RISK ANALYSIS & SECURITY RECOMMENDATIONS OF MOVING EDUCATIONAL INSTITUTIONS TO CLOUD IT INFRASTRUCTURE
RISK ANALYSIS & SECURITY RECOMMENDATIONS OF MOVING EDUCATIONAL INSTITUTIONS TO CLOUD IT INFRASTRUCTURE
ABSTRACT
Cloud computing brings for higher educational institution a wide range of benefits with new capabilities to incorporate in the educational process. However, the cloud services are vulnerable to a variety of security challenges. One of the key challenges that educational institutions face in adopting cloud computing technologies is a provisioning of a secure cloud infrastructure.
This paper discovers some cloud benefits in the education sector and discuss limitations of main cloud services as well as highlight security challenges that institutions face when utilizing cloud technologies. The paper provides baseline recommendations to avoid security risks efficiently when adopting cloud computing in institutions of higher education.
INTRODUCTION
The importance of Cloud Computing is increasing and it is receiving a growing attention in the scientific and industrial communities. Cloud Computing enables ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud Computing appears as a computational paradigm as well as a distribution architecture and its main objective is to provide secure, quick, convenient data storage and net computing service, with all computing resources visualized as services and delivered over the Internet. The cloud enhances collaboration, agility, scalability, availability, ability to adapt to fluctuations according to demand, accelerate development work, and provides potential for cost reduction through optimized and efficient computing.
http://www.jisajournal.com/content/4/1/5
There can be numerous definitions available on cloud computing. A comprehensive definition is given by National Institute of Standards and Technology states that “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction”. From the definition we can say that cloud computing has following characteristics:
- On-demand self-service.
- Broad network access.
- Resource pooling.
- Rapid elasticity.
Cloud computing plays an important role in improving the quality of education to achieve required performance by offering many benefits for education. The cloud services and applications enable users to store and access their local data in the remote data center by using their personal computers, or mobile devices. In higher educational institutions, the stakeholder term refers to anyone who has access to educational services, including students, lecturers, researchers, staff members, etc.
There are various advantages may be granted when adopting cloud computing technologies in higher education institutions. Some universities have adopted cloud computing in their programs for economic purposes, while other institutions use the cloud to provide scalable and flexible IT services.
The benefits of cloud computing solutions over traditional technologies are:
- Mobility: Nowadays students extensively use mobile devices to access data. Students want to refer textbooks, syllabi and even do their homework online via their Smartphone, laptop or tablet. Cloud-based classroom applications are the best way to facilitate this exchange between student and faculty.
- New Services: Many colleges and universities today are starting to offer virtual classrooms via online learning and video conferencing. Cloud servers allow institutions to offer these innovative teaching methods that can be accessed by students from anywhere via tablets, computers or mobile devices.
- Storage: Scalable cloud storage offers colleges and universities the ability to quickly expand storage capabilities. HE institutions have huge data to contend with, including everything from student and faculty information to course material. This data can quickly overwhelm traditional on-site storage options. Additionally, if a natural disaster happens or if a server fails, colleges and universities can quickly lose data that may never be retrievable again. Cloud storage also offers business continuity and disaster recovery.
- Efficiency: Institutions of higher learning are looking for new ways to make their organizations more efficient.
https://core.ac.uk/download/pdf/82674946.pdf
Even though the great benefits of using cloud computing in educational institutions, there are some challenges that hinder the wide scale adoption of this technology in various sectors of the university. In the current circumstances, it is not easy to track the variety security issues in cloud computing environments. The security issues are related mainly to three key requirements: confidentiality, integrity, and availability.
The confidentiality is defined as a set of rules that prevent unauthorized user from accessing sensitive information, while integrity is a way to protect data from being modified by unauthorized user and ensure that data are retrieved accurately and trustworthy, and the availability concerned with enabling authorized users to access data reliably when needed, especially during difficult circumstances and emergencies.
