Cloud Computing

Benefits, risks and recommendations for information security

Rev.B December 2012

Cloud Computing
Benefits, risks and recommendations for information security

Document History

Date

Version

Modification

Author

December
2009

1.0

Initial Release, Rev.A

Daniele
Catteddu,
Giles Hogben

December
2012

2.0

Rev.B

Thomas
Haeberlen
Lionel Dupr

About ENISA
The European Network and Information Security Agency (ENISA) is a centre of network and
information security expertise for the EU, its member states, the private sector and Europes citizens.
ENISA works with these groups to develop advice and recommendations on good practice in
information security. It assists EU member states in implementing relevant EU legislation and works to
improve the resilience of Europes critical information infrastructure and networks. ENISA seeks to
enhance existing expertise in EU member states by supporting the development of cross-border
communities committed to improving network and information security throughout the EU. More
information about ENISA and its work can be found at www.enisa.europa.eu.

Contact details
This report has been edited by:
Lionel Dupr, Thomas Haeberlen

For contacting ENISA or for general enquiries about this report, please use the following details:
Email: resilience@enisa.europa.eu
Internet: http://www.enisa.europa.eu

Cloud Computing
3
Benefits, risks and recommendations for information security

Legal notice
Notice must be taken that this publication represents the views and interpretations of the authors and
editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA
or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004 as lastly
amended by Regulation (EU) No 580/2011. This publication does not necessarily represent state-of theart and ENISA may update it from time to time.
Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external
sources including external websites referenced in this publication.
This publication is intended for information purposes only. It must be accessible free of charge. Neither
ENISA nor any person acting on its behalf is responsible for the use that might be made of the
information contained in this publication.
Reproduction is authorised provided the source is acknowledged.
European Network and Information Security Agency (ENISA), 2011

Cloud Computing
Benefits, risks and recommendations for information security

Introduction and Recap

1.1 Updating the 2009 Cloud Risk Assessment

Since the publication of the 2009 Cloud Risk Assessment study, the perception of Cloud computing has
changed, and so has the perception of the associated risks. However, the 2009 Cloud Risk Assessment
continues to be one of the most downloaded documents on the ENISA website. It is therefore
worthwhile to revise the document in general, but especially have a new look at the risks and try to reassess them, taking the developments of the last three years into account.
This document is the result of a first review round carried out by ENISA with the assistance of external
experts.
To simplify things, the risks were separated from the extensive legal considerations that form part of
the 2009 Cloud Risk Assessment. This does not mean, however, that legal aspects are not considered.
On the contrary, there will be a separate working document covering the legal aspects in the
appropriate depth, and the final revision of the Cloud Risk Assessment will again contain a discussion
of legal aspects.

1.2 Cloud computing - working definition

During the first review round, the working definition of
Cloud computing used in the Cloud Risk Assessment in
2009 was kept unchanged.
Even at the time of the original report, this working
definition was not intended as yet another definitive
definition. Cloud computing is an on-demand service
model for IT provision, often based on virtualization
and distributed computing technologies. Cloud
computing architectures have:
-

Cloud computing is an on-demand service

model for IT provision, often based on
virtualization and distributed computing
technologies. Cloud computing architectures
have:

Highly abstracted resources

Near instant scalability and flexibility
Near instantaneous provisioning
Shared resources (hardware, database,
memory, etc)
Service on demand, usually with a pay as you
go billing system
Programmatic management (e.g., through WS API).

highly abstracted resources

near instant scalability and flexibility
near instantaneous provisioning
shared resources (hardware, database,
memory, etc)
service on demand, usually with a
pay as you go billing system
programmatic
management
(eg,
through WS API).

Cloud Computing
5
Benefits, risks and recommendations for information security

There are three categories of cloud computing:

-

Software as a service (SaaS): is software offered by a third party provider, available on

demand, usually via the Internet configurable remotely. Examples include online word
processing and spreadsheet tools, CRM services and web content delivery services (Salesforce
CRM, Google Docs, etc).
Platform as a service (PaaS): allows customers to develop new applications using APIs
deployed and configurable remotely. The platforms offered include development tools,
configuration management, and deployment platforms. Examples are Microsoft Azure, Force
and Google App engine.
Infrastructure as service (IaaS): provides virtual machines and other abstracted hardware and
operating systems which may be controlled through a service API. Examples include Amazon
EC2 and S3, Terremark Enterprise Cloud, Windows Live Skydrive and Rackspace Cloud.

Clouds may also be divided into:

-

Public: available publicly - any organisation may subscribe

Private: services built according to cloud computing principles, but accessible only within a
private network
Partner or Community: cloud services offered by a provider to a limited and well-defined
number of parties.

1.3 Top security benefits

The 2009 Cloud Risk Assessment considers a number of security benefits offered by the Cloud
computing model. These have to be weighed against the risks that this model brings with it. Although
they are not strictly necessary for the purpose of assessing the risks, they have been kept in this
document (see section 2 Security benefits of cloud computing) to put the risks into perspective.
Security and the benefits of scale: put simply, all kinds of security measures are cheaper when
implemented on a larger scale. Therefore the same amount of investment in security buys better
protection. This includes all kinds of defensive measures such as filtering, patch management,
hardening of virtual machine instances and hypervisors, etc. Other benefits of scale include: multiple
locations, edge networks (content delivered or processed closer to its destination), timeliness of
response, to incidents, threat management.
Security as a market differentiator: security is a priority concern for many cloud customers; many of
them will make buying choices on the basis of the reputation for confidentiality, integrity and
resilience of, and the security services offered by, a provider. This is a strong driver for cloud providers
to improve security practices.

Cloud Computing
Benefits, risks and recommendations for information security

More timely, effective and efficient updates and defaults: default virtual machine images and
software modules used by customers can be pre-hardened and updated with the latest patches and
security settings according to fine-tuned processes; IaaS cloud service APIs also allow snapshots of
virtual infrastructure to be taken regularly and compared with a baseline. Updates can be rolled out
many times more rapidly across a homogenous platform than in traditional client-based systems that
rely on the patching model.
Rapid, smart scaling of resources: the ability of the cloud provider to dynamically reallocate resources
for filtering, traffic shaping, authentication, encryption, etc, to defensive measures (e.g., against DDoS
attacks) has obvious advantages for resilience.
Benefits of resource concentration: Although the concentration of resources undoubtedly has
disadvantages for security [see Risks], it has the obvious advantage of cheaper physical
perimiterisation and physical access control (per unit resource) and the easier and cheaper application
of many security-related processes.

1.4 Top security risks

The 2009 Cloud Risk Assessment contains a list of the top security risks related to Cloud computing.
After the first review round, the top risks have turned out to be more or less unchanged from the 2009
Cloud Risk Assessment.
The most important classes of cloud-specific risks (see section 4 Risks) are:
Loss of governance: in using cloud infrastructures, the client necessarily cedes control to the Cloud
Provider (CP) on a number of issues that may affect security. At the same time, SLAs may not offer a
commitment to provide such services on the part of the cloud provider, thus leaving a gap in security
defences.
This also includes compliance risks, because investment in achieving certification (e.g., industry
standard or regulatory requirements) may be put at risk by migration to the cloud:

if the CP cannot provide evidence of their own compliance with the relevant requirements
if the CP does not permit audit by the cloud customer (CC).

