What is Cloud Computing?
Technology is progressing by leaps and bounds. It is now possible to access Your data anytime, anywhere, using a smartphone, tablet, laptop or desktop computer. To do this, all that you need is an Internet connection. This has been made possible due to advancements in the field of cloud computing.
In the simplest terms, cloud computing is the practice of storing and accessing data and applications using the Internet. ‘Cloud’ is a metaphor for the Internet. When you use a cloud service, (such as Google cloud) your data is stored remotely on a server (referred to as ‘cloud’) that is managed by the company whose cloud service you are using. Therefore, in case of Google cloud, your data is stored on a Google server and not on your local hard drive. Some of the leading companies providing cloud services are Microsoft (OneDrive), Google (Google Drive), Apple (iCloud), Dropbox, and so on.
Nowadays, cloud is a part of almost everything on your computer. It is integrated to your operating system, applications and other services. For example, you may have used Microsoft Office 365 or Office Online (web-based). These are examples of cloud computing that utilize an instance of cloud, i.e., storage (One Drive). You can save your files online using cloud applications and later on share them with other users or choose to work together simultaneously using one of the integrated cloud services.
The reason why cloud computing came into existence was because the innovators wanted to make data access affordable for everyone—small companies, large companies and individual users. Some companies have a large amount of data which requires data mining and information extraction at regular intervals. But, not all of them can invest heavily on computer infrastructure that is needed for processing huge volumes of data. Therefore, renting resources from a cloud provider and outsourcing some of the processing to it seems like an affordable option.
Cloud providers rent out a limited amount of storage space on their servers to their customers that can be accessed from anywhere on any device using an Internet connection. Cloud is an easy way to transfer large files. Most cloud providers charge a fee for using cloud services such as storage, databases, networking, analytics, etc., depending on the usage.
Cloud Computing Architecture
A number of components and sub-components are needed to implement cloud computing. When these components work in sync, users are able to benefit from multitude of services provided by cloud companies.
The front-end platform typically consists of desktop and web-based applications. This is the client part and it includes the interfaces and applications that are used to access cloud computing. The back-end platform refers to the actual cloud. It consists of servers for storing large volumes of data and all other resources that are used to provide cloud computing services. It includes virtual machines, security mechanism, deployment model and other resources. Lastly, a cloud-based delivery is accomplished using a transmission channel; such as Internet, Intranet or inter-cloud. Together, these components make up the cloud architecture.
Cloud implementation uses following four architecture types:
Private Cloud: This type of cloud supports private storage (hosting or computer space) which can be both remote and local depending upon the database storage of the company. Companies that have sensitive or fragile data opt for this service. To provide extra security features to this storage, it is either managed internally by the company or is outsourced to a trustworthy vendor.
Public Cloud: A public cloud is the most common type of storage that is used. Most of us as individual customers have used this type of cloud service. It is operated remotely, owned by a cloud service provider and shared by multiple resource tenants. It is a remote storage service.
Community Cloud: A community cloud is a collaborative effort in which storage is shared between several companies having common concerns, such as security, compliance and jurisdiction. This cloud is also known as a semi-public or semi-private cloud. It can have either local or remote storage depending on the agreement between the companies sharing them.
Hybrid Class Cloud: A hybrid cloud is a combination of two or more different types of cloud architectures, which retain their originality but are linked through a shared standard or technology. This enables flow of data between different cloud structures (depending on the computing needs and cost) while keeping their original benefits intact. Businesses derive greater flexibility and enhanced data deployment options by using hybrid cloud.
Cloud Computing Services
Cloud computing services are provided on demand to users over the Internet. The cloud service providers use their own servers to provide this service unlike a company using their on-premise servers. There are different types of cloud services which may or may not be necessary for end users, but are of significant use to software developers. A fair understanding of cloud computing techniques helps to make an informed choice at the time of availing cloud services. The most prominent cloud services are related to infrastructure, storage, software and platform. Let us discuss these one by one.
