Data Security in Cloud ComputingAmal AlKadi, Hanouf AlYahya

CIS Department, Prince Sultan UniversityRiyadh, Saudi ArabiaAmalKadi@gmail.com

Hanouf777@hotmail.com

Abstract- Cloud computing is one of the new trends that a lot of companies are shifting towards. According to Gartner researches, cloud computing is one of four trends that will transform information technology and the way business is conducted. One of the reasons that limit the expansion of cloud computing to all business functions is the data security concerns. This research is about Data Security in Cloud Computing. We first talk about the definitions of data security and cloud computing and their importance. We then move to talk about data security technologies and techniques. After that we start discussing data security in cloud computing by first addressing most of the threats that may occur when using could computing. After seeing all major issues we will talk about all possible solutions. The last part in the research will be about the security benefits of cloud computing.

The concerns of data security are increasing due to the ongoing development of the internet and the ease of data sharing and communication. Data security is critical in all aspects of our lives; banking information, personal files and businesses almost all of those are processed using technologies and through network communication.

Index Terms—Cloud computing, Data security.

I. INTRODUCTION

Cloud computing is one of the new trends that a lot of companies are shifting toward. According to Gartner researches cloud computing is one of four trends that will transform information technology and the way business is conducted [1]. One of the reasons that limit the expansion of cloud computing to all business functions is the data security concerns. In this research we will discuss the main aspects of data security in cloud computing, what made it a hot topic and what is the cloud provided are offering.

A. Data Security

Data security is the practice of keeping data protected from corruption and unauthorized access [2]. It helps with insuring privacy and protecting personal data. The concerns of data security are increasing due to the ongoing development of the internet and the ease of data sharing and communication. Data security is critical in all aspects of our lives; banking information, personal files and businesses. Almost all of those are processed using technologies and

through network communication. One major reason security concerns are raising is because companies are conducting core and non-core business functions through other companies.

Fig. 1. The data lifecycle [3]

Figure 1 above shows the data lifecycle. Data first goes through the collection phase, where the risk of losing data or data being manipulated is moderate. Next it goes to the relevance phase, next to the classification phase; the risk is low in both phases. The next phase is handling and storing data, where there is a high risk of data loss or unprivileged access. Then data is transmitted and transported, the risk here is moderate. The next phase is the manipulation, conversion or altering of data, this phase has a high risk of losing data. The data then goes through release, backup, and retention and then destruction phases, where the risk is moderate. We can conclude that the phases where the data is threatened the most are the handling and storage, and the manipulation, conversion or altering of data.

B. Cloud Computing

When talking about cloud computing, what we mean by the term "cloud" is the Internet; because typically the internet is represented in network diagrams as clouds. Cloud computing is hard to define. Before explaining what cloud computing is, we will start with what enforced it. Time-sharing systems enabled computer machinery that lacked the capabilities to work through a main server which is connected to it through wires [4].Cloud computing provides the same ease of sharing data and information but through the Internet. Nowadays major companies such as Google and Microsoft provide this capability as a service. Gartner defines cloud computing as "a style of computing in which scalable and elastic IT-enabled capabilities are delivered as a service to external customers using Internet technologies" [5]. Another definition of cloud computing, "a standardized IT capability (services, software, or infrastructure) delivered via the Internet in a pay-per-use and self-service way"[6].

To clearly understand the definition of cloud computing we have to know the service and deployment models of cloud computing which are Infrastructure-as-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). IaaS is the delivery of computer infrastructure components, such as hardware, data storage and other compute recourses, as a service. PaaS provides a platform that runs over an infrastructure, it offers a ready to use platform and it enables users of this platform to develop their own applications. SaaS provides software that runs over a platform and infrastructure that is manage by the company offering the service [7]. Gartner predicts that 30% of new software will be delivered via SaaS model by the end of this year [8]. With the development of cloud computing a lot of big companies provided cloud computing services. Table 1 below, shows major companies that are providing these three types of services.[9]

Major cloud computing service providers are; Amazon, Google, and Microsoft. Later in this research we will discuss Amazon’s services in details and we will talk about the security measures they take.