In certain cases, it also means that using a public cloud infrastructure implies that certain kinds of
compliance cannot be achieved (e.g., PCI DSS).
Lock-in: there still is little on offer in the way of tools, procedures or standard data formats or services
interfaces that could guarantee data, application and service portability. This can make it difficult for
the customer to migrate from one provider to another or migrate data and services back to an in-

Cloud Computing
7
Benefits, risks and recommendations for information security

house IT environment. This introduces a dependency on a particular CP for service provision, especially
if data portability, as the most fundamental aspect, is not enabled.
Isolation failure: multi-tenancy and shared resources are defining characteristics of cloud computing.
This risk category covers the failure of mechanisms separating storage, memory, routing and
reputation between different tenants (e.g., so-called guest-hopping attacks). However it should be
considered that attacks on resource isolation mechanisms (e.g.,. against hypervisors) are still less
numerous and much more difficult for an attacker to put in practice compared to attacks on traditional
OSs.
Management interface compromise: customer management interfaces of a public cloud provider are
accessible through the Internet and mediate access to larger sets of resources (than traditional hosting
providers) and therefore pose an increased risk, especially when combined with remote access and
web browser vulnerabilities.
Data protection: cloud computing poses several data protection risks for cloud customers and
providers. In some cases, it may be difficult for the cloud customer (in its role as data controller) to
effectively check the data handling practices of the cloud provider and thus to be sure that the data is
handled in a lawful way. This problem is exacerbated in cases of multiple transfers of data, e.g.,
between federated clouds. On the other hand, some cloud providers do provide information on their
data handling practices. Some also offer certification summaries on their data processing and data
security activities and the data controls they have in place, e.g., SAS70 certification.
Insecure or incomplete data deletion: when a request to delete a cloud resource is made, as with
most operating systems, this may not result in true wiping of the data. Adequate or timely data
deletion may also be impossible (or undesirable from a customer perspective), either because extra
copies of data are stored but are not available, or because the disk to be destroyed also stores data
from other clients. In the case of multiple tenancies and the reuse of hardware resources, this
represents a higher risk to the customer than with dedicated hardware.
Malicious insider: while usually less likely, the damage which may be caused by malicious insiders is
often far greater. Cloud architectures necessitate certain roles which are extremely high-risk. Examples
include CP system administrators and managed security service providers.
Customers security expectations: the perception of Security levels by Customers might differentiate
from the actual security (and availability) offered by the CP, or the actual temptation of the CP to
reduce costs further by sacrificing on some security aspects.
Availability Chain: Reliance on Internet Connectivity at Customers end creates a Single point of failure
in many cases.

Cloud Computing
Benefits, risks and recommendations for information security

The risks listed above do not follow a specific order of criticality; they are just ten of the most
important cloud computing specific risks identified during the assessment. In terms of criticality, loss of
governance is still considered the top risk associated with moving to the Cloud.
The risks of using Cloud computing should be compared to the risks of staying with traditional
solutions, such as desktop-based models. To facilitate this, the 2009 Cloud Risk Assessment contains
estimates of relative risks as compared with a typical traditional environment. These were also
reconsidered during the first review round, and in many cases explanations were added.
It is often possible, and in some cases advisable, for the cloud customer to transfer risk to the cloud
provider.However not all risks can be transferred: If a risk leads to the failure of a business, serious
damage to reputation or legal implications, it is hard or impossible for any other party to compensate
for this damage. Ultimately, you can outsource responsibility but you can't outsource accountability.

1.5 Target audience

The intended audience of this report is the Cloud community at large, including Cloud providers,
current and potential Cloud customers, consultants as well as policy makers concerned with the area
of Cloud computing.
The feedback received from all stakeholders will be used in a second review round that will yield a
comprehensive update of the 2009 Cloud Risk Assessment.

Cloud Computing
9
Benefits, risks and recommendations for information security

Security benefits of cloud computing

It is hardly necessary to repeat one again about the Put simply, all kinds of security
economic, technical, architectural and ecological benefits of measures are cheaper when
cloud computing. However, in the direct experience of the implemented on a larger scale.
members of our expert group, as well as according to recent Therefore the same amount of
news from the real world, an examination of the security investment in security buys better
risks of cloud computing must be balanced by a review of its protection.
specific security benefits. Cloud computing has significant potential to improve security and resilience.
What follows is a description of the key ways in which it can contribute.

2.1 Security and the benefits of scale

Put simply, all kinds of security measures are cheaper when implemented on a larger scale. Therefore
the same amount of investment in security buys better protection. This includes all kinds of defensive
measures such as filtering, patch management, hardening of virtual machine instances and
hypervisors, human resources and their management and vetting, hardware and software redundancy,
strong authentication, efficient role-based access control and federated identity management
solutions by default, which also improves the network effects of collaboration among various partners
involved in defense. Other benefits of scale include:
-

Multiple locations: most cloud providers have the economic resources to replicate content in
multiple locations by default. This increases redundancy and independence from failure and
provides a level of disaster recovery out-of-the-box.
Edge networks: storage, processing and delivery closer to the network edge mean service
reliability and quality is increased overall and local network problems are less likely to have
global side-effects.
Improved timeliness of response to incidents: well-run larger-scale systems, for example due
to early detection of new malware deployments, can develop more effective and efficient
incident response capabilities.
Threat management: cloud providers can also afford to hire specialists in dealing with specific
security threats, while smaller companies can only afford a small number of generalists.

2.2 Security as a market differentiator

Security is a priority concern for many cloud customers customers will make buying choices on the
basis of the reputation for confidentiality, integrity and resilience, and the security services offered by
a provider, more so than in traditional environments. This is currenly still a strong incentive for cloud
providers to improve their security practices and compete on security.

10

Cloud Computing
Benefits, risks and recommendations for information security

2.3 More timely and effective and efficient updates and defaults
Virtual machine images and software modules used by customers can be pre-hardened and updated
with the latest patches and security settings according to fine-tuned processes; moreover, IaaS cloud
service APIs also allow snapshots of virtual infrastructure to be taken regularly and compared with a
baseline (e.g., to ensure software firewall rules have not changed). Updates can be rolled out many
times more rapidly across a homogenous platform than in traditional client-based systems that rely on
the patching model. Finally in PaaS and SaaS models the applications are more likely to have been
hardened to run outside the enterprise environment, which makes them likely to be more portable
and robust than the equivalent enterprise software (where it exists). They are also more likely to be
regularly updated and patched in a centralized fashion minimizing the window of vulnerability.

2.4 Rapid, smart scaling of resources

The list of cloud resources that can be rapidly scaled on demand already includes, e.g., storage, CPU
time, memory, web service requests and virtual machine instances, and the level of granular control
over resource consumption is increasing as technologies mature.
A cloud provider has the potential to dynamically reallocate resources for filtering, traffic shaping,
encryption, etc, in order to increase support for defensive measures (e.g., against DDoS attacks) when
an attack is likely or it is taking place. When this ability for dynamic resource reallocation is combined
with appropriate resource optimisation methods, the cloud provider may be able to limit the effect
that some attacks could have on the availability of resources that legitimately hosted services use, as
well as limit the effect of increasing the use of resources by the security defence to combat such
attacks. Achieving this requires however that the provider implements adequate coordination of
autonomics for security defence and for resource management and optimisation.
The ability to dynamically scale defensive resources on demand has obvious advantages for resilience.
Furthermore, the more all kinds of individual resources can be scaled in a granular way, without
scaling all of the system resources, the cheaper it is to respond to sudden (non-malicious) peaks in
demand.

