Cloud Interoperability and Standards

Interoperability is the ability of two or more systems or

applications to exchange information and to mutually use
the information that has been exchanged
Cloud interoperability
– refers to the ability of the systems to work efficiently
and collaborate effectively across different cloud
platforms”.
– [Cloud Service Provider] CSP’s services should be
flexible enough to integrate itself into other platforms
and services provided by other CSPs.
Cloud Interoperability and Standards

Portability, is moving the data and/or applications from

one system to another and having it remain useable or
executable.

Cloud Portability means that if the users want to

migrate data or applications from one CSP to others; the
vendor should not lock-in customer data or services and
the migration should be ease.
Need of Cloud Interoperability and Portability

• Switching cloud service providers

• Use of multiple cloud service providers
• Hybrid cloud configuration
• Cloud migration – Customer moves one or more inhouse
applications and/or data to Cloud.
 Cloud Interoperability and Standards
• Each CSP has its own ways to define and implement
hypervisors, processes, security, a storage model, a
networking model, a cloud API, licensing models
Cloud interoperability obstacles
When you decide to move an application between clouds, there are
challenges. These include
1. Rebuilding the application and application stack in the target cloud.
2. Setting up the network in the target cloud to give the application the
support that it had in its original cloud.
3. Setting up security to match the capabilities provided by the source cloud.
4. Managing the application running in the target cloud.
5. Handling data movement and the encryption of data while it is in transit
and when it gets to the target cloud.
Cloud Interoperability and Standards
“Entering a cloud computing agreement is easier than
leaving it”.
• Customer may need alternatives
– to find a more suitable solution for current needs.
Or
– vendor is no longer able to provide the required service.
• The aim is to introduce standards and allow interoperability
between solutions offered by different vendors.
• Presence of standards in the cloud computing community
– Can avoid vendor lock-in.
– Could give room for interoperability.
Cloud Interoperability and Standards
• At present, there are no concrete agreement on the
protocols and technologies.
• Organizations leading the path on Standardization
Process
– Cloud Computing Interoperability Forum (CCIF)
– Open Cloud Consortium
– DMTF Cloud Standards Incubator
– Open Cloud Manifesto
Cloud Interoperability and Standards
• Example: In the IaaS market, the use of a proprietary virtual
machine format constitutes the major reasons for the vendor
lockin.
• Open Virtualization Format
– Making an attempt to provide a common format for storing
the information and metadata describing a virtual machine
image.
– Includes full specification for packaging and distributing
virtual machine images in completely platform- independent
fashion.
• Another major direction is to design the common API or
Standard Interface to interact with different Cloud based
Solutions. (to support Interoperability).
 Scalability and Fault Tolerance
• An attractive feature of cloud platforms is
the ability to scale on demand.
• Cloud middleware needs to be designed
with the principle of scalability along
different dimensions
for example, performance, size, and load.
• Both Scalability and Fault tolerance are
needed at the same time.
Scalability and Elasticity
• An attractive feature of cloud
platforms is the ability to scale on
demand.
• Defined as the cloud's ability to
provide applications, processes and
media to ever growing numbers of
users.
• A virtualized computing resource has
three essential components: CPU,
Memory, Disk.
• Commonly used where the persistent
deployment of resources is required to
handle the workload statically (Not
short term requirements)
Scalability and Elasticity
• Scaling-up
– Limited by physical machine
capabilities.
– adding more memory
(RAM), more powerful
processors (CPUs), or faster
storage
– For ex. If a host machine has
8 CPU units and 64 GB of
RAM, a VM inside this host
cannot size over those numbers
with the real power of
computing resources.
Scalability and Elasticity

• Scaling-Out

– This includes the acquisition of

new infrastructure and connecting
it to existing infrastructure so that
they work together seamlessly.
– Complex architectural design is
necessary to build an application
capable of complete horizontal
scaling
Scalability and Elasticity
• Diagonal Scaling
– It is a combination of both
Horizontal and Vertical
scalability.
– The resources can be added
both vertically and horizontally.
• Example Scenario
– Increase in the number of
customers/visitors to a company
(with initially small number of
users).
– Scale up of database
capabilities.
Scalability and Elasticity
• Elasticity
– refers to the ability of a cloud to automatically expand or
compressed the infrastructural resources on a sudden-up and
down in the requirement so that the workload can be managed
efficiently.
– helpful to address only those scenarios where the resources
requirements fluctuate up and down suddenly for a specific
time interval.
Example Scenario:
• Consider an online shopping site whose transaction workload
increases during festive season like Christmas.
• More concern on Cloud-Elasticity service rather than Cloud
Scalability.
Scalability and Elasticity
Practices for maximizing Cloud Scalability and Elasticity
• Employ auto scaling
– Auto scaling is defined as automatically scaling capacity
either up or down based on user-defined conditions.
– For example, if we know that an application always see
high use at night and low use in the morning and plan
accordingly.
• Use load balancing
– automatic way of scaling up by distributing workloads
across various nodes in order to maximize resources.
Elasticity Scalability
• Used to meet the sudden up • Used to meet the static
and down in the workload for a increase in the workload.
small period of time. • Used to address the
• Used to meet dynamic increase in workload in an
changes, where the resources organization.
need can increase or decrease. • Commonly used by giant
• Commonly used by small companies whose customer
companies whose workload circle persistently grows in
and demand increases only for order to do the operations
a specific period of time. efficiently.
• Short term planning and • Long term planning and
adopted just to deal with an adopted just to deal with an
unexpected increase in demand expected increase in
or seasonal demands. demand
 Compliance and Governance
Compliance
– Related to backing data on cloud storage services.
– Compliance is to ensure proper data transfer standards and
regulations to be followed.
– Every time a company moves data from the internal storage to a
cloud, it is faced with being compliant with industry regulations
and laws.