Some of the commonly used cloud services are:
Infrastructure-as-a-Service (IaaS): This is the most commonly used cloud service. It includes virtual servers, storage disks and networks and provides a basic (remote IT) structure to an organisation which is manageable and flexible. Customers can access and use the storage space that is provided using their handheld devices, such as smartphones to store data, including pictures, videos and music on the cloud. Some of the companies that offer Infrastructure as a Service (laaS) include Amazon, FlexiScale and Rackspace.
Platform-as-a-Service (PaaS): This is a cloud-based development platform designed for developers to build, run and manage applications over the Internet. The PaaS infrastructure is built and managed by the cloud service provider who provides the software and hardware tools required for application development -as a service. Some of the popular PaaS service providers are IBM BlueMix, Microsoft Azure and Cloudbees. Developers can run an operating system, database, or write code and execute that using a programming language. The platform gives the developers the flexibility to focus on the applications they are running on the cloud service. The cloud provider deals with the complexities of maintaining and building the infrastructure to run these applications.
Software-as-a-Service (SaaS): Software as a Service means that the users can access different software present on cloud on a pay-per-use-basis. This is a very useful service as software licenses are prohibitively expensive and it is not possible to license all such software. This is where Saas comes in. It provides access to a multitude of software which provide more or less the same functionality similar to their licensed counterparts. For example, Google Docs provides almost the same functionality compared to Microsoft Word which is expensive to license.
Working of Cloud Computing
Whether you are an executive or an employee, student or teacher, company agent or customer; being an avid Internet user, you must have experienced cloud computing even without explicitly opting for it. Anything which allows you to store and manage data on a remote network is a cloud service. For example, Gmail and Yahoo are examples of cloud services; where emails are stored on servers managed by cloud service providers and accessed by users on their local machines.
In order to understand the working of cloud architecture, let’s imagine it as an online safety deposit box. Individuals and enterprises view cloud services not as third party, but as trusted cloud providers who hold the custody of the data. They are like secure bank accounts and can be accessed from anywhere at any time. People store data on cloud which is valuable to them but is hard to carry everywhere, for example original music, pictures, projects, etc. Interestingly, even if the device that is used to access cloud is lost, data is still secure. The best examples of cloud services that are in use today are Google Drive, OneDrive, iCloud and Dropbox.
The advantages of using cloud computing are:
Universal access: Cloud computing supports mobility, therefore, files can be accessed from anywhere. For employees, this facilitates work from home and business trips without having to carry the files with them all the time. Employees can collaborate and work on the same document simultaneously without being in the same place. This increases productivity and the speed at which information is exchanged.
Increased storage capacity: In the past, the amount of data allowed to save was dependent on the device capacity. If we ran out of memory, we would need USB support to continue working. Cloud computing has increased the storage capacity by leaps and bound; so, you do not have to worry about limited hard drive space of your computer.
Can be easily set up: Setting up a cloud service is a matter of minutes. Customizing settings options, such as password creation and selecting the devices you want to be connected to is equally easy. Cloud providers also provide instructions that can be followed to easily update cloud from time to time. Cost effective: As we discussed, if cloud was not there, users would have had to invest heavily in storage media, such as flash drives and external hard disk drives. The constant risk of losing data in case of hardware crash would also have been there. With the advent of cloud services, there is no risk of losing data and the cost is negligible.
Flexibility: Cloud offers scalability in terms of storage size that allows you to change the storage size depending on the requirement in a short span of time. For example, if you are planning to go on a vacation, you can increase your cloud storage size so that you have enough space to store your vacation pictures and videos. After returning, you can save these back to your hard drive and recover storage space on your cloud account. Therefore, you do not need to worry about data loss in case a memory card gets corrupted.
Associated Threats to Cloud Computing
A cloud network is accessible to users and multiple other networks. This makes it vulnerable to threats originating from computers following the same or different architecture. Therefore, it is important to be aware of the kinds of threats that are posed and take necessary precautions so that we are ready to face these threats. In this regard, it is all the more important to choose the right kind of cloud service provider.