2.5 Standardised interfaces for managed security services

Large cloud providers can offer a standardised, open interface to managed security services (MSS)
providers offering services to all its customers. This potentially creates a more open and readily
available market for security services where customers can switch providers more easily and with
lower set-up costs.

Cloud Computing
11
Benefits, risks and recommendations for information security

2.6 Audit and evidence-gathering

IaaS offerings support on-demand cloning of virtual machines. In the event of a suspected security
breach, the customer can take an image of a live virtual machine or virtual components thereof for
offline forensic analysis, leading to less down-time for analysis. With storage on tap, multiple clones
can be created and analysis activities parallelised to reduce investigation time. This improves the expost analysis of security incidents and increases the probability of tracking attackers and patching
weaknesses. However, it does presume the customer has access to trained forensic experts (which is
not a standard cloud service as of writing).
It can also provide more cost-effective storage for logs, thus allowing more comprehensive logging
without compromising performance. Pay as you go cloud storage brings transparency to your audit
storage costs and makes adjusting to meet future audit log requirements easier. This makes the
process of identifying security incidents as they happen more efficient (7).

2.7 Audit and SLAs force better risk management

The need to quantify penalties for various risk scenarios in SLAs and the possible impact of security
breaches on reputation (see Security as market differentiator) motivate more rigorous internal audit
and risk assessment procedures than would otherwise be exist. The frequent audits imposed on CPs
tend to expose risks which would not otherwise have been discovered, having therefore the same
positive effect.

2.8 Benefits of resource concentration

Although the concentration of resources undoubtedly has disadvantages for security it has the obvious
advantage of cheaper physical perimiterisation and physical access control (per unit resource) and the
easier and cheaper application of a comprehensive security policy and control over data management,
patch management, incident management, and maintenance processes. The extent to which those
savings are passed on to customers will obviously vary.

12

Cloud Computing
Benefits, risks and recommendations for information security

Risk assessment

3.1 Use-case scenario

The scenario used for the Risk Assessment uses a generic approach, and no statement was intended to
be completely realistic for a specific case, a given cloud client or provider. However, many or even all
elements of this scenario are likely to occur, and should be considered by all organisations.

3.2 Risk assessment process

The level of risk is estimated on the basis of the likelihood of an incident scenario, mapped against the
estimated negative impact. The likelihood of an incident scenario is given by a threat exploiting
vulnerability with a given likelihood.
In many cases the estimate of likelihood depends heavily on the cloud model or architecture under
consideration.
The following shows the risk level as a function of the business impact and likelihood of the incident
scenario. The resulting risk is measured on a scale of 0 to 8 that can be evaluated against risk
acceptance criteria. This risk scale could also be mapped to a simple overall risk rating:

Low risk: 0-2

Medium Risk: 3-5
High Risk: 6-8

Likelihood of

Very Low

Low

Medium

High

Very High

incident

(Very
Unlikely)

(Unlikely)

(Possible)

(Likely)

(Frequent)

Very Low

Low

Medium

Business

High

Impact

Very High

scenario

Cloud Computing
13
Benefits, risks and recommendations for information security

We have based the estimation of risk levels on ISO/IEC 27005:2008 (10).

3.3 Threats, Vulnerabilities, Assets and Risks

A risk is commonly described by a combination of a threat and a vulnerability, affecting an asset. In the
2009 Cloud Risk Assessment, the risks included references to lists of assets and vulnerabilities, while
the risk title in most cases describes the threat involved.
During the first review round, we found that while the lists of assets and vulnerabilities also need some
revision, the risks can stand quite well by themselves because it is rather obvious how the combination
of threat, vulnerability and asset would look like.
In order to keep the document short, the lists of assets and vulnerabilities were therefore omitted for
the time being. In the full revision of the Cloud Risk Assessment, they are likely to be included again, in
revised form.

14

Cloud Computing
Benefits, risks and recommendations for information security

Risks

The following points should be noted in relation to the descriptions of risk below:
-

Risk should always be understood in relation to overall business opportunity and appetite for
risk sometimes risk is compensated by opportunity.
Cloud services are not only about convenient storage, accessible by multiple devices, but
include important benefits such as more convenient communication and instant multi-point
collaboration. Therefore, a comparative analysis needs to compare not only the risks of storing
data in different places (on premises vs. the cloud) but also the risks when on premises-data
stored on premises e.g. a spreadsheet - is emailed to other persons for their contributions,
against the security issues of a spreadsheet stored in the cloud and open to collaboration
between those persons. Therefore, the risks of using cloud computing should be compared to
the risks of staying with traditional solutions, such as desktop-based models.
The level of risk will in many cases vary significantly with the type of cloud architecture being
considered.
It is possible for the cloud customer to transfer risk to the cloud provider and the risks should
be considered against the cost benefit received from the services. However not all risks can be
transferred: if a risk leads to the failure of a business, serious damage to reputation or legal
implications, it is hard or impossible for any other party to compensate for this damage.
The risk analysis in this paper applies to cloud technology. It does not apply to any specific
cloud computing offering or company. This paper is not meant to replace a project-specific
organisational risk assessment.
The level of risks is expressed from the perspective of the cloud customer.

Cloud Computing
15
Benefits, risks and recommendations for information security

The following table shows the distribution of the risk probabilities and impacts:

PROBABILITY
4

R.2

R.19

7
R.7
R.20

R.1

R.8
R.9

R.21

4
R.22

5
R.10

R.6
R.5 (1)R.12
R.4

R.6
R.16

R.23
1

R.15

4
R.18

IMPACT
Figure 1: Risk distribution

The risks are classified into three categories:

Policy and Organizational

Technical

R.11

5
R.13

R.3

R.14

16

Cloud Computing
Benefits, risks and recommendations for information security

Legal.

Each risk is presented in tables which include:

Probability estimate
Impact estimate
Level of risk
Comparison (where applicable) between the Classic IT and Cloud settings. The arrows
show the way the risk changes when moving from the Classic IT to the Cloud setting

As in the original Risk Assessment document, we have not included an overall comparative risk since it
is assumed that all the risks selected are higher in the Cloud setting.

Cloud Computing
17
Benefits, risks and recommendations for information security

4.1 Policy and organizational risks

R.1 Lock-in
Risk number and name

R.1

Short description

Relying strongly on the services of one provider can lead to severe

difficulties in changing the provider. Migrating to another provider
may even become virtually impossible.

Risk rating

Probability: High

Probability in

Comparison to classic IT

Lock-in

Impact: Medium

Risk: High

Cloud services are often based on proprietary nonstandard data formats and application logic. This can
make migrating data and services to another CP difficult
or even impossible,
A missing exit strategy exacerbates this risk.
Lock-in also occurs in the classic IT setting, but in this
case the customer usually has more control over the data
and services.

Impact in
Comparison to classic IT

In both cases, data and own development efforts can be

lost.

There is currently little on offer in the way of tools, procedures or standard data formats or services
interfaces that could guarantee data and service portability. This makes it extremely difficult for a
customer to migrate from one provider to another, or to migrate data and services to or from an inhouse IT environment. Furthermore, cloud providers may have an incentive to prevent (directly or
indirectly) the portability of their customers services and data.
This potential dependency for service provision on a particular CP, depending on the CP's
commitments, may lead to a catastrophic business failure should the cloud provider go bankrupt and
the content and application migration path to another provider is too costly (financially or time-wise)
or insufficient warning is given (no early warning).

