performing periodic testing, documenting results and communicating vulnerabilities to the respective team leads, suggesting potential mitigation strategies. 5. Enforcement: Violation of the policy could result in loss or limitations on use of information resources, as well as disciplinary and/or legal action, includ-ing termination of employment or referral for criminal prosecution. c. Password Policy: Upon exploiting the vulnerability of the target system the pen tester can extract the passwords and crack them to login to other systems. Hav-ing a strict password policy will help reduce this vulnerability.…

    • 729 Words
    • 3 Pages
    Improved Essays
  • Improved Essays

    There is a subtle difference between security and protection, we will perceive that both of them are extremely close concepts but still not the same. Protection is assured if one has all the necessary security measures as security itself is a type of protection to all the external hazards. Information is a treasure which is immensely worthy to an organization and thus it needs to be protected firmly. It is easy to corrupt, lose and steal thus the measures needed or taken to secure them from irrelevant entries are mentioned as Information Security. The significant step taken by most of the Organizations or firms recently is the use of ethical hacking process or techniques to evaluate the success or failure of their current security measures.…

    • 1032 Words
    • 5 Pages
    Improved Essays
  • Improved Essays

    A Vulnerability Assessment needs to be completed to identify weaknesses in the network security configuration in order to suggest changes. We must keep in mind that documentation on how the network systems are configured is critical for the recovery process during a penetrating testing. Vulnerability Assessments are designed to identify network weaknesses and help coming with security improvements and remedies. Penetration testing is a testing method that tries to exploit a weakness in the system to prove that an attacker could successfully penetrate it. (Kim, D. & Solomon, Michael 2014, page 486).…

    • 706 Words
    • 3 Pages
    Improved Essays
  • Improved Essays

    4. Use of firewall to safeguard online EHR systems unless they are offline. 5. Use of antivirus and malware protection plays a major role in securing the portal. 6. having data back ups regular interval ensuring its safety will be a responsibility when unexpected things happen around either during natural disaster or intruders hack into system.…

    • 1171 Words
    • 5 Pages
    Improved Essays
  • Improved Essays

    Data Insecurity

    • 1802 Words
    • 8 Pages

    He also explored the concerns of the organizations regarding the data being stolen from the The role of the third party in the process of encryption is also necessary to be taken into account. In the contemporary world, these are the third party that is focusing over the process of encryption. They are actually being hired by the organizations for getting this task done, and this becomes, sometimes, the reason for the data stealing. David explored that the organizations are confused and their focus is mainly over the cloud providers. The companies rely over the providers of the tasks that are to be performed with regard to the encryption.…

    • 1802 Words
    • 8 Pages
    Improved Essays
  • Improved Essays

    Attacks such as DDoS (Distributed Denial of Service) target servers by sending large numbers of connection requests within a short span of time, which renders the server unresponsive. IT strategists should not only take into account the response in such events but how such attacks could be identified early on so that other backup systems could be made operational to service genuine requests. The observation principle also lays special emphasis on the identification of threats and the training of security analysts to detect suspicious behavior in the least possible time. Hackers typically do not repeat a particular style of attack again once it is used against an organization. Security analysts should be trained to detect newer and smarter forms of attacks as…

    • 810 Words
    • 4 Pages
    Improved Essays
  • Improved Essays

    Secure Computer Security

    • 1115 Words
    • 4 Pages

    This will direct the administrator as to what needs to be done to secure the information and the system. Less vital or crucial data may not need as much protection as the types of data like account numbers, and trade secrets. You must follow the laws that govern you business. In a bank there may be data that can’t be disclosed to the public until it is reported. Insider trading is a type of unethical practice that is illegal.…

    • 1115 Words
    • 4 Pages
    Improved Essays
  • Great Essays

    Passwords should not be written down and change periodically; this will minimize the risk of hacker learning employees’ passwords. After securing access to the computer systems, next is to securing access to the data itself. Database security will be set differently that computer systems security. Access to specific data must be restricted so that certain people have access to retrieve and/or modify certain the data. The principle of least privilege should be used for access controls.…

    • 967 Words
    • 4 Pages
    Great Essays
  • Great Essays

    The goal of an APT is to gain access into the power grid network and collect as much information as possible. They use the exfiltration techniques that allow them to transfer sensitive information to their data-miner area also know as Command and Control Center. It is important for the APT to mask the data to resemble normal network traffic so that it detection can be made difficult or almost impossible (Cruz, 2013). Method for data exfiltration includes: Backdoors: This method used by the attacker to capture keystrokes, as well as video and audio of the system’s environment, using attached audio microphones and video cameras File transfer protocols Abuse: Attackers can abuse legitimate Windows features as well. For instance, attackers can…

    • 1307 Words
    • 6 Pages
    Great Essays