TABLE IEXAMPLES OF MAJOR CLOUD COMPUTING SERVICE PROVIDERS

Offering Focus Area

Amazon Core offering includes the AWS infrastructure related to servers, storage and bandwidth, and databases

SMB focus

Google For creating and running web services Supports only Python and java Also provides SaaS–related productivity

application.

SMB focus

Microsoft Operating system with a set of developer service.

Allows the building of new cloud application and the enhancement of existing application for the could.

Platform for Microsoft application development.

Enterprise /SMB focus

II. DATA SECURITY TECHNOLOGIES

To understand data security, we need to explain security basics. Data security key pillars are: authentication, access control, and auditing.

A. Authentication

Authentication is verifying that the person who requested an access to the information is who he claims to be. It is a process of proving identity. Authentication is a major security measure for cloud computing service providers and users. It is important for service providers to insure that the technologies of authentication are accurate. Authentication is categorized into three categories; authentication by what you have, what you know, and what you are. The main techniques used in authentication are: username and password, tokens, biometrics, certificates, and Kerberos. Username and password is the most common user technique. A token is a security device that has a permission of access embedded in the token itself. Biometric is using the person’s own characteristics for authentication. Certificates link a specific person to a key, they are issued by certification authority (CA). The digital certificate helps the receiver to verify the identity of the sender. Kerberos is an authentication system developed by Massachusetts Institute of Technology (MIT) and it is used to verify the identity of the users. Kerberos uses encryption and authentication for security [10].

B. Access control

After authentication and making sure that the user is who he claims to be, the next step is access control; which is restricting the user from access all information, and limiting his access to only material which the user has permission to access. Assigning rights to groups is more efficient than assigning them to specific users. Thus, users should be assigned to groups and then getting the same privileges for all the group members. A list of permissions can be assigned to a group or a user, it can be; Full Control, Modify, Read, Write, List Folder Contents, Read and Execute. The models to determine the access control types are; Mandatory Access Control (MAC), Role-Based Access Control (RBAC), Discretionary Access Control (DAC). In Mandatory Access Control the user has no privileges of giving permissions to other users with regards to an object or file. This model is the most restricted. In Role-Based Access Control the permission is assigned to a position or a role, where the person in a specific position can distribute permission to access objects under his control. In Discretionary Access Control any user can adjust the permissions of all other users. This model is the least restricted [10].

C. Audit

The last pillar of data security is auditing. Information security configurations should be audited to ensure that the access controls are in place. Some of the auditing techniques are; logging and system scanning. Logging is keeping record of the activities performed by users and the time at which it occurred. The information recorded in the logging is useful when it’s compared with the access control list (ACL). An access control list saves all users and the permissions they have. Performing checking will allow us to find unauthorized access and if a user has permission that he should not have. The logging is performed automatically in most cases. The second technique in auditing is system scanning. System scanning checks the permissions assigned to a user or a role, whereas logging keeps track of actions performed by users in the system and when it was performed [10].

III. DATA SECURITY IN CLOUD COMPUTING

Fig. 2. The main issues on cloud computing.

The above graph shows that the number one concern about cloud services is security; since the business’s critical information is exposed to a third-party which worries the businesses of the information’s vulnerability to be attacked. [11]

Since cloud computing is offered as a service, which raises a lot of questions to be answered with regards to data security. Costumers moving to the cloud have a lot of concerns when it comes to handing over control to a third-party; especially sensitive data of the company and its customers. Computer security researches found out that when two programs running at the same time on the same operating system an attacker can steal data by using eavesdropping program. One research raised concerns about having the same problem when two virtual machines are running on the same server. What confirmed this security issues was a research done by three computer scientists at the University of California in San Diego, and one at MIT. This research was done by hiring two

virtual machines at the same server, which was offered from Amazon’s Elastic Computer Cloud EC2. They used one virtual machine as a target, and another as an attacker, and then they tried planting malicious virtual machines at the same server, and they succeed. However, Amazon said they have solved this problem, but no details were shared. Radu Sion, a computer scientist at the State University of New York said "If you don't have everybody using the cloud, you can't have a cheap service. But when you have everybody using the clouds, you have all these security issues that you have to solve suddenly."[12]