18

Cloud Computing
Benefits, risks and recommendations for information security

The acquisition of the cloud provider can also have a similar effect, since it increases the likelihood of
sudden changes in provider policy and non-binding agreements such as terms of use (ToU).
It is important to understand that the extent and nature of lock-in varies according to the cloud type:

SaaS Lock-in
Customer data is typically stored in a custom database schema designed by the SaaS provider.
Most SaaS providers offer API calls to read (and thereby export) data records. However, if the
provider does not offer a readymade data export routine, the customer will need to develop a
program to extract their data and write it to file ready for import to another provider. It should
be noted that there are few formal agreements on the structure of business records (e.g., a
customer record at one SaaS provider may have different fields than at another provider),
although there are common underlying file formats for the export and import of data, e.g.,
XML. The new provider can normally help with this work at a negotiated cost. However, if the
data is to be brought back in-house, the customer will need to write import routines that take
care of any required data mapping unless the CP offers such a routine. As customers will
evaluate this aspect before making important migration decisions, it is in the long-term
business interest of CPs to make data portability as easy, complete and cost-effective as
possible.
Application lock-in is the most obvious form of lock-in (although it is not specific to cloud
services). SaaS providers typically develop a custom application tailored to the needs of their
target market. SaaS customers with a large user-base can incur very high switching costs when
migrating to another SaaS provider as the end-user experience is impacted (e.g., re-training is
necessary). Where the customer has
In using cloud infrastructures, the client
developed programs to interact with the
necessarily cedes control to the CP on a
providers API directly (e.g., for integration
number of issues which may affect security.
with other applications), these will also need
For example ToUs may prohibit port scans,
to be re-written to take into account the new
vulnerability assessment and penetration
providers API.
testing. Moreover, there may be conflicts
between customer hardening procedures and
PaaS Lock-in
the cloud environment. On the other hand,
PaaS lock-in occurs at both the API layer (ie, platform
SLAs may not offer a commitment to provide
specific API calls) and at the component level. For
such services on the part of the cloud provider,
example, the PaaS provider may offer a highly
thus leaving a gap in security defenses.
efficient back-end data store. Not only must the
customer develop code using the custom APIs offered Moreover the cloud provider may outsource or
by the provider, but they must also code data access sub-contract
services
to
third-parties
routines in a way that is compatible with the back-end (unknown providers) which may not offer the
same guarantees (such as to provide the
service in a lawful way) as issued by the cloud
provider. Or the control of the cloud provider
changes, so the terms and conditions of their
services may also change.

Cloud Computing
19
Benefits, risks and recommendations for information security

data store. This code will not necessarily be portable across PaaS providers, even if a seemingly
compatible API is offered, as the data access model may be different (e.g., relational v hashing).

PaaS lock-in at the API layer happens as different providers offer different APIs.
PaaS lock-in happens at the runtime layer as standard runtimes are often heavily customised
to operate safely in a cloud environment. For example, a Java runtime may have dangerous
calls removed or modified for security reasons. The onus is on the customers' developers to
understand and take into account these differences.
PaaS also suffers from data lock-in, in the same way as in SaaS, but in this case the onus is
completely on the customer to create compatible export routines.

IaaS-Lock-in
IaaS lock-in varies depending on the specific infrastructure services consumed. For example, a
customer using cloud storage will not be impacted by non-compatible virtual machine formats.

IaaS computing providers typically offer hypervisor based virtual machines. Software and VM
metadata is bundled together for portability typically just within the providers cloud.
Migrating between providers is non-trivial until open standards, such as OVF (11), are adopted.
IaaS storage provider offerings vary from simplistic key/value based data stores to policy
enhanced file based stores. Feature sets can vary significantly, hence so do storage semantics.
However application level dependence on specific policy features (e.g., access controls) may
limit the customers choice of provider.
Data lock-in is the obvious concern with IaaS storage services. As cloud customers push more
data to cloud storage, data lock-in increases unless the CP provides for data portability.

Common to all providers is the possibility of a run on the banks scenario for a cloud provider. For this
scenario, suppose there is a crisis of confidence in the cloud providers financial position, and
therefore a mass exit and withdrawal of content on a first come, first served basis. Then, in a situation
where a provider limits the amount of content (data and application code) which can be withdrawn
in a given timeframe, some customers will never be able to retrieve their data and applications.
As in any new IT market, competitive pressure, an inadequate business strategy, lack of financial
support, etc, could lead some providers to go out of business or at least to force them to restructure
their service portfolio offering. In other words, it is possible that in the short or medium term some
cloud computing services could be terminated.
The impact of this threat for the cloud customer is easily understandable, since it could lead to a loss
or deterioration of service delivery performance, and quality of service, as well as a loss of investment.
Furthermore, failures in the services outsourced to the CP may have a significant impact on the cloud
customers ability to meet its duties and obligations to its own customers. The customer of the cloud
provider may thus be exposed to contractual and tortuous liability to its customers based on its

20

Cloud Computing
Benefits, risks and recommendations for information security

providers negligence. Failures by the cloud provider may also result in liability by the customer to its
employees.
Acquisition of the cloud provider could increase the likelihood of a strategic shift and may put nonbinding agreements at risk (e.g., software interfaces, security investments, non-contractual security
controls). This could make it impossible to comply with the security requirements. The final impact
could be damaging for crucial assets such as: the organizations reputation, customer or patient trust,
and employee loyalty and experience.

Cloud Computing
21
Benefits, risks and recommendations for information security

R.2 Loss of governance

Risk number and name

R.2

Short description

When using Cloud services, the CC necessarily cedes control to the CP

on a number of issues which may affect security.

Risk rating

Probablity: Very High

Probability in

Ceding control to a service provider lies in the nature of

Cloud services, and of any kind of outsourcing in general,
and is therefore almost certain to occur.

Loss of governance might occur in classic IT scenarios, as

well. If it occurs, the impact will be similar.

Comparison to classic IT
Impact in
Comparison to classic IT

Loss of governance

Impact: Very High

Risk: Very High

In using cloud infrastructures, the client necessarily cedes control to the CP on a number of issues
which may affect security. For example ToUs may prohibit port scans, vulnerability assessment and
penetration testing. Moreover, there may be conflicts between customer hardening procedures and
the cloud environment. On the other hand, SLAs may not offer a commitment to provide such services
on the part of the CP, thus leaving a gap in security defenses.
Moreover the CP may outsource or sub- Certain organisations migrating to the cloud
contract services to third-parties (unknown have made considerable investments in
providers) which may not offer the same achieving certification either for competitive
guarantees (such as to provide the service in a advantage or to meet industry standards or
lawful way) as issued by the CP (see also regulatory requirements (eg, PCI DSS).
below). Or the control of the CP changes, so the
terms and conditions of their services may also change.
The loss of governance and control could have a potentially severe impact on the organizations
strategy and therefore on the capacity to meet its mission and goals. The loss of control and
governance can also lead to the impossibility of complying with the security requirements, a lack of
confidentiality, integrity and availability of data, and a deterioration of performance and quality of
service, not to mention the introduction of compliance challenges, as certain organisations migrating
to the cloud have made considerable investments in achieving certification either for competitive

22

Cloud Computing
Benefits, risks and recommendations for information security

advantage or to meet industry standards or regulatory requirements (e.g., PCI DSS). This investment
may be put at risk by a migration to the cloud:

if the CP cannot provide evidence of

their own compliance to the relevant
requirements;
if the CP does not permit audit by the
CC.