Users store a lot of personal information and sensitive data on their computers and this information is now being stored on the cloud. The data stored on the cloud is valuable to individuals with a malicious intent. Therefore, it is important that users find out and evaluate the security measures that their cloud provider has in place. Additionally, users must adhere to the safety checklist and take precautions to secure their data.
The types of threats associated with cloud computing are:
Data breach: Data breach can happen when data is stored locally or on cloud, but if cloud data is compromised it is far more severe. In order to prevent this, cloud provider ensure that their network is highly secure and the security protocol that is implemented is regularly updated. This is done remain ahead of the newer and threats are cloud data breach places at risk multiple enterprises and their user data. That is why hackers prefer to attack a cloud system rather than standalone machine. The recent AshleyMadison.com breach compromised valuable data of their users.
Data ownership and control: The chances of a data breach are significantly higher if the management of your organization’s data stored on cloud is outsourced to a third party provider. Issues such as geographical location, backup processes to ensure that data is protected are now outside the control exercise by your organization. When users place their data on cloud, the cloud service provider gets access to their confidential data consequently, ownership is compromised and it may impact compliance control and requirements.
Data loss: No matter where your data is stored the impact of permanent data loss is huge. It has the potential to affect an organization financially, legally and operationally. Data loss would also lead to failure in satisfying compliance policies and protection requirements. Additionally, natural disasters, technical failures and data purge also affect cloud computing the same way as they affect a standalone system.
Malicious attacks: Hackers or authorized users with malicious intentions can attack and abuse cloud storage for conducting illegal activities or monetary gains. This includes storing and spreading copyrighted documents, pirated software and viruses. Cloud resources have become prone to malicious injections. Such as running a malicious code on the cloud after gaining access through illegal means.
Insider threat: The possibility of an attack originating from within your organisation is less compared to external threats; but these threats are real and have become prominent over the years. They have resulted in the misuse of confidential information belonging to many customer and/or organisations. Assigning incorrect access levels to users and delay/neglect in revoking access to attrited employees can result in organizational data getting exposed to people who should not have it.
Loopholes in technology: Every technology has some deficiency which is exploited by the hackers whenever it is exposed. A loophole in the technology that forms the backbone of a cloud network has the potential to exposes the entire cloud and its users to hackers. For example, there was a massive ransomware cyber-attack (originating in US) that took place and affected almost 99 countries including India. Almost 45,000 attacks were registered which compromised the data and finances of many organisations.
Shared space: Since cloud is a shared space, multiple users share and store data on a single server. One user getting access to the data of another user using the same technology cannot be totally ruled out.
Safety Measures Against Threats to Cloud Computing
Data servers of the cloud providers are scattered all over the world and are governed by different privacy and cyber laws in different countries. There is not a single law that governs these data centres, therefore, in the event of data loss, it will be impossible to decide which country’s laws are applicable for prosecution as your data could have been stored across multiple locations. So, we are left with the basic ways of prevention and precaution for safeguarding the information shared on cloud.
Some of the precautionary measures to protect cloud data are:
Backing up data: It is important that we create a backup file locally for the confidential data stored on the cloud. This will help to create a dual backup, one that is stored locally and other one that is on cloud. Therefore, if either of them is lost due to any reason, we can still have another copy to rely on. If the users don’t prefer local backups, then they can also create a backup on another cloud. Losing data from both cloud systems simultaneously is an extremely rare scenario.
Understanding the cloud provider’s user agreement: In order to safeguard your data, before selecting a cloud provider, it is better to go through the user agreement. Though this step of setting up your cloud account suffers from insufficient attention, it can contain something which makes you change your mind and go to another provider.
Updating the Backups Created: We might suffer data loss even after taking a backup. This is because the backup is not taken on a regular basis and any changes made after the last backup are not recovered. Therefore, it is necessary to keep taking backups on a regular basis.
Password protection: Cloud users need to understand the importance of strong password protection for their files. Creating long passwords containing a combination of alphabets, numerals and special characters is the best way to keep your account safe from hackers.