Thus, costumers usually demand transparency and detailed information of the security measures of the vendors. Costumers are mostly concerned about these major security threats; Unknown risk profile, Malicious insiders, Shared technology issues, Data loss and leakage, Insecure interfaces and APIs, Account or service hijacking, and Abuse use of cloud computing.

A. Insecure Interfaces and APIs

The first major threat that we are discussing is insecure interfaces and APIs. The interface and API are the most important part of the cloud. Having non-secure one will jeopardize the integrity and confidentiality of the data. This threat puts all of the three cloud computing service models in risk. Since all activates done by the user goes through the interface, it’s crucial to have a secure one. It’s hard for companies moving to the cloud to identify whether the interface they are using to get to the cloud and the data stored there is secure. Some suggestion for perspective cloud computing costumers is to analyze the security model of the interface used; they should insure strong authentication and access control, in addition to encryption. [13]

B. Malicious Insiders

A second threat is malicious insiders, which threatens all three models of cloud computing. This threat is well-know to organizations. With the introduction of cloud computing, this threat has been amplified. Companies moving their data to the cloud providers may not reveal how access to their physical and non-physical assets is being granted, and how they monitor the employees. The level of impact depends on the level of access granted to employees, so, for the consumer of cloud services, they should know how the providers are detecting and protecting their data from malicious insider threat. One way a company can ensure that malicious insider threat is almost eliminated is by specifying human resources requirements as part of the legal contracts. As well, a company can require transparency in the overall information security and management practices. [13]

C. Shared Technology Issues

A third example of threats is shared technology issues, which was the issue in the previous discussed research. This threatens the infrastructure as a service model only (IaaS). This problem occurs because the underlying physical components that form the infrastructure were not designed to offer isolation for multi-tenant architecture. Sharing the CPU and the cache threatens the security of the data. In theory, customers should not be able to access any other tenant’s information or network. A cloud provider should conduct vulnerability scanning and configuration audits to protect customers. [13]

D. Data Loss or Leakage

Another threat is data loss or leakage. Due to the architectural and operational characteristics of the cloud environment, data loss and leakage are increasing. Unauthorized people should not be granted access to the data to insure that none will be deleted or altered intentionally in anyway. For a service provider, data loss or leakage can have a destructive impact on their reputation and name. In addition, loss of some sensitive data might affect the providers legally and financially. Providers should backup the data and have a solid plan to overcome this kind of threats. This threat affects all the three cloud computing models. [13]

E. Unknown Risk Profile

The next threat that we will be discussing is unknown risk profile. Companies are driven by the advertisement of the service providers showing all the benefits of moving to the cloud; like hardware reduction, maintenance and licensing. On the other hand, they miss the downside of using the cloud. A company who’s making long term decision needs to address all the potential risks. The service provider should inform customers of all possible risks or otherwise this may include serious threats. Potential customers should ask for disclosure of applicable logs, data, and infrastructure details. [13]

F. Abuse Use of Cloud Computing

Our next threat is about the abuse use of cloud computing. Since cloud computing providers try to promote for their services by offering a free trial period for their customers; in which the customers only need a valid credit card to register for the service. These users can easily abuse the service by spamming and implementing malicious codes. At first, the abuse of cloud computing was limited to the IaaS model, but nowadays, PaaS model is affected as well. For service providers to prevent these kinds of activates, they should have a strict registration process. In addition to monitoring public blacklists for their own network blocks. [13]

G. Account or Service Hijacking

This threat, which is “account or service hijacking”, is not a new threat; as it has existed since the begging of the evolution of using computers. Since users usually use the same password for all different kinds of services; their passwords are more vulnerable to these kinds of attacks. Hijacking someone’s account could offer the chance of eavesdropping on others’ activities. Account hijacking jeopardizes the integrity and the availability of data. Cloud service providers should monitor the activities so that they can detect any illegal or suspicious activity. In addition to emphasizing the importance of keeping everyone’s user safe and top secret. [13]

Table 2 below, shows each threat and which models does it effect.

