Cloud hooks: Security and privacy issues in cloud computing

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2011, Pages

  Jansen, Wayne A ^a  

^a NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CLOUD HEAD; COMPUTING SECURITY; DAMAGING WIND; EXTRATROPICAL CYCLONES; HOOK FORMATION; KEY ISSUES; SECURITY AND PRIVACY ISSUES; TERM SIGNIFICANCE; WARM AIR;

COMPUTER SYSTEMS; HOOKS; SYSTEMS SCIENCE;

CLOUD COMPUTING;

EID: 79952952264     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2011.103     Document Type: Conference Paper

References (70)

1. J. Brodkin, Loss of Customer Data Spurs Closure of Online Storage Service 'The Linkup,' Network World, August 11, 2008, http://www.networkworld.com/news/ 2008/081108-linkup-failure.html?page=1
2. C. Brooks, Amazon EC2 Attack Prompts Customer Support Changes, Tech Target, October 12, 2009, http://searchcloudcomputing.techtarget.com/news/ article/0,289142,sid201-gci1371090,00.html
3. M. Calore, Ma.gnolia Suffers Major Data Loss, Site Taken Offline, Wired Magazine, January 30, 2009, http://www.wired.com/epicenter/2009/01/magnolia- suffer/
4. D. Cappelli, A. Moore, R. Trzeciak, T. J. Shimeall, Common Sense Guide to Prevention and Detection of Insider Threats, 3rd Edition, Version 3.1, CERT, January 2009, http://www.cert.org/archive/pdf/CSG-V3.pdf
5. USA Patriot Act Comes under Fire in B.C. Report, CBC News, October 30, 2004, http://www.cbc.ca/canada/story/2004/10/29/patriotact-bc041029.html
6. R. Chow et al., Controlling Data in the Cloud: Outsourcing Computation without Outsourcing Control, ACM Workshop on Cloud Computing Security, Chicago, IL, November 2009
7. G. Clarke, Microsoft's Azure Cloud Suffers First Crash, The Register, March 16, 2009, http://www.theregister.co.uk/2009/03/16/azure-cloud-crash/
8. S. Cocheo, The Bank Robber, the Quote, and the Final Irony, nFront, ABA Banking Journal, 1997, http://www.banking.com/aba/profile-0397.htm
9. Safe Harbor Privacy Principles, U.S. Department of Commerce, July 21, 2000, http://www.export.gov/safeharbor/eg-main-018247.asp
10. J. E. Dunn, Ultra-secure Firefox Offered to UK Bank Users, Techworld, February 26, 2010, http://news.techworld.com/security/3213740/ultra-secure- firefox-offered-to-uk-bank-users/
11. J. E. Dunn, Virtualised USB Key Beats Keyloggers, Techworld, February 22, 2010, http://news.techworld.com/security/3213277/virtualised-usb-key-beats- keyloggers/
12. M. P. Eisenhauer, Privacy and Security Law Issues in Off-shore Outsourcing Transactions, Hunton & Williams LLP, The Outsourcing Institute, February 15, 2005, http://www.outsourcing.com/legal-corner/pdf/Outsourcing- Privacy.pdf
13. P. Ferrie, Attacks on Virtual Machine Emulators, White Paper, Symantec Corporation, January 2007, http://www.symantec.com/avcenter/reference/Virtual- Machine-Threats.pdf
14. T. Ferguson, Salesforce.com Outage Hits Thousands of Businesses, CNET News, January 8, 2009, http://news.cnet.com/8301-1001-3-10136540-92.html
15. S. Frei, T. Duebendorfer, G. Ollmann, M. May, Understanding the Web Browser Threat, ETH Zurich, Tech Report Nr. 288, 2008, http://ecollection. ethbib.ethz.ch/eserv/eth:30892/eth-30892-01.pdf
16. G. Fowler, B. Worthen, The Internet Industry is on a Cloud - Whatever That May Mean, The Wall Street Journal, March 26, 2009
17. S. Gajek, M. Jensen, L. Liao, and J. Schwenk, Analysis of Signature Wrapping Attacks and Countermeasures, IEEE International Conference on Web Services, Los Angeles, CA, July 2009
18. T. Garfinkel, M. Rosenblum, When Virtual is Harder than Real, HotOS'05, Santa Fe, NM, June 2005
19. S. Garfinkel, An Evaluation of Amazon's Grid Computing Services: EC2, S3 and SQS, Technical Report TR-08-07, Center for Research on Computation and Society, Harvard University, July 2007
20. D. Goodin, Salesforce.com Outage Exposes Cloud's Dark Linings, The Register, January 6, 2009, http://www.theregister.co.uk/2009/01/06/salesforce- outage/
21. D. Goodin, Webhost Hack Wipes Out Data for 100,000 Sites, The Register, June 8, 2009, http://www.theregister.co.uk/2009/06/08/webhost-attack/
