Q14Cloud Computing

When organizations move data to the cloud, they face several security challenges. Data privacy and confidentiality are major concerns, especially in public clouds where resources are shared. Insecure APIs and interfaces can be exploited by attackers. Multi-tenancy introduces the risk of data leakage between tenants if isolation is breached. Additionally, compliance with regulations (like GDPR or HIPAA) becomes complex because the physical location of the data might be spread across different geographical regions.

• Data Breaches: Misconfigured storage buckets or weak access controls can expose sensitive data to the public internet, often without any sophisticated hacking required.
• Loss of Control: Once data and applications move to a third-party provider, the consumer loses direct physical control over the underlying hardware and must trust the provider's security practices.
• Insecure APIs: Cloud services are managed almost entirely through REST APIs; weak authentication or missing rate limits on these APIs can let attackers provision resources or exfiltrate data.
• Insider Threats: Malicious or careless employees of either the cloud provider or the tenant organization can misuse elevated privileges to access confidential data.
• Account Hijacking: Phishing or credential theft can give attackers control of a cloud account, allowing them to manipulate data or redirect users to malicious sites.
• Compliance and Data Sovereignty: Different countries impose different legal requirements on where regulated data may be stored and processed, which is difficult to enforce when providers replicate data across global data centers.

These risks are typically addressed through the Shared Responsibility Model, where the provider secures the physical infrastructure and hypervisor while the consumer is responsible for identity management, encryption, and application-level security.