TABLE 2EXAMPLES OF THE THREATS THAT MIGHT THREATEN THE CLOUD COMPUTING

MODELS

Threats IaaS PaaS

SaaS

Insecure Interfaces and APIsMalicious InsidersShared Technology IssuesData Loss or LeakageUnknown Risk ProfileAbuse Use of Cloud ComputingAccount or Service Hijacking

IV. DATA SECURITY SOLUTIONS

Due to the threats discussed above, researches came up with some solutions and some ideas to be implemented. One of the solutions provided was by Amazon web service. Another idea was suggested by a group from Microsoft.

Amazon has introduced a private cloud that offered more security because of the demand of Amazon’s customers to have a more enhanced level of security in the cloud service. In addition, the group from Microsoft suggested a way to prevent what happened in the case of the researchers from San Diego and MIT by monitoring the use of the shared cache memory by a virtual machine which is operation on the same server.

A. Encryption

Major cloud computing security solutions are based on encryption. The most secure ways nowadays is getting the encrypted data from the cloud to a secure location, decrypting it, then use it and work with, and at last, return the data encrypted again back to the cloud. Another possibility which is less secure, is keeping the information in the cloud

unencrypted. Craug Gentry, a cryptography researcher at IBM “The general theme of cloud computing is that you want

to be able to outsource all kinds of functionality but you don’t want to give away your privacy—and you need very versatile cryptography to do that,”. Encryption techniques used

nowadays need to be more advanced to suit the cloud computing environment. [12] IBM researcher called Craig Gentry have founded a solution for analysing data in the cloud without having to decrypted which years ago was considered impossible. The solution was called “privacy homomorphism," or "fully homomorphic encryption”.[14] privacy homomorphism is defined as “ a form of encryption where a specific algebraic operation is performed on the plaintext and another (possibly different) algebraic operation is performed on the cipher text[15]”

B. Virtualization solution

To solve the problem of virtualization, a research called “HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity” by Zhi Wang and Xuxian Jiang, presented HyperSafe. When people first started using virtual machines, they assumed that they were safe and the hypervisor (virtual machine monitor VMM) is secure. A study by the National Vulnerability Database showed that in the last three years, there were 26 security vulnerabilities. These contemporary hypervisors where the security vulnerabilities occurred (Xen and VMware) had a large complex code base.

HyperSafe is developed to solve this problem by using two techniques. “The first technique locks down write-protected memory pages and prevents them from being manipulated at

runtime, thus effectively protecting the hypervisor’s code integrity; The second key technique converts the control data into pointer indexes by introducing one layer of indirection

and thus expands protection to include control-flow enforcement”.[16]

C. Private clouds

Private cloud is a stack of network servers and storage hardware used for one single customer. The first benefit is providing security; where you have your own dedicated data center, that is not available for anyone but you, exclusively provided for you from the service provider. The second benefit is flexibility; with the option of changing the specific features of the cloud to meet your changing needs. With that level of flexibility, some challenges raised, such as, the level of complexity used in building these private clouds. [17]

Private cloud is considered a solution to two of the major threats which are hacking and denial of service attacks (DOS). To solve the problem of hacking, private cloud restricts access to administrators only, and allows the business to have access control over their environment. The other threat is denial of service attacks on other customers that share the same infrastructure. Private clouds allow you to have your own infrastructure not sharing it with any other person, which eliminates any threat of DOS.[18]

The private cloud helps with disaster recovery plan since it allows for isolating the resources if any hardware failure

Fig. 3. Traditional page table updates vs. new page table updates in HyperSafe

Fig. 4. Traditional indirect call vs. new indirect call in HyperSafe

occurs. Another benefit is that you can connect your private cloud to your dedicated environment.