Resource sharing means that malicious

activities carried out by one tenant may affect
the reputation of another tenant.

In certain cases, it even means that using a public cloud infrastructure implies that certain kinds of
compliance cannot be achieved and hence cloud hosted services cannot be used for services that need
them. For example, EC2 says customers would be hard-pressed to achieve PCI compliance on their
platform. So EC2 hosted services cannot be used to handle credit card transactions.
A CP can also outsource certain specialised tasks of its production chain to third parties. In such a
situation the level of security of the CP may depend on the level of security of each one of the links
and the level of dependency of the CP on the third party. Any interruption or corruption in the chain or
a lack of coordination of responsibilities between all the parties involved can lead to: unavailability of
services, loss of data confidentiality, integrity and availability, economic and reputational losses due to
failure to meet customer demand, violation of SLA, cascading service failure, etc.
An important example here is where a critical dependency exists on a third party single-sign-on or
identity management service. In this case, an interruption of the third party service or of the CPs
connection to the service or a weakness in their security procedures may compromise the availability
or confidentiality of a CC or indeed the entire cloud offering.
In general, a lack of transparency in the contract can be a problem for the whole system. If a CP does
not declare which core IT services are outsourced - it is not realistic that providers should list the
contractors since these may change frequently - the CC is not in a position to properly evaluate the risk
he is facing. This lack of transparency could decrease the level of trust in the provider.

Cloud Computing
23
Benefits, risks and recommendations for information security

R.3 Suppy Chain Failure

Risk number and name

R.3

Short description

A CP can outsource parts of its production chain to third parties, or

even use other CPs as part of its service. This way, a potential for
cascading failures is created

Risk rating

Probability: Low

Probability in

Supply chain failiures can occur also in classic IT setups,

but the probability is considered to be higher in Cloud
scenarios.

The potential impact of supply chain failures has to be

considered higher than in classic IT setups, because the
supply chain is likely to be longer and the customers
options fewer.

Comparison to classic IT
Impact in
Comparison to classic IT

Suppy Chain Failure

Impact: Medium

Risk: Medium

A CP can outsource certain specialised tasks of its production chain to third parties, or even use
another cloud service as a backend. In such a situation the level of security of the cloud service
depends on the level of security of each one of the links and the level of dependency of the cloud
provider on the third party. Any interruption or corruption in the chain or a lack of coordination of
responsibilities between all the parties involved can lead to: unavailability of services, loss of data
confidentiality, integrity and availability, economic and reputational losses due to failure to meet
customer demand, violation of SLA, cascading service failure, etc.
An important example here is where a critical dependency exists on a third party single-sign-on or
identity management service. In this case, an interruption of the third party service or of the CPs
connection to the service or a weakness in their security procedures may compromise the availability
or confidentiality of a cloud customer or indeed the entire cloud offering.
In general, a lack of transparency in the contract can be a problem for the whole system. If a CP does
not declare which core IT services are outsourced - it is not realistic that providers should list the
contractors since these may change frequently - the customer is not in a position to properly evaluate
the risk he is facing. This lack of transparency could decrease the level of trust in the provider.

24

Cloud Computing
Benefits, risks and recommendations for information security

R.4 Conflicts between customer hardening procedures and cloud environment

Conflicts between customer hardening procedures and
cloud environment

Risk number and name

R.4

Short description

Certain security measures of a CC may conflict with a CPs

environment, making their implementation by the CC impossible.

Risk rating

Probability: Medium

Probability in

n.a.

Impact: Medium

Risk: Medium

This risk doesnt exist in classic IT settings

Comparison to classic IT
Impact in

n.a.

Comparison to classic IT

CPs must set out a clear segregation of responsibilities that articulates the minimum actions customers
must undertake. The failure of customers to properly secure their environments may pose a
vulnerability to the cloud platform if the CP has not
taken the necessary steps to provide isolation. CPs Customers must realize and assume their
should further articulate their isolation mechanisms responsibility as failure to do so would place
and provide best practice guidelines to assist their data and resources at further risk.
customers to secure their resources.
Customers must realize and assume their responsibility as failure to do so would place their data and
resources at further risk. In some cases CC have inappropriately assumed that the CP was responsible
for, and was conducting, all activities required to ensure security of their data. This assumption by the
customer, and/or a lack of clear articulation by the CP, placed unnecessary risk on the customers data.
It is imperative that CCs identify their responsibilities and comply with them.
CPs, by their very nature, are tasked with providing a multi-tenant environment, whether this is via
virtualization on a server or the common network shared by the customers. The co-location of many
customers inevitably causes conflict for the CP as customers communication security requirements
are likely to be divergent from each other.

Cloud Computing
25
Benefits, risks and recommendations for information security

Take, for example, the case of two customers on a shared traditional network infrastructure. If one
customer wishes the network firewall to block all traffic except for SSH, but another customer is
running a web server farm and requires passage of HTTP and HTTPS, who wins? This same type of
issue is raised by customers who have competing and conflicting compliance requirements. This type
of challenge only worsens as the number of tenants and the disparity of their requirements increase.
Therefore, CPs must be in a position to deal with these challenges by way of technology, policy and
transparency (where appropriate).

26

Cloud Computing
Benefits, risks and recommendations for information security

R.5 Social engineering attacks

Risk number and name

R.5

Short description

Social engineering is understood to mean the art of manipulating

people into performing actions or divulging confidential information.
While it is similar to a confidence trick or simple fraud, it is typically
trickery or deception for the purpose of information gathering, fraud,
or computer system access; in most cases the attacker never comes
face-to-face with the victims.

Risk rating

Probability: Medium

Probability in

Due to the involvement of different organisations, the

probablility for social engineering attacks is considered
higher. This is mostly due to the greater attack surface
created by the interaction between two different
entities.

If a social engineering attack occurs, the impact will be

the same in both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Social engineering attacks

Impact: High

Risk: Medium

Cloud Computing
27
Benefits, risks and recommendations for information security

4.2 Technical risks

R.6 Resource exhaustion (under or over provisioning)
Risk number and name

R.6

Resource Exhaustion

Short description

As Cloud services are on-demand services, there is the possibility

that the CP wont be able to

meet an increased demand in a certain shared resource, or

to maintain a given service level.

Ris rating for failing to meet Probability: Medium

an increase in demand

Impact: Medium

Risk: Medium

Risk rating for failing to Probability: Low

maintain the current service
level

Impact: High

Risk: Medium

Probability in

Resource exhaustion can also occur in classic IT settings.

As the CP is supposed to have an effective capacity
management in place that will make it unlikely that a
resource exhaustion event occurs, the probability is
considered lower in a Cloud setting.

If a resource exhaustion event occurs, the impact will be

the same in both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Cloud services are on-demand services. Therefore there is a level of calculated risk in allocating all the
resources of a cloud service, because resources are allocated according to statistical projections.
Inaccurate modelling of resources usage - common resources allocation algorithms are vulnerable to
distortions of fairness - or inadequate resource provisioning and inadequate investments in
infrastructure can lead, from the CP perspective, to:

Service unavailability: failure in certain highly specific application scenarios which use a
particular resource very intensively (ie, CPU/Memory intensive number crunching or
simulation (eg. forecasting stock prices;

28

Cloud Computing
Benefits, risks and recommendations for information security

Access control compromised: in some cases it may be possible to force a system to fail open
in the event of resource exhaustion.
Economic and reputational losses: due to failure to meet customer demand.
The opposite consequences of inaccurate estimation of resource needs could lead to:
Infrastructure oversize: excessive provisioning leading to economic losses and loss of
profitability.