LITERATURES REVIEW
In the past few years the concept of “Cloud Computing” has emerged as a viable and promising solution to the challenges associated with shrinking IT budgets and escalating IT needs. Cloud Computing is a model for enabling convenient, OnDemand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Users can access these resources from any computer with a high-speed Internet connection while having no other connection to the hardware that holds the source software. Because computation takes place on a remote server, the user’s hardware and software requirements are much lower than they would be otherwise, reducing both cost and maintenance requirements. For this reason, Cloud Computing holds appeal for HE institutions seeking to reduce IT budgets.
Today’s students do not know a world without the Internet. Through programs such as Facebook, Twitter, Gmail, and Flickr, students already are well versed and frequent consumers of cloud-based technologies. Accordingly, they expect to have 24/7 access to digital technologies in their educational environment, including cloud technologies which support social media. In addition, cloud-based solutions can be very effective in supporting collaborative and cooperative learning as well as other socially oriented theories of teaching and learning. With the opportunity to facilitate these student needs, coupled with the cost-savings,
Cloud computing ensures that learning institutions do concentrate more on research and learning, rather than on implementing complex IT infrastructure. The cloud computing applications related to education will form the basis of future IT infrastructure in education to ensure the development of hardware and software environment. By integrating the resources through cloud computing, it will be possible to meet the high demand by utilizing the high speeds involved in processing the data thus reducing the pressure associated with the information explosion.
Cloud computing is used in the education sector for hosting learning management systems (LMSs) e.g. Moodle and Blackboard within the cloud. Most institutions outsource the providers of the LMSs due to the high costs involved in the establishment and maintaining such systems. In today’s world e-learning has been adopted at different education levels including training for firms, lifelong learning, as well as in academic units; E-learning solutions range from commercial to open-source. There are two main entities of the e-learning system including trainers and students. The students get to access exams, courses, and can relay their assignments online, whereas the trainers can relay tests manage courses and evaluate homework and assignments for the students and the two parties can communicate with one another.
Despite the advantages associated with cloud computing, there are also various drawbacks which should also be considered. The most critical concerns relate to vendor lock, latency, reliability, security, control, performance, as well as privacy. Organizations may hesitate from surrendering the control of their IT resources to external providers may end up changing the existent technology without the consent of the customers. Thus, because the users do not have any control over the servers, they depend on the provider to manage and update their software.
Additionally, there exist valid privacy and security concerns. Cloud service implementation on a large scale may not be possible until legal matters relating to data protection and privacy are addressed. Vendor lock, as well as failure is also another concern of cloud computing. Proprietary APIs are used by several cloud providers to proffer their services. As the number of providers increase, portability is bound to become more important. Further, if a provider who owns the data center where a user has saved his/her data fails, there ought to be adverse repercussions to the user.
https://arxiv.org/pdf/1706.01136.pdf
LIMITATIONS IN CLOUD SERVICE MODELS
This section focuses on some limitations related to cloud service models that disserve adopting cloud computing in higher educational institutions
Limitations in SaaS: Two key limitations may effect on deploying applications under SaaS model: data locality, and integrity. Generally, the user does not know where the service provider stores data and how can be assured that no one can modify it. The lack of trust between cloud user and provider is a critical issue that should be addressed when using SaaS. As a result, to avoid data leakage in the educational institutions the computer center in the university may host the SaaS application on its own private server or deploy it on infrastructure services provided by trusted third-party provider such as Amazon, Google, etc. For these reasons, most of higher educational institutions involved in this survey are using a private cloud, rather than public or hybrid cloud.
Limitations in PaaS: Although PaaS platforms provide flexibility for developers in educational institutions to accelerate development of new SaaS applications and migrate them to the cloud. However, the developers might face some challenges when using PaaS platforms. First, the cost is increased due to adding some new features enable developers to add and control own cloud-based applications. Another serious problem that faces PaaS users is lock-in programming models and high-level services with the vendor who provides service. These models and services are depending on particular environment and need to be completely rewritten when migrating to another PaaS environment. This less portability reduces user’s freedom to migrate to another platform. On the other hand, despite the fact that developers are able to build and control their applications on top of the platform, but they don’t know any think about security below the platform which still is assigned by the service provider.