Private cloud is specially fitted for companies that have very specific security resources or data requirement.[19]

The figure below shows a comparison between private clouds and other types of clouds.[20]

Fig 5. Features of private cloud in comparison to other types of clouds

V. AMAZON WEB SERVICES

Amazon provides a lot of services related to cloud computing. Amazon web services offer a variety of services. They have computing services; like Amazon Elastic Compute Cloud, Amazon private cloud and Amazon Simple Storage Service.

A. Amazon Elastic Compute Cloud

Amazon Elastic Compute Cloud (EC2). “EC2 is a web service that provides resizable compute capacity”.[21].EC2 provides multiple levels of security to its customers; starting with security in the host and the guest operating systems, firewalls, and signed API calls. In the level of host operating system; only administrators from Amazon who are granted the privilege using strong authentication can access the system and manage the cloud. All accesses in this level are logged and audited.

The second level; the guest operating system, customers have full control over the virtual instances; accounts, services, and applications. Amazon web servers (AWS) have no access to the customers’ instances.

The next level is firewalls, where all configurations of the firewall are set to “deny” mode in default. The customer has the choice of changing the mode whenever needed, and can configure the firewall to treat different classes of instances in different set of rules. The security measure here is that the firewall configurations cannot be manipulated by the guest OS unless you get an X.509 certificate, and a key to authorize the change.

The next and the last level is the signed API calls. All API functions are signed by the customer’s Amazon Secret Access Key. Amazon recommends that all API calls are encrypted

using SSL. A second measure of security is Instance Isolation. “Different instances running on the same physical machine are isolated from each other via the Xen hypervisor. Amazon is active in the Xen community, which ensures awareness of the latest developments. In addition, the AWS firewall resides within the hypervisor layer, between the physical network interface and the instance's virtual interface. All packets must pass through this layer, thus an instance’s neighbors have no more access to that instance than any other host on the Internet and can be treated as if they are on separate physical hosts. The physical RAM is separated using similar mechanisms. AWS recommends that customers further protect their data using appropriate means. One common solution is to run an encrypted file system on top of the virtualized disk device.”[22]

Fig 6. Illustration of the Instance Isolation measure

B. Amazon Virtual Private Cloud

Another package of services provided from Amazon are networking services; such as Amazon Virtual Private Cloud (VPC), they enable companies to connect their infrastructure with a set of isolated AWC resources using virtual private network (VPN) connection. Amazon VPC is integrated with Amazon EC2. Figure 7 below illustrates the architecture of Amazon VPC.[22]

Fig 7. Illustration of Amazon VPC setting

C. Amazon Simple Storage Service

Another service that Amazon provides is; Amazon Simple Storage Service (S3), which gives customers the capability of

storing their own data on Amazon premises. Customers using this service are mostly concerned whether someone with unauthorized access would be able to access their data. What Amazon did, to eliminate these concerns, is two security measures; data management, and access logging.

In data management, to secure the data, they use data encryption and physical security. When a customer deletes an object from Amazon S3, the link of the object will be deleted. After the deletion of the link, there will be no remote access to the deleted object. To insure availability of data, Amazon S3 objects are stored redundantly on multiple devices across Amazon’s S3 region. They also provide versioning, which can be used to distinguish, retrieve, and restore every version of each object stored in Amazon S3 packets. With versioning customer can recover all versions when an application fail.