From the CC perspective, a poor provider selection and lack of supplier redundancy could lead to:

Service unavailability: failure in the delivery (or degrading performance) of services both in real
time and not in real time;
Access control system compromised: put the confidentiality and Integrity of data at risk;
Economic and reputational losses: due to failure to meet customer demand, violation of SLA,
cascading service failure, etc.

Note: this risk could be also a consequence of a DDoS

attack and of misbehaving applications due to poor
application compartmentalization in some CPs
systems.

There is a level of calculated risk in allocating

all the resources of a cloud service, because
resources are allocated according to statistical
projections.

Cloud Computing
29
Benefits, risks and recommendations for information security

R.7 Isolation failure

Risk number and name

R.7

Short description

In shared environments, errors or attacks can lead to situations where

one tenant has access to another tenants resources or data. In the
case of attacks, an attacker gets access to the resources or data of a
specific customer, or even of all customers of the Cloud service.

Risk rating

Probability: High

Probability in

Isolation failures can also occur in classic IT settings, but

due to the shared nature of Cloud services and the
exposed interfaces, the probability is considered higher
for Cloud services.

The impact of an isolation failure is considered the same

for both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Isolation failure

Impact: High

Risk: High

Multi-tenancy and shared resources are two of the defining characteristics of cloud computing
environments. Computing capacity, storage, and network are shared between multiple users.
This class of risks includes the failure of mechanisms separating storage, memory, routing, and even
reputation between different tenants of the shared infrastructure (e.g., so-called guest-hopping
attacks, SQL injection attacks exposing multiple customers data stored in the same table, and side
channel attacks).
Note that the likelihood (probability) of this incident scenario depends on the cloud model considered;
it is likely to be low for private clouds and higher (medium) in the case of public clouds.
The impact can be a loss of valuable or sensitive data, reputation damage and service interruption for
cloud providers and their clients.
Resource sharing also means that malicious activities carried out by one tenant may affect the
reputation of another tenant. For example, spamming, port scanning or the serving of malicious
content from cloud infrastructure can lead to:

30

Cloud Computing
Benefits, risks and recommendations for information security

a range of IP addresses being blocked, including the attacker and other innocent tenants of an
infrastructure;
confiscation of resources due to neighbour activities (neighbour subpoenaed).

The impact can be deterioration in service delivery and data loss, as well as problems for the
organizations reputation.

Cloud Computing
31
Benefits, risks and recommendations for information security

R.8 Cloud provider malicious insider - abuse of high privilege roles

Cloud provider malicious insider - abuse of high privilege
roles

Risk number and name

R.8

Short description

Malicious insiders at the CP can cause various kinds of damage to a

CCs assets.

Risk rating

Probability: Medium

Probability in

The malicious insider threat also exists in classic IT

settings, but the likelihood of an incident has to be
considered higher because admin roles at CPs provide
more temptation and more opportunities.

The impact caused by mailicious insider is considered the

same for both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Impact: Very high

Risk: High

The malicious activities of an insider could potentially have an impact on: the confidentiality, integrity
and availability of all kind of data, IP, all kind of services and therefore indirectly on the organizations
reputation, customer trust and the experiences of employees. This can be considered especially
important in the case of cloud computing due to the fact that cloud architectures necessitate certain
roles which are extremely high-risk. Examples of such roles include CP system administrators and
auditors and managed security service providers dealing with intrusion detection reports and incident
response. As cloud use increases, employees of cloud providers increasingly become targets for
criminal gangs (as has been witnessed in the financial services industry with call centre workers).

32

Cloud Computing
Benefits, risks and recommendations for information security

R.9 Management interface compromise (manipulation, availability of infrastructure)

Management interface compromise
availability of infrastructure)

(manipulation,

Risk number and name

R.9

Short description

The customer management interfaces of public cloud providers are

Internet accessible and mediate access to larger sets of resources
(than traditional hosting providers) and therefore pose an increased
risk especially when combined with remote access and web browser
vulnerabilities.

Risk rating

Probability: Medium

Probability in

This risk doesnt exit in classic IT settings

If management interfaces are compromised in classic IT

settings, the impact is the same as for Cloud settings.

Impact: Very high

Risk: High

Comparison to classic IT
Impact in
Comparison to classic IT

The customer management interfaces of public cloud providers are Internet accessible and mediate
access to larger sets of resources (than traditional
hosting providers) and therefore pose an increased The customer management interfaces of public
risk especially when combined with remote access cloud providers are Internet accessible and
and web browser vulnerabilities. This includes mediate access to larger sets of resources
customer interfaces controlling a number of virtual (than traditional hosting providers) and
machines and, most importantly, CP interfaces therefore pose an increased risk especially
controlling the operation of the overall cloud system. when combined with remote access and web
Of course, this risk may be mitigated by more browser vulnerabilities.
investment in security by providers.

Cloud Computing
33
Benefits, risks and recommendations for information security

R.10

Intercepting data in transit

Risk number and name

R.10

Short description

Whenever data is transferred between different computers or sites,

there is the possibility that the transfer can be intercepted, This is
especially relevant in shared environments and when data is
transferred between sites (e.g. between CC and CP).

Risk rating

Probability: Medium

Probability in

The risk of data being intercepted is considerably higher

in Cloud environments, because these always involve
both a shared environment and transfers between sites.

If data is intercepted, the impact is the same in both

Cloud and classic IT settings.

Comparison to classic IT
Impact in
Comparison to classic IT

Intercepting data in transit

Impact: High

Risk: Medium

Cloud computing, being a distributed architecture, implies more data in transit than traditional
infrastructures. For example, data must be transferred in order to synchronise multiple distributed
machine images, images distributed across multiple physical machines, between cloud infrastructure
and remote web clients, etc. Furthermore, most use of data-centre hosted computing is implemented
using a secure VPN-like connection environment, a practice not always followed in the cloud context.
Sniffing, spoofing, man-inthe-middle attacks, side channel and replay attacks have to be considered
as possible threat sources.
Moreover, in some cases the CP does not offer a confidentiality or non-disclosure clause or these
clauses are not sufficient to guarantee respect for the protection of the customers secret information
and know-how that will circulate in the cloud.

34

Cloud Computing
Benefits, risks and recommendations for information security

R.11

Insecure or ineffective deletion of data

Risk number and name

R.11

Short description

Deleting data from Cloud storage does not in fact mean that the data
is removed from the storage or eventual backup media. If disk storage
is not encrypted, the data could be accessed at at later time by
another customer of a Cloud provider

Risk rating

Probability: Medium

Probability in

Scaling up or down resources and moving data around is

a characteristic of the Cloud deployment model. In this
context, the probability of a data exposure due to
ineffective deletion is considered higher than in a classic
IT setting.

The impact of a data exposure is considered the same for

both Cloud and classic IT settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Insecure or ineffective deletion of data

Impact: Very high

Risk: High

Whenever a provider is changed, resources are scaled down, physical hardware is reallocated, etc,
data may be available beyond the lifetime specified in the security policy. It may be impossible to carry
out the procedures specified by the security policy, since full data deletion is only possible by
destroying a disk which also stores data from other clients. When a request to delete a cloud resource
is made, this may not result in true wiping of the data
There are several different scenarios in which a
(as with most operating systems). Where true data
cloud customer's resources may be used by
wiping is required, special procedures must be
other parties in a malicious way that has an
followed and this may not be supported by the
economic impact.
standard API (or at all).
If effective encryption is used then the level of risk may be considered to be lower.