– For example, healthcare organizations in the USA have to

comply with HIPAA (Health Insurance Portability and
Accountability Act of 1996), public retail companies have to
comply with SOX (Sarbanes-Oxley Act of 2002).
 Security, Trust and Privacy
“Security risks of cloud computing are the top concern as
77% of respondents stated in the referred survey.”

• Possible threats from Uploading and Downloading data

from clouds.
• The aim is to prevent data tampering and access to sensitive
information.
• Traditionally managed by cryptographic technologies.
• Privacy “Sensitive and personal information that is kept in
the cloud should be defined as being for internal use only”.

• Website hacking and virus attack are the biggest problems

of cloud computing data security.
Cloud Information Security

• Basic terms
– Confidentiality something made accessible to only
authorized parties
– Integrity not altered by an unauthorized party.
– Availability always being accessible and usable.
– Threat A potential security violation that can challenge
defenses.
– Vulnerability a weakness that can be exploited to attack
on a system.
Cloud Information Security

• Key points
– Confidentiality, integrity, authenticity and availability are
associated with measuring security.

– Threats, vulnerabilities and risks are associated with

measuring and assessing insecurity and lack of security.

– Security controls, mechanism and policies are associated

with establishing countermeasures.
Cloud Information Security

• Threat agent an entity that poses a threat (capable of carrying

an attack)
– Anonymous Attacker
• non-trusted cloud service consumer without permission in
cloud.
• For example: An external software program that launches
network level attacks, bypassing user accounts, stealing user
credentials.
• Can be more dangerous with limited information on security
policies.
– Malicious Service Agent
• Capable of intercepting and forwarding the network traffic that
flows within a cloud.
Cloud Information Security
• Threat agent an entity that poses a threat (capable of carrying
an attack)
– Trusted Attacker
• Sharing IT resources in the same cloud environment as the cloud
consumer.
• Unlike anonymous attacker, launch attacks within the cloud’s
trust
boundaries by exploiting legitimate credentials.
– Malicious Insider
• Agent working on behalf or in relation to the cloud provider.
• For example: former employees or third parties with access to
cloud provider’s premises.
Identify the kind of attacker !!

• A person trying to modify the content of your

data being shared to cloud??

• A person trying to get access to your cloud

account??

• A cloud user trying to get access to your

sensitive data??
Cloud Security Threats
• Traffic Eavesdropping
– Passively Intercepting the data being transferred to or
within the cloud.
– Attack on confidentiality of the data.
Cloud Security Threats
• Malicious Intermediary

– When messages are intercepted and altered by a

malicious service agent.
– Attack on confidentiality and Integrity of the data.
Cloud Security Threats
• Denial of Service
– Overload IT resources to interrupt their proper
functioning.

– Attack on availability of the data.

– Example:
• Repeated communication request.
• Artificially increasing network traffic.
• Sending multiple request which need/consume
excessive memory and processing resources
Cloud Security Threats
• Denial of Service
• Cloud service consumer A sends multiple messages to
a cloudservice hosted on virtual server to overload the
physical server.
Cloud Security Threats
• Virtualization Attack
– Virtualization: Provides multiple cloud consumers with
access to IT resources that share underlying hardware but
are logically isolated from each other.
– May involve cloud providers granting administrative
access to virtualized IT resources.
– Cloud consumer could abuse the access to attack the
physical resources.
– Can impact the confidentiality, integrity or availability of
resources.
“An authorized cloud service consumer carries out a
virtualization attack by abusing its administrative
access to a virtual server to exploit the underlying
hardware”.
Cloud Security Threats
• Overlapping Trust Boundaries
– Can happen when IT resources are shared by
different cloud service consumers having overlapping
trust boundaries.

– Malicious consumer can target the shared resources

to launch an attack.
Cloud Security Threats
• Overlapping Trust
Boundaries
Cloud Service consumer A is
trusted by the Cloud Provider.
Gains

Access to a virtual server.

Then uses this access to attack

the underlying
hardware/physical server.

Further, attacks the virtual

server used by cloud service
consumer B.
Preventive Security Considerations in Cloud
Computing
• Identify assets we need to protect.
• Implement Security Policies and Countermeasures.
• Identify kinds of attack that can be mounted and
how to counter those attacks.
• Put geographical restrictions.
• Make sure cloud provider compliance with standard
rules and regulations.
• Evaluate legal issues.