Limitations in IaaS: Compared with first two service models, IaaS provides for user better control on security issues. The main factor should be considered the reliability of stored data in the provider’s resources. The duty of IaaS model security is divided between service providers and their customers. The provider’s responsibility involves main security controls such as physical and virtual environmental security. In turn, the cloud user is responsible for applying the suit security controls associated with software including operating system, developed applications and data. Virtualization technology is a fundamental of IaaS model. In a virtualization environment, when users are utilizing the shared infrastructure resources, this may lead to a cross-tenant attack. In this case, the attacker gains root-level access and then penetrates most of the tenants’ accounts in the cloud.
SECURITY CHALLENGES AND RISKS
Organizers in education sector are wishing to use cloud services that are not radically different from those services that totally managed within their own centers. However, they are in fact facing a range of substantial new challenges. This section addresses the critical security and privacy-related challenges and risks in cloud computing. To understand and successfully address the cloud security issues and its challenges in higher educational institutions, we need to investigate various aspects of cloud challenges such as threats, risks, and attack models. Challenges in cloud computing are categorized into four main aspects; Network, Access control, Cloud infrastructure, and Data Security.
Network Security
In this category, we are discussing security-related issues of a transmission medium through which the user can connect to cloud infrastructure. Provisioning secure medium prevents leakage of sensitive information during transmission. The most security challenges are associated with the network used as long as cloud-computing operations are totally depending on networks by which the users migrate their data to cloud servers. As data are stored at the remote cloud server, the service provider has to provide for users a protection way to keep data in safe from a traditional network-based attack such as DoS, Man-in-the-Middle attack, IP spoofing, packet sniffing, port scanning, etc. Table 1 below describes most of the possible attacks threaten cloud computing services. With regard to the risks of network security in a cloud environment, hacking and intrusion are increased. This requires the use of strong network security techniques such as Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols. Furthermore, adequate rules in firewall router, auditable access rights, and some security policies must be implemented to secure system and avoid service hijacking.
Access Control
Access Control includes important security issues such as authentication, identification, and authorization. Since authorized users have access to the cloud via Internet, this increases security risks in cloud computing. The insecure interface of the web application is vulnerable to expose an educational institution to unauthorized access. Furthermore, weak authentication mechanism might increase the possibility of an unauthorized access to data or services which are globally accessible and shared with other users through the multi-tenancy cloud. For this reason, using strong authentication mechanism is a basic and mandatory requirement for any cloud system to ensure the privacy of user information and data stored on a cloud provider’s server.
The primary responsibility of the service provider is to protect cloud service and user data against unauthorized access. In current best practices, some good security solutions are recommended to avoid penetration such as VPNs technology, Privileged Access Management, Next Generation Firewalls, etc.
Cloud Infrastructure
This category entails issues related to the physical equipment used as a backbone for cloud infrastructure as well as the virtual software used to operate cloud resources. The cloud infrastructure involves main features of cloud service models and is particularly associated with virtualization environment. Virtualization is a fundamental technology used by cloud vendors to achieve multi-tenant architecture, where it divides the computing resources of cloud server into multiple execution environments. The virtualization-based cloud is not safe due to multi-user shared environment, where all virtual instances are on the same physical machine. One of the virtualization security challenges faces cloud system is a lack of VM protection, because multiple VMs located on the same computer, you cannot put a hardware protection device such as a firewall between them. Another challenge is due to a dynamic environment where VMs are created, terminated, or moved to another place automatically, which make very hard to monitor traffic and determine if the attack is accruing.
Common attacks that might threaten cloud infrastructure are Theft-of-Service, DoS, Malware Injection, Cross-VM Side Channel, Phishing, Botnets, and VM rollback attack.