Cloud Computing
35
Benefits, risks and recommendations for information security

R.12

Distributed denial of service (DDoS)

Risk number and name

R.12

Short description

Distributed Denial of Service attacks aim at overloading a resource

(network or service interface) by flooding it with requests from many
sources distributed across a wide geographical or topological area,
so that the legitimate users are unable to use the resource as
intended.

Risk rating

Probability: Medium

Probability in

The probability of a DDoS attack affecting a particular

customer is considered lower than the probability of a
standalone service being affected by a targeted DDoS
attack. The reason is that a Cloud provider is expected
to have better resources and mitigation techniques
available than an individual company could have.

The impact of a DDoS attack is considered to be the

same in both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Distributed denial of service (DDoS)

Impact: High

Risk: Medium

36

Cloud Computing
Benefits, risks and recommendations for information security

R.13

Economic denial of service (EDoS)

Risk number and name

R.13

Short description

As a consequence of attacks, poor budget planning, or misconfigurations, the cost of a Cloud service can strain the financial
resources of a CC to an extent that the service is no longer affordable.

Risk rating

Probability: Low

Probability in

Although this risk is to some extent also present in classic

IT settings, it becomes much more relevant in Cloud
settings, because resources are allocated and billed
dynamically.

If an EDoS event occurs, the impact will be the same both

in a classic IT and in Cloud setting.

Comparison to classic IT

Impact in
Comparison to classic IT

Economic denial of service (EDoS)

Impact: High

Risk: Medium

There are several different scenarios in which a CC's resources may be used by other parties in a
malicious way that has an economic impact:

Identity theft: an attacker uses an account and uses the customer's resources for his own gain
or in order to damage the customer economically.
The CC has not set effective limits on the use of paid resources and experiences unexpected
loads on these resources through no malicious actions.
An attacker uses a public channel to use up the CC's metered resources - for example, where
the customer pays per HTTP request; a DDoS attack can have this effect.

EDoS destroys economic resources; the worst case scenario would be the bankruptcy of the customer
or a serious economic impact.

Cloud Computing
37
Benefits, risks and recommendations for information security

R.14

Compromise of Service Engine

Risk number and name

R.14

Compromise of Service Engine

Short description

The service engine is a fundamental part of a Cloud service. A

compromise of the service engine will give an attacker access to the
data of all customers, resulting in a potential complete loss of data or
denial of service.

Risk rating

Probability: Low

Probability in

Impact: Very high

Risk: High

This risk does not exist in classic IT settings.

Comparison to classic IT
Impact in

n.a.

Comparison to classic IT

Each cloud architecture relies on a highly specialized platform, the service engine that sits above the
physical hardware resources and manages customer resources at different levels of abstraction. For
example, in IaaS clouds this software component can be the hypervisor. The service engine is
developed and supported by cloud platform vendors and the open source community in some cases. It
can be further customized by the CPs.
Like any other software layer, the service engine code can have vulnerabilities and is prone to attacks
or unexpected failure. An attacker can compromise
Cloud providers must set out a clear
the service engine by hacking it from inside a virtual
segregation of responsibilities that articulates
machine (IaaS clouds), the runtime environment
the minimum actions customers must
(PaaS clouds), the application pool (SaaS clouds), or
undertake.
through its APIs.
Hacking the service engine may be useful to escape the isolation between different customer
environments (jailbreak) and gain access to the data contained inside them, to monitor and modify the
information inside them in a transparent way (without direct interaction with the application inside
the customer environment), or to reduce the resources assigned to them, causing a denial of service.

38

Cloud Computing
Benefits, risks and recommendations for information security

R.15

Loss of Cryptographic Keys

Risk number and name

R.15

Short description

The loss or compromise of cryptographic keys used for encryption,

authentication or digital signatures can lead to data loss, denial of
services, or financial damages

Risk rating

Probability: Low

Probability in

This risk is also present in classic IT settings, but

cryptographic techniques are more likely to be used in
Cloud settings

If a loss of cryptographic keys occurs, the impact is

considered the same both in classic IT and in Cloud
settings.

Comparison to classic IT
Impact in
Comparison to classic IT

Loss of Cryptographic Keys

Impact: High

Risk: Medium

This includes disclosure of secret keys (SSL, file encryption, customer private keys, etc) or passwords to
malicious parties, the loss or corruption of those keys, or their unauthorised use for authentication and
non-repudiation (digital signature).

Cloud Computing
39
Benefits, risks and recommendations for information security

R.16

Non Cloud-Specific Network-Related Technical Failures or Attacks

Non Cloud-Specific Network-Related Technical Failures or
Attacks

Risk number and name

R.16

Short description

Cloud services can be affected by a number of network-related

technical failures that can also occur on classic IT settings. Examples
include the loss of Internet connectivity due to failures at the CCs site
or the CCs Internet service provider, temporarily reduced network
bandwidth on the path between CC and CP, disruptions in the global
Internet routing infrastructure leading to the loss of the network path
between CC and CP, and failures of the CPs Internet connectivity.

Risk rating

Probability: Medium

Probability in

Network-related technical failures or attacks can occur

both in Cloud and in classic IT settings.

The impact of network-related failures is considered

higher in a Cloud setting because of the rather
immediate effect on the performance or even the
availability of the Cloud service.

Comparison to classic IT
Impact in
Comparison to classic IT

Impact: Medium

Risk: Medium

40

Cloud Computing
Benefits, risks and recommendations for information security

R.17

Loss of Backups

Risk number and name

0
Loss of Backups

Short description

The backups a CP makes of its customers data can get lost,

damaged, or the physical media on which the backup is stored can
get stolen.

Risk rating

Probability: Low

Probability in

The probability of a loss of backups is considered lower

in a Cloud setting because it is assumed that a CP will
have better protection mechanisms in place than an
average CC.

If backups are lost or stolen, the impact is the same for

both Cloud and classic IT settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Impact: High

Risk: Medium

Cloud Computing
41
Benefits, risks and recommendations for information security

R.18

Natural disasters

Risk number and name

R.18

Short description

Natural disasters like flooding, earthquakes, tsunamis can affect the

infrastructure of a CP. This way, a CC might be affected by natural
disasters occurring far away from its own location.

Risk rating

Probability: Very low

Probability in

The probability of a natural disaster affecting a Cloud

service is considered lower for a Cloud service than for
classic IT because it is assumed that a CP has more
redundancy built into its infrastructure than an average
CC.

If a natural disaster does affect a Cloud service, the

impact is considered higher than in a classic IT setting,
because the recovery efforts of a CP will not be focussed
on restoring service to a particular customer, but rather
to restore the service in general. Therefore, the time to
recovery may be higher than in a classic IT setting.

Comparison to classic IT

Impact in
Comparison to classic IT

Natural disasters

Impact: High

Risk: Medium

Generally speaking, the risk from natural disasters is lower compared to traditional infrastructures
because CPs often offer multiple redundant sites and network paths by default. This is illustrated e.g.
by the 2011 Japan earthquake where classic IT often failed, but no large datacentre went down.