Amazon S3 packets are configured to keep logs of access to them and their objects. These access logs contain information about the request type, and the requested resource, and the requester IP, plus the time and date of the request. Log records are combined periodically into log files.[22]

VI. SECURITY BENEFITS OF CLOUD

The benefit of scale is considered one of the major security benefits of the cloud. Since most cloud providers operate in multiple locations by default, this will increase the independency from failure and provide a level of disaster recovery. In addition, when using the service from a cloud computing provider, you get a list of benefits with it; such as hiring specialists to deal with security threats. Plus, it is easier for the service providers to insure that the system is secure from hackers and bugs.

Another benefit of the cloud is having protection from distributed denial of service (DDOS). When having a large cloud provider like Amazon, it is hard to overload their system because of its size, so, as a result, customers of such companies get protected from these attacks.

One more benefit is the chance for standardization and collaboration. Since the servers are owned by the service providers, there is a greater chance of using the same set of hardware, which will eventually lead to the standardization and collaboration for improving security services for the users.[23]

VII. CONCLUSION

Whenever a new technology is introduced, a great benefit comes along with it; just like cloud computing. Meanwhile, potential risks are attached to it as well. Cloud computing security needs a few more years to be solid. A lot of researches have been conducted to introduce new ways of securing the clouds and the data. Most researches are not yet

implemented, but, hopefully, in the next few years we will find these technologies implemented, and used to its full potential. And as technology is evolving, more risks might threat the business. However, many researches are working on improving these issues as it progress.

REFERENCES[1] "Gartner Identifies Four Converging Trends That Will Change the Face

of IT and Business." Technology Research & Business Leader Insight | Gartner. Gartner, 15 Nov. 2010. Web. 11 Dec. 2010. <http://www.gartner.com/it/page.jsp?id=1470115>.

[2] "What Is Data Security?" Spam – Antivirus - Identity Theft - Scams and Fraud: STOP IT. Web. 30 Nov. 2010. <http://www.spamlaws.com/data-security.html>.

[3] Data Lifycycle. Digital image. Web. 9 Jan. 2011. <http://cloudsecurityalliance.googlegroups.com/web/Datalifecycle.pdf?gda=_lh7REMAAACJG7iKeUOOFamAbEkryLW2jHbjBu1NcoXB7KhixHtQlfvV_T_OFibCcYqzBc7w-eMytiJ-HdGYYcPi_09pl8N7FWLveOaWjzbYnpnkpmxcWg>.

[4] Hayes, Brian. "Cloud Computing | July 2008." Communications of the ACM. Web. 28 Nov. 2010. <http://cacm.acm.org/magazines/2008/7/5368-cloud-computing/fulltext>.

[5] STAMFORD, CONN. "Gartner Highlights Five Attributes of Cloud Computing." Technology Research & Business Leader Insight | Gartner. 23 June 2009. Web. 11 Dec. 2010. <http://www.gartner.com/it/page.jsp?id=1035013>.

[6] Staten, James. "Cloud Computing for the Enterprise." Forrester. Forrester Research, 3 Feb. 2009. Web. 9 Dec. 2010. <http://www.forrester.com/imagesV2/uplmisc/CloudComputingWebinarSlideDeck.pdf>.

[7] Wilshusen, By Gregory. "Information Security: Federal ..." Google Books. DIANE Publishing. Web. 28 Nov. 2010. <http://books.google.com/books?id=DtZSSxhPZPQC&pg=PA15&dq=cloud computing&hl=en&ei=tpzvTJL0F9P-4waJwtjdBA&sa=X&oi=book_result&ct=result&resnum=1&ved=0CCkQ6AEwAA&safe=active#v=onepage&q&f=false>.

[8] Rittinghouse, John W., and James F. Ransome. "• Cloud Computing: Implementation, Management, and Security." Klc Consulting. CRC Press. Web. 29 Nov. 2010. <http://www.klcconsulting.net/security_resources/cloud/Cloud_Computing_Book-Implementation-Management-Security-2010.pdf>.