22. A. Greenberg, IBM's Blindfolded Calculator, Forbes Magazine, July 13, 2009
23. N. Gruschka, L. L. Iacono, Vulnerable Cloud: SOAP Message Security Validation Revisited, IEEE International Conference on Web Services, Los Angeles, CA, July 2009
24. M. Gunderloy, Who Protects Your Cloud Data?, Web Worker Daily, January 13, 2008, http://webworkerdaily.com/2008/01/13/who-protects-your-cloud-data/
25. Twitter Email Account Hack Highlights Cloud Dangers, Infosecurity Magazine, July 23, 2009, http://www.infosecurity-magazine.com/view/2668/twitter- email-account-hack-highlights-cloud-dangers-/
26. D. Jacobs, S. Aulbach, Ruminations on Multi-Tenant Databases, Fachtagung für Datenbanksysteme in Business, Technologie und Web, March 2007, http://www.btw2007.de/paper/p514.pdf
27. W. Jansen, Directions in Security Metrics Research, Interagency Report 7564, National Institute of Standards and Technology (NIST), April 2009
28. M. Jensen, J. Schwenk, N. Gruschka, L. L. Iacono, On Technical Security Issues in Cloud Computing, IEEE International Conference on Cloud Computing, Bangalore, India, September 21-25, 2009
29. Guide for Applying the Risk Management Framework to Federal Information Systems, Joint Task Force Transformation Initiative, Special Publication 800-37, Revision 1, NIST
30. B. R. Kandukuri, R. Paturi V, A. Rakshit, Cloud Security Issues, IEEE International Conference on Services Computing, Bangalore, India, September 21-25, 2009
31. P. A. Karger, I/O for Virtual Machine Monitors: Security and Performance Issues, IEEE Security and Privacy, September/October 2008
32. N. Katz, Austin Plane Crash: Pilot Joseph Andrew Stack May Have Targeted IRS Offices, Says FBI, CBS News, February 18, 2010, http://www.cbsnews.com/8301- 504083-162-6220271-504083.html?tag=contentMain%3bcontentBody
33. Y. Keleta, J. H. P. Eloff, H. S. Venter, Proposing a Secure XACML Architecture Ensuring Privacy and Trust, Research in Progress Paper, University of Pretoria, 2005, http://icsa.cs.up.ac.za/issa/2005/Proceedings/Research/093- Article.pdf
34. S. M. Kerner, Mozilla Confirms Security Threat from Malicious Firefox Add-Ons, eSecurity Planet, February 5, 2010, http://www.esecurityplanet.com/ news/article.php/3863331/Mozilla-Confirms-Security-Threat-From-Malicious- Firefox-Add-Ons.htm
35. S. King et al., SubVirt: Implementing Malware with Virtual Machines, IEEE Symposium on Security and Privacy, Berkeley, California, May 2006
36. B. Krebs, Salesforce.com Acknowledges Data Loss, Security Fix, The Washington Post, November 6, 2007
37. E. Kowalski et al., Insider Threat Study: Illicit Cyber Activity in the Government Sector, Software Engineering Institute, January 2008, http://www.cert.org/archive/pdf/insiderthreat-gov2008.pdf
38. M. Krigsma, Amazon S3 Web Services Down. Bad, Bad News for Customers, ZDNET, February 15, 2008, http://blogs.zdnet.com/projectfailures/?p=602
39. S. Labaton, 2 Men Held in Attempt to Bomb I.R.S. Office, New York Times, December 29, 1995
40. 20-Year Term in Plot to Bomb IRS Offices, Nation In Brief, Los Angeles Times, August 10, 1996
41. N. Leavitt. Is Cloud Computing Really Ready for Prime Time?, IEEE Computer, January 2009
42. R. McMillan, Salesforce.com Warns Customers of Phishing Scam, PC Magazine, IDG News Network, November 6, 2007, http://www.pcworld.com/ businesscenter/article/139353/salesforcecom-warns-customers-of-phishing-scam. html
43. R. McMillan, Hackers Find a Home in Amazon's EC2 Cloud, Infoworld, IDG News Network, December 10, 2009, http://www.infoworld.com/d/cloud-computing/ hackers-find-home-in-amazons-ec2-cloud-742
44. R. McMillan, Misdirected Spyware Infects Ohio Hospital, PC Magazine, IDG News Service Sept. 17, 2009, http://www.pcworld.com/businesscenter/article/ 172185/misdirected-spyware-infects-ohio-hospital.html
45. P. Mell, T. Grance, The NIST Definition of Cloud Computing, Version 15, National Institute of Standards and Technology, October 7, 2009, http://csrc.nist.gov/groups/SNS/cloud-computing
46. C. Metz, DDoS Attack Rains Down on Amazon Cloud, The Register, October 5, 2009, http://www.theregister.co.uk/2009/10/05/amazon-bitbucket-outage/