Data Security
Data Security risks constitute the biggest challenge for adopting cloud computing in higher education institution. Some institutions still prefer to store their critical data into own repositories instead of moving them to a remote cloud. The cloud service providers have to prove to customers their ability to deal with various challenges related to data security. Several security issues have been identified and classified according to data states in the cloud: Data-at-Rest and Data-in-Transit. Data at rest refers to the data stored in the cloud servers, which need to be protected and to validate that an unauthorized user has not altered the data stored in the cloud. Especially, when data stored far away with no physical control over it such as in public cloud. In the state of Data-in-Transit, the possibility of data loss or leakage occurring is increased when travelling from one location to another. The major risk might face data security is the use of inappropriate encryption protocol and weak key in the cloud environment.
RECOMMENDATIONS:
The main barriers to cloud computing adoption are security and confidentiality of data concerns, privacy and regulatory compliance concerns, and reliability of the service provider. Overcoming these concerns requires not just preventive and immediate solutions but also proactive and forward-thinking approaches.
Techniques and guideline to overcome the barriers of cloud adoption:
Reliability and availability: To ensure that the services in the cloud are reliable and up and running well at all times, reliable cloud vendor is required. The chosen cloud service provider should be one that guarantees service level, uptime and availability 99% of the time. The chosen vendor should have redundancy of power, cooling systems, security system, servers, storage, excellent Internet connection, and fire suppression systems among other things to ensure that the required services are consistently and constantly available.
Providing security in the cloud: The university must be assured of tight, well-defined security services in the cloud before they employ the services of any vendor. These security services include identity management, access control as well as authorization and authentication mechanisms to ensure the right level of control within the cloud environment and that only authorized personnel can make any changes or additions to the data and applications in the cloud as a way of ensuring the security, privacy, and confidentiality of data. The service provider should have a comprehensive security infrastructure in place at all levels of the services they provide.
SLA management: The cloud vendors should give guarantee by providing service levels for all services they are offering and ensure to meet the requirements of the SLA. The SLA should be negotiated to meet the expected level of service quality and should include refund guarantees or some kind of penalties if the promised service level is not delivered. This will keep the service providers on their toes to meet up with the terms and requirements of the SLA and the clients assured of quality service delivery. Also, the copyright laws as contained in the vendors’ SLA and that of the location where the vendors’ infrastructures are located should be carefully considered before commitments are made.
Encryption: This is the process of changing or transforming information into a form that cannot be understood by any unauthorized person. By using this technique, the data are translated into a secret code that cannot be understood by anyone else except those who have the code or password to decrypt the encrypted information. This will protect the data and ensure its authenticity and integrity, and further prevent the improper disclosure of confidential educational data stored in the cloud. Encryption is the main method used to ensure the security of data stored in the cloud.
Digital signature: Security and privacy concerns can also be overcome by using digital signatures, an electronic signature used to authenticate the identity of the user of the services provided over the cloud, by using this technique, the user must provide the appropriate login or access credentials before they can have access to the information or application they want to use. This will help to ensure the authenticity, accountability, and integrity of data in the cloud.
https://journals.sagepub.com/doi/pdf/10.1177/2158244014546461
CONCLUSION
Cloud computing is an emerging technology paradigm that promises to provide solution to the current financial crisis faced by HE institutes. The migration from traditional system towards Cloud Computing would enable the HE institutions to cope with rapidly changing software and hardware needs at lower cost. It would help to standardize and update the educational content, and help enhanced collaboration between HE institutes. The HE institutes expect to cut 20% of their IT budget by moving most of its applications to the cloud. This presents a major shift in approach and provides a major opportunity to increase organizational efficiency, improve agility, and stimulate innovation. Cloud computing represents an opportunity for universities to take advantages of the enormous benefits of cloud services and resources in the educational process. However, the cloud users remain concerned about security issues that represent the major obstacle that may prohibit the adoption of cloud computing on a large scale. As with any technology, Cloud Computing raises many concerns including security and privacy. Therefore, a comprehensive list of recommendations has been provided to avoid security risks efficiently when adopting cloud computing in educational institutions.
https://core.ac.uk/download/pdf/82674946.pdf
Looking for a Similar Assignment? Order now and Get 10% Discount! Use Coupon Code "Newclient"
