Page 144 - Big data - Concept and application for telecommunications

4 Big data - Concept and application for telecommunications

8.2.2 Shared environment

Cloud computing provides potential cost savings through massive resource sharing that occurs on a very large
scale. This situation exposes many potentially vulnerable interfaces. For example, different CSCs consume
services from the same cloud simultaneously. As a result, the CSC could potentially have unauthorized access
to other tenants' virtual machines, network traffic, actual/residual data, etc. Any such unauthorized or
malicious access to another CSC's assets might compromise integrity, availability and confidentiality.

For example, multiple virtual machines co-hosted on one physical server share both the central processing
unit (CPU) and memory resources which are virtualized by the hypervisor. This example of challenges covers
the failure of hypervisor isolation mechanisms, thus allowing unauthorized access to the memory or storage
of other virtual machines.

8.2.3 Inconsistency and conflict of protection mechanisms
Due to the decentralized architecture of a cloud computing infrastructure, its protection mechanisms might
be inconsistent among distributed security modules. For example, an access denied by one security module
may be granted by another. This inconsistency might cause problems for an authorized user, and might be
exploited by an attacker, thereby compromising confidentiality, integrity and availability.

8.2.4 Jurisdictional conflict
Data in the cloud can be moved around between data centres, or even across international borders.
Depending on the host country, data will be governed by different applicable jurisdictions. For example, some
jurisdictions, such as the European Union, require extensive protection of personally identifiable information
(PII), which cannot usually be processed in places that do not provide a sufficient level of guaranteed
protection. As a second example, some jurisdictions may treat communications as a service (CaaS) as an
unregulated information service while others treat it as a regulated telephony service. This jurisdictional
conflict can lead to legal complications that impact security, such as rules governing the lawful intercept of
communications by law enforcement authorities, which may affect decisions on cryptography.

8.2.5 Evolutionary risks
One advantage of cloud computing is to postpone some choices from the system design phase to the
execution phase. This means that some dependent software components of a system may be selected and
implemented only when the function requiring them has been executed. However, conventional risk
assessment methodology can no longer match such a dynamically evolving system. A system which has
passed a security assessment during the design phase might have new vulnerabilities introduced during its
lifetime due to changes in software components.

8.2.6 Bad migration and integration

Migrating to the cloud often implies moving large amounts of data and major configuration changes (e.g.,
network addressing). Migration of a part of an ICT system to an external CSP might require substantial
changes in the system design (e.g., network and security policies). A bad integration caused by incompatible
interfaces or inconsistent policy enforcement might result in both functional and non-functional impacts. For
example, virtual machines that run behind a firewall in a private data centre are accidently exposed to the
open Internet in the CSP's cloud.

8.2.7 Business discontinuity
Cloud computing allocates resources and delivers them as a service. The whole cloud computing ecosystem
is composed of many interdependent parts. The discontinuity of any part (such as a blackout, denial-of-
service or delay) might affect cloud computing service availability connected with clause 8.1.5 "Service
unavailability", and then cause business discontinuity.

8.2.8 Cloud service partner lock-in
The platform of the CSP is built using software and hardware components from various suppliers. Some
components may include proprietary features or extensions that are useful to the CSP. However, relying on
these proprietary features limits the CSP's ability to migrate to another component supplier.

136 Security, privacy and data protection