This book provides a comprehensive review of the most up to date
research related to cloud security auditing and discusses auditing the
cloud infrastructure from the structural point of view, while focusing
on virtualization-related security properties and consistency between
multiple control layers. It presents an off-line automated framework for
auditing consistent isolation between virtual networks in
OpenStack-managed cloud spanning over overlay and layer 2 by considering
both cloud layers' views. A runtime security auditing framework for the
cloud with special focus on the user-level including common access
control and authentication mechanisms e.g., RBAC, ABAC and SSO is
covered as well.
This book also discusses a learning-based proactive security auditing
system, which extracts probabilistic dependencies between runtime events
and applies such dependencies to proactively audit and prevent security
violations resulting from critical events. Finally, this book elaborates
the design and implementation of a middleware as a pluggable interface
to OpenStack for intercepting and verifying the legitimacy of user
requests at runtime.
Many companies nowadays leverage cloud services for conducting major
business operations (e.g., Web service, inventory management, customer
service, etc.). However, the fear of losing control and governance still
persists due to the inherent lack of transparency and trust in clouds.
The complex design and implementation of cloud infrastructures may cause
numerous vulnerabilities and misconfigurations, while the unique
properties of clouds (elastic, self-service, multi-tenancy) can bring
novel security challenges. In this book, the authors discuss how
state-of-the-art security auditing solutions may help increase cloud
tenants' trust in the service providers by providing assurance on the
compliance with the applicable laws, regulations, policies, and
standards. This book introduces the latest research results on both
traditional retroactive auditing and novel (runtime and proactive)
auditing techniques to serve different stakeholders in the cloud. This
book covers security threats from different cloud abstraction levels and
discusses a wide-range of security properties related to cloud-specific
standards (e.g., Cloud Control Matrix (CCM) and ISO 27017). It also
elaborates on the integration of security auditing solutions into real
world cloud management platforms (e.g., OpenStack, Amazon AWS and Google
GCP).
This book targets industrial scientists, who are working on cloud or
security-related topics, as well as security practitioners,
administrators, cloud providers and operators.Researchers and
advanced-level students studying and working in computer science,
practically in cloud security will also be interested in this book.
