How to reduce security risks of cloud computing

We have given some assignments for the cloud computing. I am having very bit knowledge about it, so I have prepared some notes which contains some basic concepts of cloud computing. As is often the fear caused by skepticism from the new: there are rumors and there is lack of education. But who knows what threatens security vulnerabilities and how to protect yourself. But the main thing that we are told to do is mention some steps that can be useful for reducing the security risks of cloud computing. Now frankly speaking, I am not having any ideas about it. So thought that posting here would be useful. Please provide some information about how to reduce security risks of cloud computing? I am expecting that some members hanging out there will help me soon. :notworthy

Quote:

---

As is often the fear caused by skepticism from the new: there are rumors and there is lack of education. But who knows what threatens security vulnerabilities and how to protect yourself.

---

Be less afraid, because the risks can be reduced to a minimum. Even from provider to provider or analyst to analyst different definition of the Cloud lead to serious misunderstandings: Mostly it's about a displacement of the ICT resources of local computers to the public, insecure Internet. But must necessarily be so? Here it is, in principle, between public ("public") Clouds Amazon and Google as well as dedicated ("private") to distinguish clouds for company. The former are primarily suitable for home users, for example, to receive mail anywhere and send files or photos or vacation comfortable on hard drives to store the power. They usually cost nothing, but also its operators agree to anything. In a server failure, users must wait. Breaks a mail server or a disk, the data is gone. Security and service agreements - nil.

No risk, no fun? What's in the private lives more and more, is contrary to the clear demands of the business world. From the data security, protection against manipulation and high availability often depends on the survival of a company. Worldwide, most firms stood for over a week without their IT data from ruin. As well as a great financial loss usually suffers the image, if information leaks about a new product development before its official publication to the outside. Companies should therefore refrain, despite the high flexibility and the pure consumption-based rather pay the cloud? The answer lies in the "private" cloud, a cloud, and compromise their own connection to a data center. This is where the data is not over the public Internet, but over the tunneled network of the provider.

The biggest challenge for companies in the cloud computing is to find the right service provider. You need to deal with this, intensive services offered by them and its actual performance. Can he serve as individual needs? How good it is familiar with industry-specific requirements? Large ICT providers providing the same services for a variety of customers. With the resulting economies of scale they can use technology that would hardly affordable for a single company. It would also staff with the right skills hold and update the knowledge of employees regularly in training. About the provider they buy the professional and industry know-how with the same one. This is particularly noticeable in the security pays off. The attackers usually know perfectly with the latest tools. keep up here, requires a considerable financial and human effort.

However, companies should not I get the whole security providers simply push on, but at first hard about him with the necessary level of protection to deal with. The service provider must explain the risks to its customer and tell them what they are doing specifically, however. Only from a thorough risk analysis can derive a custom solution that meets all safety requirements. As with traditional ICT environments ranging in cloud computing, the selective feeding of security vulnerabilities is not sufficient. On the other hand, does a company need not necessarily use all available security technologies on the market, but it can from a reputable provider modular whole relationship as needed. Subsequent periodic risk assessments and audits to supplement in the form of a penetration test, this holistic approach. This allows to find new vulnerabilities and adaptation measures quickly. The exact selection and continuous updating of the security measures currently in cloud computing is very important, since increases with the high degree of decentralization and distribution of applications and data, the number of attack vectors and threats. If the safety requirements laid down precisely, they can agree on service level agreements consistently in contract, from production in the data center via the network by PC or mobile device at the user company. In our own network, the service providers ensure compliance with the SLAs in the cloud. So the customer can assess the quality and reliability of the ICT service objective. The fact that a special, central place all operations - implementation, configuration, release, update and patch management , backup etc. - Checks and controls, facilitating compliance with the security measures as well. Only then can they engage effectively at all levels as cogs. This allows, ultimately, even the safe integration of mobile devices in the cloud.

Despite many similarities in terms of safety, the virtual cloud is compared with the traditional outsourcing some special requirements. This applies, for example, data protection: As the data center several companies servers share the resources they need to assign them, certainly must be that no one can gain insight of the other data in the. This occurs on a clean separation of applications and data of each customer. Made possible by the so-called virtual local area networks (VLANs). This all-new Cloud customer automatically receives a separate connection to the server. The calculator has therefore be the individual over any number of access routes. The administration of VLANs is done with a central switch ( switch ). This is where all network cables. The switch automatically assigns each VLAN to a particular customer. This may work only in its own area. VLANs are completely isolated from each other. Someone with evil intentions, so the switch would not have access to another. The box itself should be partitioned into several units, of which every customer receives a disk along with VLAN access. You can not therefore jump from their partition to another company. This allows, for example, SAP and Oracle applications running on a shared server - mixed up. In addition, should the computer be completely decoupled from the public Internet. Web applications, such as online bills, then run in separate service areas. This prevents attacks via the Web to business-critical applications.