Cloud Security Flashcards
What are the basic components of cloud security, and what do they aim to protect?
Confidentiality, Integrity (data and origin), and Availability are the basic components of cloud security. They aim to protect data, resources, and access in the cloud.
What are the four types of security attacks, and how do they compromise security?
The four types of security attacks are:
Interruption (attacks on availability)
Interception (attacks on confidentiality)
Modification (attacks on integrity)
Fabrication (attacks on authenticity)
What are the classes of security threats in the cloud, and how do they affect security?
Classes of threats in the cloud include Disclosure, Deception, Disruption, and Usurpation. They impact security by compromising privacy, modifying data, causing disruptions, and impersonating entities.
What is the relationship between policies and mechanisms in cloud security?
Policies define what is and isn’t allowed in a system, while mechanisms enforce these policies. If policies conflict, discrepancies can create security vulnerabilities.
What are the primary goals of security in the cloud, and what do they aim to achieve?
The primary goals of security in the cloud are Prevention (preventing security policy violations), Detection (detecting violations), and Recovery (stopping attacks, assessing and repairing damage, and maintaining functionality).
What role do trust and assumptions play in cloud security?
Trust and assumptions underlie all aspects of security, from defining unambiguous policies to mechanisms that enforce policies and supporting mechanisms that work correctly.
What are the types of mechanisms in cloud security, and how do they work?
The types of mechanisms include secure mechanisms (precisely define a set of reachable states) and broad mechanisms (define a set of secure states).
What are the stages of assurance in cloud security, and what do they involve?
Assurance involves Specification (requirements analysis and functionality statement), Design (how the system meets the specification), and Implementation (creating programs/systems).
What operational issues are important in cloud security, and how do they impact decision-making?
Operational issues include Cost-Benefit Analysis (determining the cost-effectiveness of security measures), Risk Analysis (evaluating what and how much to protect), and Legal and Customary considerations.
What human issues can affect cloud security, and what challenges do they introduce?
Human issues in cloud security include Organizational Problems (power, responsibility, and financial benefits) and People Problems (addressing outsiders, insiders, and social engineering).
How do security attacks compromise the security of information, and what are the four types of security attacks?
Security attacks compromise information security. The four types of attacks are Interruption (attacks on availability), Interception (attacks on confidentiality), Modification (attacks on integrity), and Fabrication (attacks on authenticity).
What are the classes of threats in cloud security, and what types of security issues do they represent?
Classes of threats in cloud security include Disclosure (privacy issues), Deception (modification, spoofing, repudiation of origin, denial of receipt), Disruption (modification), and Usurpation (modification, spoofing, delay, denial of service).
How do policies and mechanisms interact in cloud security, and what can discrepancies in policies lead to?
Policies define “security” for a system, and mechanisms enforce policies. If policies conflict, discrepancies may create security vulnerabilities.
What are the primary goals of security in the cloud, and what do they aim to achieve?
The primary goals of security in the cloud are Prevention (preventing security policy violations), Detection (detecting violations), and Recovery (stopping attacks, assessing and repairing damage, and maintaining functionality).
How do trust and assumptions underlie security in the cloud, and what do they relate to in terms of policies and mechanisms?
Trust and assumptions underlie all aspects of security in the cloud. They relate to unambiguously partitioning system states and ensuring that policies correctly capture security requirements.
What are the two types of mechanisms in cloud security, and how do they relate to reachable and secure states?
The two types of mechanisms are secure mechanisms (precisely define a set of reachable states) and broad mechanisms (define a set of secure states).
What stages are involved in assurance in cloud security, and what does each stage entail?
Assurance involves Specification (requirements analysis and functionality statement), Design (how the system meets the specification), and Implementation (creating programs/systems).
What operational issues are important in cloud security, and what considerations are involved in these issues?
Operational issues include Cost-Benefit Analysis (determining the cost-effectiveness of security measures), Risk Analysis (evaluating what and how much to protect), and Legal and Customary considerations.
What are the human issues that can impact cloud security, and what challenges do they introduce?
Human issues in cloud security include Organizational Problems (power, responsibility, and financial benefits) and People Problems (addressing outsiders, insiders, and social engineering).
What threats and challenges are introduced by virtualization in cloud security, and what are some potential vulnerabilities associated with hypervisors?
Virtualization introduces threats and challenges, including resource isolation. Hypervisor vulnerabilities may include shared clipboard technology, keystroke logging, virtual machine backdoors, and ARP poisoning.
What is Data Life Cycle Management?
Data Life Cycle Management involves managing data throughout its entire lifecycle, from creation and storage to processing, archiving, and eventual disposal or deletion.
What are the key security considerations in Data Life Cycle Management?
The key security considerations include confidentiality, integrity, and availability of data, as well as compliance with regulations and secure data handling practices.
What is the significance of the research article titled “Hey, You, Get Off of My Cloud!”?
The research article explores information leakage in third-party compute clouds, specifically Amazon EC2, and investigates the practicality of cross-VM attacks.
What is the motivation behind the attack model in cloud security research?
The motivation is to study the practicality of mounting cross-VM attacks in existing third-party compute clouds, such as Amazon EC2.
What are the assumptions of the threat model in cloud security research?
The threat model assumes that the provider and infrastructure are trusted, does not consider attacks that rely on subverting administrator functions, and focuses on non-provider-affiliated malicious parties and their potential victims.
What is Amazon EC2, and how does it work?
Amazon EC2 is a scalable, pay-as-you-go compute capacity service in the cloud that allows customers to run different operating systems within virtual machines. It offers various instance types, regions, and availability zones.
