4: Cloud Computing Top Security Risks

compliance with the software licence is the responsibility of

All rights reserved. May not be reproduced in any form without permission from the publisher, except fair uses permitted under U.S. or applicable copyright law.

the Cloud provider. In other words, while the user pays a

fee for use of the Windows® operating systems, it is the
responsibility of the Cloud provider to comply with all
requirements and restrictions imposed by Microsoft relating
to deployment of its operating system in the Cloud
provider’s environment.

Conclusion
This chapter has discussed how security in a Cloud
Computing environment differs from that in a traditional
dedicated data centre.
Part of the difference is due to the software technologies
used to implement Cloud Computing environments.
Virtualisation abstracts operating environments away from
physical servers and makes assumptions about static
computing environments obsolete. The automated
orchestration aspects of Cloud environments means that
manual implementation of security products, components,
and configurations cannot keep up with dynamic topologies
of Cloud applications.
Beyond the Cloud technology changes, Cloud Computing
environments are also quite different from traditional data
centres. Because Cloud environments are shared pools of
resources, many traditional security practices based on
Copyright @ 2012. IT Governance Publishing.

placing appliances within the data centre are no longer

tenable.
Finally, of course, Cloud Computing environments differ
because part of the overall security responsibility lies with
the Cloud provider, while another part lies with the Cloud
users. This shared responsibility meets at the ‘trust

113
EBSCO : eBook Academic Collection (EBSCOhost) - printed on 3/17/2019 8:24 PM via OPEN UNIVERSITY
OF CYPRUS
AN: 571554 ; Carstensen, Jared, Golden, Bernard, Morgenthal, JP.; Cloud Computing : Assessing the
Risks
Account: ns020823.main.eds
 4: Cloud Computing Top Security Risks

boundary’, which demarcates which part is responsible for

All rights reserved. May not be reproduced in any form without permission from the publisher, except fair uses permitted under U.S. or applicable copyright law.

security in a particular ‘layer’ of the overall solution.

Figure 6 was introduced to illustrate the layers of the
overall Cloud environment and to indicate where the trust
boundary is located in a public IaaS environment.
Each layer of the environment was described, offering
detail about security elements that make up the layer.
With this foundation of security knowledge, we can next
turn to how IT organisations can evaluate security below
the trust boundary. Chapter 5 is devoted to understanding
how evaluation may be performed and the crucial role of
certification in Cloud security.
Copyright @ 2012. IT Governance Publishing.

114
EBSCO : eBook Academic Collection (EBSCOhost) - printed on 3/17/2019 8:24 PM via OPEN UNIVERSITY
OF CYPRUS
AN: 571554 ; Carstensen, Jared, Golden, Bernard, Morgenthal, JP.; Cloud Computing : Assessing the
Risks
Account: ns020823.main.eds