Two Step Authentication: Some cloud service providers like Google provide an optional two step authentication feature. If it is enabled, each time you log in to your account, the system sends a one-time password on your registered mobile number. You need to authenticate your credentials by entering the password on the screen. Upon successful authentication, you will be able to access your account. This provides another layer of security on the cloud.
Encryption and Decryption: Some cloud service providers encrypt the data stored on cloud. Encryption provides total protection for your data. Unless you lose your encryption key or a hacker manages to decrypt the encrypted data (which is extremely difficult), your data is absolutely safe. Encryption is the process of converting the data saved on the cloud (using a defined algorithm) into a format that is not human readable. It can be read only after decrypting it. Data in encrypted format cannot be accessed even by authorised users without providing the decryption key. Users can encrypt the data and then store it on cloud to add another layer of security.
Disciplined online behaviour: Whenever you access cloud from a public terminal, never save your password on the web browser and always remember to logout. No amount of data security or protection features will be effective if users lose their passwords to an attacker due to carelessness.
Avoid cloud networks for storing sensitive information: The easiest and guaranteed way to keep your data safe is by not uploading it to a cloud. Personal details, such as social security number, passport details, credit card information, intimate and private pictures etc., should not be uploaded on cloud. It is strongly recommended to store this kind of information on an external hard disk in a secure physical space.
Issues Related to Cloud Privacy
With the advent of cloud technology and its many benefits, a lot of users are opting to share, promote, store and manage their data online; without fully understanding its implications. If a user wants to store personal data on cloud then lack of due diligence before this migration can lead to data loss. A common misconception about cloud is that it is completely private and free from attackers. This is because users feel that they have complete control of the data that they store on cloud; whereas the cloud itself is out of their reach. Cloud servers are the properties of service providers and they can access the data stored on it anytime they want. These servers are spread across the globe and user data is not stored on a single server.
Many factors are responsible for ensuring cloud privacy:
Data ownership issues: Irrespective of what is claimed by the service provider, a layman is always unsure of the ownership of data once it is uploaded on the cloud. For example, if a user takes a picture and uploads it on the cloud, the copyright may become invalid in certain cases. A cloud provider can access this picture which may be valuable to the user, and might use it for its own benefit. Therefore, one should avoid uploading any important data of financial, emotional and legal nature on cloud.
Location of The Data: Data centres are located all around the world. It is impossible to guess in which location your personal data is stored. Every country has different cyber laws and laws governing data privacy. Therefore, your data can be stored in a place where the laws are contradictory to your rights and could conflict with the laws prevalent in your country. Google and Microsoft have admitted that some of the countries where their data is stored have summoned them more than once to get access of the information of their users. Users should be extremely cautious while uploading crucial data on cloud if the data centre of the service provider is in a foreign land.
Data migration: Data can be transferred from one data centre to another for security reasons or routine maintenance. This can also happen due to excessive information storage at any one centre. Data migration can cross geographical boundaries of nations and hence be subject to the laws of more than one country. Post migration, the current data centre may or may not subscribe to the privacy agreement that was signed with the customer at the time of setting up the cloud account. Due to this, a user suffers from a host of privacy issues which are needed to be considered before transferring data onto a cloud.
Permanency of data: Users keep on creating new data every day; because of this a lot of data is uploaded and stored on the cloud. There is no way to decipher if data that is deleted from cloud has been permanently deleted or can be restored. A lot of cases of revenge porn have arisen due to this feature of cloud.
Handling Cloud Privacy Issues
As discussed in the above section, apart from many security concerns there are also many privacy issues which need to be examined before choosing a cloud service provider. Privacy issues, if not handled carefully can expose a user’s data to wrong hands.
Following measures should be applied to keep your cloud data private:
Encryption: Users need to encrypt their private and personal data if they are uploading it to a cloud. The encryption technique used for data security can be applied for data privacy as well. This is because encrypted data will be useful only to those users who have the key to decrypt it. Therefore, it is advisable to choose a cloud service provider that offers encryption. Users can also encrypt the data on their own before uploading to cloud to create an extra layer of security.