42

Cloud Computing
Benefits, risks and recommendations for information security

4.3 Legal risks

R.19

Subpoena and e-discovery

Risk number and name

R.19

Short description

Law enforcement authorities may ask operators of IT infrastructures

to provide information pertaining to criminal cases, or information
may have to be provided during civil lawsuits. In some cases, storage
media or other hardware might be seized as evidence.

Risk rating

Probability: High

Probability in

Due to the shared usage of hardware resources in a

Cloud setting, a CC can also be affected by subpoenas or
civil law suits directed at the CP or third parties, not just
those directed at the CC himself. The probability is
therefore higher in a Cloud setting than in a classic IT
setting.

The impact of subpoena or e-discovery is considered to

be the same in both classic IT and Cloud settings.

Comparison to classic IT

Impact in
Comparison to classic IT

Subpoena and e-discovery

Impact: Medium

Risk: High

In the event of the confiscation of physical hardware as a result of subpoena by law-enforcement

agencies or civil suits, the centralisation of storage as well as shared tenancy of physical hardware
means many more clients are at risk of the disclosure of their data to unwanted parties.
At the same time, it may become impossible for the agency of a single nation to confiscate a cloud
given pending advances around long distance hypervisor migration.

Cloud Computing
43
Benefits, risks and recommendations for information security

R.20

Risk from changes of jurisdiction

Risk number and name

R.20

Risk from changes of jurisdiction

Short description

When data is stored or processed in a data centre located in a country

other than the CCs, there are numerous ways in which the change in
jurisdiction could affect the security of the information.
Examples include:

Data might be seized or the operations of a service disrupted

due to reasons that dont exist in the CCs country.
In some cases, national security interests of the hosting
country might be cited as a reason for seizing data.
Additionally, a CP might be subject to law enforcement or
national security actions from the country its business
headquarters is based in, not just those from the countries
where its data centres are located.

Risk rating

Probability: High

Probability in

This risk is considered to be considerably higher in a

Cloud setting, because a potentially large number of
different countries jurisdictions might be involved.

The impact of an event related to this risk is considered

the same in both classic IT and Cloud settings.

Comparison to classic IT
Impact in
Comparison to classic IT

Impact: High

Risk: High

Customer data may be held in multiple jurisdictions, some of which may be high risk. If data centres
are located in high-risk countries, e.g., those. lacking the rule of law and having an unpredictable legal
framework and enforcement, autocratic police states, states that do not respect international
agreements, etc, sites could be raided by local authorities and data or systems subject to enforced
disclosure or seizure.
Note that we are not implying here that all subpoena law-enforcement measures are unacceptable,
merely that some may be so and that some legitimate seizures of hardware (which appear to be rare)
may affect more customers than the targets of a law-enforcement action depending on how the data
is stored.

44

Cloud Computing
Benefits, risks and recommendations for information security

Cloud Computing
45
Benefits, risks and recommendations for information security

R.21

Data protection risks

Risk number and name

R.21

Short description

Processing data in another country may incur difficulties regarding

data protection legislation, or might even be considered unlawful by
the responsible Data Protection authority.

Risk rating

Probability: High

Probability in

As a CP might move data and processing applications

between data centres located in different countries
even without notifying the CC, the probability has to be
considered higher in a Cloud setting than in a classic IT
setting, where the data processor has full control over
the location.

If difficulties regarding data protection regulations are

encountered, the impact will be the same in both classic
IT and Cloud setting.

Comparison to classic IT

Impact in
Comparison to classic IT

Data protection risks

Impact: High

Risk: High

Cloud computing poses several data protection risks for CCs and CPs.

It can be difficult for the CC (in its role of data controller) to effectively check the data
processing that the CP carries out, and thus be sure that the data is handled in a lawful way. It
has to be clear that the CC will be the main person responsible for the processing of personal
data, even when such processing is carried out by the CP in its role of external processor.
Failure to comply with data protection law may lead to administrative, civil and also criminal
sanctions, which vary from country to country, for the data controller. This problem is
exacerbated in the case of multiple transfers of data e.g., between federated clouds. On the
other hand, some CPs do provide information on the data processing that they carry out. Some
also offer certification summaries of their data processing and data security activities and the
data controls they have in place, e.g., SAS70 certification providers.
There may be data security breaches which are not notified to the controller by the CP.
The CC may lose control of the data processed by the CP. This issue is increased in the case of
multiple transfers of data (e.g., between federated CPs).
The CP may receive data that have not been lawfully collected by its customer (the controller).

46

Cloud Computing
Benefits, risks and recommendations for information security

Cloud Computing
47
Benefits, risks and recommendations for information security

R.22

Licensing Issues

Risk number and name

R.22

Short description

Violating a software suppliers licensing agreements can result in

significant financial penalties or disruptions of service.

Risk rating

Probability: Medium

Probability in

As many software licensing agreements are not yet

cloud aware, the probability of incidents related to
licensing has to be considered higher in a Cloud setting.

The impact of a licensing issue is considered the same in

both settings.

Comparison to classic IT
Impact in
Comparison to classic IT

Licensing Issues

Impact: Medium

Risk: Medium

Licensing conditions, such as per-seat agreements, and online licensing checks may become
unworkable in a cloud environment. For example, if software is charged on a per instance basis every
time a new machine is instantiated then the cloud customers licensing costs may increase
exponentially even though they are using the same number of machine instances for the same
duration.

48

Cloud Computing
Benefits, risks and recommendations for information security

R.23

Intellectual Property Issues

Risk number and name

R.23

Short description

Both in the Cloud and when using certain software and service
environments within the own infrastructure, there is the possibility for
creating original work (new applications, software etc.) tied to this
specific environment. As with all intellectual property, if not protected
by the appropriate contractual clauses, this original work may be at
risk.

Risk rating

Probability: Low

Probability in

The probability of intellectual property issues is

considered higher in a Cloud setting.

The impact of intellectual property issues is considered

the same in both classic IT and Cloud settings.

Comparison to classic IT
Impact in
Comparison to classic IT

Intellectual Property Issues

Impact: Medium

Risk: Medium

Cloud Computing
49
Benefits, risks and recommendations for information security

Conclusions and next steps

Cloud computing is a new way of delivering computing resources, not a new technology. Computing
services ranging from data storage and processing to software, such as email handling, are now
available instantly, commitment-free and on-demand. This new economic model for computing has
found fertile ground and is seeing massive global investment. According to IDCs analysis, the
worldwide forecast for cloud services in 2009 will be in the order of $17.4bn. The estimation for 2013
amounts to $44.2bn, with the European market ranging from 971m in 2008 to 6,005m in 2013. For
cloud computing to reach the full potential promised by the technology, it must offer solid information
security, and therefore, proper consideration and management of risks.
ENISA has played an important role in giving stakeholders an overview of the information security risks
when going cloud . Our 2009 cloud security risk assessment is widely referred to, across EU member
states, and outside the EU. This year we decided to update the assessment of risk and benefits, to
better reflect the current situation. After the first round of reviews, we conclude that the main risks,
when adopting cloud computing, have not changed. We have restructured the risks with the goal of
making the descriptions more uniform.
The updated risk assessment will now be subjected to a second review round by a group of experts set
up by ENISA. At the same time, there will be a more in-depth review of the legal and data protection
aspects of Cloud computing, which were excluded from the first round of review.
ENISA will continue to monitor the developments related to risks of Cloud computing and update the
Risk Assessment as necessary.

50

Cloud Computing
Benefits, risks and recommendations for information security

P.O.

Box
1309,
71001
Greecewww.enisa.europa.eu

Heraklion,