47. R. Miller, Major Outage for Amazon S3 and EC2, Data Center Knowledge, February 15, 2008, http://www.datacenterknowledge.com/archives/2008/02/15/major- outage-for-amazon-s3-and-ec2/
48. R. Miller, Lightning Strike Triggers Amazon EC2 Outage, Data Center Knowledge, June 11, 2009, http://www.datacenterknowledge.com/archives/2009/06/ 11/lightning-strike-triggers-amazon-ec2-outage/
49. J. Oberheide, E. Cooke, F. Jahanian, Empirical Exploitation of Live Virtual Machine Migration, Black Hat Security Conference, Washington, DC, February 2008
50. T. Ormandy, An Empirical Study into the Security Exposure to Hosts of Hostile Virtualized Environments, 2007, http://taviso.decsystem.org/virtsec.pdf
51. S. Overby, How to Negotiate a Better Cloud Computing Contract, CIO, April 21, 2010, http://www.cio.com/article/591629/How-to-Negotiate-a-Better-Cloud- Computing-Contract
52. S. Pearson, Taking Account of Privacy when Designing Cloud Computing Services, ICSE Workshop on Software Engineering Challenges of Cloud Computing, May 23, 2009, Vancouver, Canada
53. N. Provos et al., The Ghost In The Browser: Analysis of Web-based Malware, Hot Topics in Understanding Botnets (HotBots), April 10, 2007, Cambridge, MA
54. N. Provos, M. A. Rajab, P. Mavrommatis, Cybercrime 2.0: When the Cloud Turns Dark, Communications of the ACM, April 2009
55. Security Within a Virtualized Environment: A New Layer in Layered Security, White Paper, Reflex Security, retrieved April 23, 2010, http://www.vmware.com/files/pdf/partners/security/security-virtualized- whitepaper.pdf
56. T. Ristenpart, E. Tromer, H. Shacham, S. Savage, Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds, ACM Conference on Computer and Communications Security, November 2009
57. VMware Vulnerability in NAT Networking, BugTraq, Security Focus, December 21, 2005, http://www.securityfocus.com/archive/1/420017
58. A. Shah, Kernel-based Virtualization with KVM, Linux Magazine, issue 86, January 2008, http://www.linuxmagazine. com/w3/issue/86/Kernel-Based- Virtualization-With-KVM.pdf
59. T. Shelton, Remote Heap Overflow, ID: ACSSEC-2005-11-25 - 0x1, http://packetstormsecurity.org/0512-advisories/ACSSEC-2005-11-25-0x1.txt
60. M. Slaviero, BlackHat presentation demo vids: Amazon, part 4 of 5, AMIBomb, August 8, 2009, http://www.sensepost.com/blog/3797.html
61. J. D. Sutter, Twitter Hack Raises Questions about 'Cloud Computing', CNN, July 16, 2009, http://edition.cnn.com/2009/TECH/07/16/twitter.hack/
62. L. M. Vaquero1, L. Rodero-Merino1, J. Caceres, M. Lindner, A Break in the Clouds: Towards a Cloud Definition, Computer Communication Review, January 2009, http://ccr.sigcomm.org/online/files/p50-v39n1l-vaqueroA.pdf
63. K. Vieira, A. Schulter, C. Westphall, C. Westphall, Intrusion Detection Techniques in Grid and Cloud Computing Environment, IT Professional, IEEE Computer Society, August 26, 2009.
64. VMware Hosted Products and Patches for ESX and ESXi Resolve a Critical Security Vulnerability, VMware Security Advisory, VMSA-2009-0006, http://www.vmware.com/security/advisories/VMSA-2009-0006.html
65. P. Wainewright. Many Degrees of Multi-tenancy, ZDNET News and Blogs, June 16, 2008, http://blogs.zdnet.com/SAAS/?p=533
66. J. Wei et al., Managing Security of Virtual Machine Images in a Cloud Environment, ACM Cloud Computing Security Workshop, Nov. 13, 2009, Chicago, IL
67. L. Whitney, Amazon EC2 Cloud Service Hit by Botnet, Outage, December 11, 2009, CNET News, http://news.cnet.com/8301-1009-3-10413951-83.html
68. Xen Architecture Overview, Version 1.2, Xen Wiki Whitepaper, February 13, 2008, http://wiki.xensource.com/xenwiki/XenArchitecture?action= AttachFile&do=get&target=Xen+Architecture-Q1+2008.pdf
69. L. Youseff, M. Butrico, D. D. Silva, Toward a Unified Ontology of Cloud Computing, Grid Computing Environments Workshop, held with SC08, November 2008. http://www.cs.ucsb.edu/~lyouseff/CCOntology/CloudOntology.pdf
70. K. Zetter, FBI Defends Disruptive Raids on Texas Data Centers, Wired Magazine, April 7, 2009, http://www.wired.com/threatlevel/2009/04/data-centers- ra/