Understanding the Terms and Conditions: Going through the terms and conditions might be a tiresome task for many users, but it is one of the most important steps that should be followed before setting up your cloud account. The standard practice of blindly agreeing to the terms and conditions without even reading them can put your data at great risk. This is because in case of any failure the service provider can easily cite these conditions and user may not have much of a legal recourse. Some service providers also have clauses related to access rights towards any data which is being stored on the cloud. This is a part of the terms and conditions. It is worth taking out time to read the terms and conditions carefully as it helps to save time, money and energy if an unexpected event happens later on.
Avoiding sharing information on cloud: Some clouds allow users to share their information with other users of that cloud. People share pictures, videos, music etc. with their friends by giving restricted cloud access. This is a practice that can be exploited. Avoid sharing information on cloud to safeguard your privacy and avoid cyber bulling.
Avoid using cloud for storing sensitive data: Personal information, sensitive images, videos and audios should not be uploaded to a cloud. Edward Snowden, the NSA whistle-blower, had intercepted intimate pictures of people that were being examined and shared by NSA agents just for some cheap fun. This may not have caused any harm but it certainly undermined the dignity and privacy of those whose pictures were monitored.
Selecting a Cloud Service Provider
Selecting the right service provider is very important. This is because data security and data privacy are of primary importance to a user. It is always safer to choose a cloud provider that encrypts the data that you store on cloud. Before signing up for a cloud account, you must carefully review all the terms and conditions to understand your rights. In some cases, there are specific clauses that talk about rights to access the Mara that is stored on cloud.
Every cloud service is created to cater to different needs of the users. Some users use cloud to store music, pictures and videos while others use it for hosting blogs. Enterprises often use cloud to satisfy multiple commercial requirements. Before selecting a cloud service the user must examine and analyse the following Issues:
Space: Users need to perform an evaluation of their needs and amount of cloud storage needed to store their data. If they end up buying extra space it might cause a strain on their finances, whereas, buying less space would mean adding chunks of space later, which can cost more. Therefore, it is important to calculate the optimum amount of space that is required.
Finances: Users need to work out their finances and decide how much they are willing to invest for a cloud service. It is advisable to check the offers from multiple service providers and compare the cost and benefits of each of them. Following this, depending on the requirement and the cost involved (keeping in mind your budget), you will be able to make an informed choice. Some service providers provide online cost calculators for their clients, such as Google, Microsoft, Rackspace and vCloud.
Access to the cloud’s customer service: Generally, users don’t have any control on the cloud. When faced with a problem there is nothing much that they can do on their own. Therefore, it is important that that the service provider that is selected has a responsive customer service.
Review of previous and existing users: Getting a neutral opinion is always helpful and reliable. There are a lot of sites which review various cloud platforms. By going through these websites, users can get a fair idea about the feedback received regarding different cloud providers. This can be helpful in choosing the right kind of cloud provider.
Security features: The service providers must have standard security features to protect the data being stored with them. Therefore, it is important to review these features beforehand which are described under different clauses in the user agreement or other terms and conditions signed with the customer.
Data loss management: Data loss management is integral as it raises many questions about what will happen if such a situation takes place. It is always helpful to know the history of data loss tackling of any service provider to get an idea about their past course of action and how they are likely to proceed in such a scenario.
Location of the data centre: A country with privacy laws that conflict with the laws prevalent in your country can adversely affect the security and privacy of your data. This can happen if the data centre holding your data happens to be located in one such country. Therefore, it is important to know in which country the data centre of your service provider is located. After knowing this, you will be able to assess the legal implications related to data security and accordingly take a decision about the service provider.
Number of failures in the past: if a cloud company is prone to failure, then that company should be avoided in order to safeguard your data. The understanding of this issue at last might take you to the correct service provider who can offer all your requirements.