Blog

Cloud storage security: comparative study

Today the use of cloud-based storages is becoming more and more popular. Indeed, why should you care about  buying and configuring the server, ensuring its physical and virtual stability, if instead you can actually afford to buy any number of virtual machines and change their quantity  depending on the influx of visitors to your resource.
28 August 2014
Cloud-based testing
Cybersecurity testing
The article by a1qa
a1qa

Today  the use of cloud-based storages is becoming more and more popular. Indeed, why should you care about  buying and configuring the server, ensuring its physical and virtual stability, if instead you can actually afford to buy any number of virtual machines and change their quantity depending on the influx of visitors to your resource. The article by Anna Andreeva, security testing engineer.

Cloud providers allow you to get fast access to all the necessary equipment for virtual work both small sized and enterprise applications with complex business logic and numerous services. In addition, development process of cloud web application does not differ much from applications written in a conventional computer. Definitely, it is convenient. Especially if you must run the project in the short term  and it’s difficult to predict  the number of users. In such cases, cloud “infrastructure as a service» (IaaS) is convenient which offered by a dozen of eminent providers.

However, how safe it actually is to store your data in the cloud? After all, if the server is not in the next room  and  the door is locked with a key, someone definitely has access to it – at least network provider staff.

How safe is the transmission of data from client to the cloud storage? And back? That’s what two most popular providers offering cloud infrastructure are saying about their safety.

Perhaps,  the most famous provider of cloud infrastructure is Amazon EC2, which has long been a leader among competitors.

What the customer gets when entrusts the product to Amazon?

  • Multilevel security. Security mechanisms implemented at several levels:  for host operating systems, virtual instances and virtual guest OS, as well as firewalls and API calls.
  • Hypervisor. Amazon EC2 uses a modified version of the Xen hypervisor, which can significantly improve the performance of virtual machines through paravirtualization. And access to the CPU implemented with separate privileges:  Host OS has the highest level (0), the guest OS – level 1, and the applications have the least privileges (level 3).
  • Isolation instances. Multiple guests can be deployed on one physical machine. Although instances do not have direct access to the physical disk, they are given the virtual data storages.  In order data from different applications do not influence each other in the case of disk space liberation, information from each of the storage units is automatically deleted (the value is set as zero). Memory is not returned to the pool of free memory until the reset process completes.
  • Security of the host OS. Multifactorial authentication system is envisaged for administrative access to the hosts management.  If an employee no longer needs in such access his account canceles.
  • Host OS security. Support of  security here lies entirely on the development team, as provider does not have access to both  – the instances and guest operating systems that are installed on them. It is in fact a strong side in the context of application security (provider can not get the customer’s data) but also creates  potential vulnerabilities for attacks.  Configuration errors can potentially give attacker access to applications, data, and even entire virtual machine.
  • Firewall. By default, all firewall’s  ports are closed. This means that the customer himself must vividly  open the ports for incoming traffic. Amazon provides the ability to split  the levels of access groups (Security Groups).
  • API access. API calls to start or interrupt instances, change firewall settings and other functions signed by a secret key (Amazon Secret Access Key). Access to API is impossible without it. In addition, the API calls are encrypted using kriptogafical SSL protocol.

Read the second part here.

The artilce Cloud Storage Security: AWS Vs.Azure by Anna Andreeva was published in Network Computing online edition, you can read the full version here.

More Posts

6-march-2023-1
21 March 2023,
by a1qa
4 min read
The ultimate QA guide for smoothly migrating to Web 3.0
Find out how businesses can seamlessly migrate to Web 3.0 by relying on quality assurance.
Cybersecurity testing
General
Performance testing
Usability testing
27 February 2023,
by a1qa
5 min read
Reaching HIPAA compliance for eHealth solutions through QA
We reveal HIPAA’s data safety benchmarks and shed light on how software testing may help in its conformity.
Cybersecurity testing
Software lifecycle QA
Mobile app testing
15 February 2023,
by a1qa
4 min read
Mobile app testing guide: win the race with five-star software
Which aspects of mobile apps to test first to produce a really high-quality product? Find the answer to this and other questions related to mobile app testing in the article.
Cybersecurity testing
Functional testing
Mobile app testing
Performance testing
Test automation
Usability testing
qa-trends-in-telecom
30 September 2022,
by a1qa
5 min read
4 telecom trends for 2023 and how to painlessly implement them with QA
It’s time to explore the telecom trends for the upcoming year. Let’s look at them together and also see the value that QA brings for their smooth deployment.
Cybersecurity testing
Migration testing
QA trends
Quality assurance
Test automation
black-friday
29 July 2022,
by a1qa
4 min read
Get ready for Black-Friday-to-Cyber-Monday shopping: 5 testing types to include in your QA strategy
What’s your nightmare during Black Friday and Cyber Monday shopping? If it’s a loss of sales, read about the ways to prevent this in the article.
Cybersecurity testing
Functional testing
Localization testing
Performance testing
Usability testing
30 June 2022,
by a1qa
4 min read
App software testing for telecom: What are the common issues telco providers face?
Facing problems with the quality of your telecom software products? Read more in the article and find out the ways to address them.
Cybersecurity testing
Performance testing
Test automation
20 June 2022,
by Alina Karachun
5 min read
Top-quality IoT solutions: 3 problems and ways to solve them
What quality aspects of IoT solutions are predominant to care about and why? Find the answers in the article.
Cybersecurity testing
IoT testing
Performance testing
19 April 2022,
by a1qa
5 min read
What prevents companies from boosting eCommerce customer experience: 4 common mistakes
Dreaming of a flawless online shopping journey for your users? Explore 4 widespread situations that hamper achieving this goal.
Cybersecurity testing
Performance testing
Test automation
Usability testing
Clutch awards
23 March 2022,
by a1qa
2 min read
a1qa recognized for cybersecurity expertise by Clutch!
The global online review platform Clutch added a1qa to the Top 15 Penetration Testing Companies for 2022.
Cybersecurity testing

Get in touch

Please fill in the required field.
Email address seems invalid.
Please fill in the required field.
We use cookies on our website to improve its functionality and to enhance your user experience. We also use cookies for analytics. If you continue to browse this website, we will assume you agree that we can place cookies on your device. For more details, please read our Privacy and Cookies Policy.