[9] Latif, Shahed, Subra Kumaraswamy, and Tim Mather. "Cloud Security and Privacy: An ... - Google." Google Books. Web. 28 Nov. 2010. <http://books.google.com/books?id=BHazecOuDLYC&printsec=frontcover&hl=ar&safe=active#v=onepage&q&f=false>.

[10] Ciampa, Mark D. Security Guide to Network Security Fundamentals. 2nd ed. Boston, MA: Thomson/Course Technology, 2005. Print.

[11] Gens, Frank. "IT Cloud Services User Survey, Pt.2: Top Benefits & Challenges." IDC EXchange. 02 Oct. 2008. Web. 14 Dec. 2010. <http://blogs.idc.com/ie/?p=210>.

[12] Talbot, David. "Security in the Ether." Smith College. Feb. 2009. Web. 29 Nov. 2010. <http://cs.smith.edu/dftwiki/images/0/02/SecurityInTheEther.pdf>.

[13] "Top Threats to Cloud Computing V1.0." Cloud Security Alliance (CSA) - Security Best Practices for Cloud Computing. Cloud Security Alliance, Mar. 2010. Web. 29 Nov. 2010. <http://www.cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf>.

[14] Cohen, Reuven. "IBM Researcher Solves In-Cloud Data Encryption Puzzle." Cloud Computing Journal. Web. 14 Jan. 2011. <http://cloudcomputing.sys-con.com/node/1015761>.

[15] "Homomorphic Encryption." Wikipedia, the Free Encyclopedia. Web. 14 Jan. 2011. <http://en.wikipedia.org/wiki/Privacy_homomorphism>.

[16] Wang, Zhi, and Xuxian Jiang. "HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity." North Carolina State University. Web. 9 Jan. 2011. <http://www4.ncsu.edu/~zwang15/files/oakland10.pdf>.

[17] "What Are the Benefits of Private Cloud Computing for Businesses? » Welcome to Privatecloud.com." Privatecloud.com. 28 July 2010. Web. 09 Jan. 2011. <http://www.privatecloud.com/2010/08/06/what-are-the-benefits-of-private-cloud-computing-for-businesses/?fbid=jUhoEh0OcQD>. Chen, Yanpei, Vern Paxson, and Randy H. Katz. "What’s New About Cloud Computing Security?" Electrical Engineering and Computer Sciences University of California at Berkeley. Jan. 2010. Web. 29 Nov. 2010. <http://www.eecs.berkeley.edu/Pubs/TechRpts/2010/EECS-2010-5.pdf>.

[18] Marler, Jon. "Securing the Cloud: Addressing Cloud Computing Security Concerns with Private Cloud." 25 May 2010. Web. 09 Jan. 2011. <http://www.rackspace.com/hosting_knowledge/private-cloud/securing-the-cloud-addressing-cloud-computing-security-concerns-with-private-cloud/>.

[19] Private Cloud 101 Video - Who's a Good Fit for Private Cloud? Perf. RackspaceHosting.YouTube. 17 Nov. 2009. Web. 09 Jan. 2011. <http://www.youtube.com/watch?v=1RbEbo8UyCE&feature=related>.

[20] "Cloud Computing Risk Assessment — ENISA." Securing Europe's Information Society. ENISA, 20 Nov. 2009. Web. 09 Jan. 2011. <http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk-assessment>.

[21] Sns, Using Amazon. "What Is AWS?" Amazon Web Services. Web. 11 Jan. 2011. <http://aws.amazon.com/what-is-aws/>.

[22] "Amazon Web Services: Overview of Security Processes." AmazonAWS. Aug. 2010. Web. 11 Jan. 2011. <http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper.pdf>.

[23] "The Security Benefits of Cloud Computing | CloudTweaks.com - The Cloud Computing Community." Cloud Computing Social Community - CloudTweaks.com. 15 Aug. 2010. Web. 11 Jan. 2011. <http://www.cloudtweaks.com/2010/08/the-security-benefits-of-cloud-computing/>.