云计算面临的主要安全威胁有哪些(云计算的安全分为哪几个方面)

1. System security of virtual machines brought by virtualization
Virtualization technology plays an important role in system organization, reducing system operation costs, and improving the efficiency, utilization and flexibility of hardware resources. character of. However, virtualization technology itself not only faces existing security threats in traditional networks, but also faces security issues introduced by itself.
If a system is infected with a virus, will other systems be implicated, whether the isolation work can be done well, and even whether the background storage and data information will be affected. If the virtual machine system crashes, will it affect other virtual machines? This is a very real problem.
2. Identity authentication security, personal information security and transaction security brought about by the rise of e-commerce
E-commerce has become an important development direction of the Internet. Currently, the number of transactions generated by the national network every year The amount has accounted for 9% of all transactions throughout the year, and many valuable and large items also tend to be traded online.
Therefore, the security of e-commerce transactions has become a very urgent issue. However, in this regard, user security protection appears to be very weak. Personal transaction passwords have been stolen, and website or bank database information leakage problems have emerged one after another, becoming New security hotspot.
3. How cloud computing ensures the security of its own key business data
Enterprises put their business in the cloud data center so that users in the system can easily share it, which saves a lot of things. It looks beautiful, but what about the security issue? What if the data is leaked?
This is a question that every CIO has in mind. This issue is both a security issue and an information planning issue, and You need to be familiar with all aspects of cloud computing, including which layer to use for virtualization and how to do it. These issues present both opportunities and challenges for security vendors.
4. Security issues brought about by the impact of mobile users on traditional networks
With the popularization of smartphones and the development of mobile Internet, security issues of mobile terminals are challenging the traditional network attack and defense system. . As we all know, the traditional security protection in the past was to guard the ports of my server, and use firewalls, anti-virus walls, and traffic monitoring to form a Maginot line of defense. In this way, all mail servers, database servers, and various external attacks will be blocked. .
However, when the mobile Internet is integrated into the conventional network, it is estimated that the previous plane has become a three-dimensional one. Many email viruses or attack programs are introduced from mobile phones or PDAs, which makes conventional protection systems face huge challenges.
If enterprises want to ensure the security of cloud data, they must recruit corresponding talents, which has given rise to a new high-paying industry - cloud security engineers.

The security threats faced by cloud computing mainly include the following points:
Security Threat 1: Data Leakage
For Indicating the harm that data breaches can do to an enterprise, CSA mentioned in its report a research article it published in November 2012, which described how hackers exploited side-channel time information to compromise a virtual machine. machine to obtain the private keys used by other virtual machines on the same server. However, in fact, malicious hackers may not necessarily need to take such painstaking efforts to ensure that such an attack is successful. If the multi-tenant cloud service database is improperly designed, even if there is only one vulnerability in a user's application, an attacker can obtain this user's data, and also obtain the data of other users.
Security Threat 2: Data Loss
CSA believes that the second largest threat to the cloud computing environment is data loss. Users may watch those valuable data disappear without a trace, but there is nothing they can do about it. A malicious hacker will delete the target's data. A careless service provider or a disaster (such as a fire, flood, or earthquake) can also result in user data loss. What makes the situation even more serious is that if the user loses the encryption key, the act of encrypting the data will cause trouble for the user.
Security Threat 3: Data Hijacking
The third largest cloud computing security risk is the hijacking of account or service traffic. CSA believes that cloud computing adds a new threat in this regard. If a hacker obtains a company's login information, it is possible for them to eavesdrop on related activities and transactions, manipulate data, return false information, and direct corporate customers to illegal websites. The report states: "Your account or service instance may become a new base for attackers. They will then use your good reputation to launch external attacks." CSA mentioned in the report that Amazon encountered cross-site scripting (XSS) in 2010. )attack.
Security Threat 4: Insecure Interfaces
The fourth largest security threat is insecure interfaces (APIs). IT administrators will use APIs to configure, manage, coordinate and monitor cloud services. APIs are extremely important to the security and availability of cloud services in general. Enterprises and third parties therefore often develop on top of these interfaces and provide additional services. "This adds complexity to interface management," CSA said in the report. "This approach also increases risk by requiring companies to hand over login details to third parties in order to communicate with each other."

Security Threat 5: Denial of Service Attack
Distributed Denial of Service (DDoS) is listed as the fifth largest security threat facing cloud computing. DDoS has been a major threat to the Internet for many years. In the era of cloud computing, many enterprises will require one or more services to maintain 24/7 availability. In this case, this threat becomes particularly serious. Service outages caused by DDoS can cause service providers to lose customers, and can also cause heavy losses to users who pay for cloud services based on usage time and disk space.
Security Threat 6: “Temporary Workers” with malicious intentions
The sixth major threat is insiders with malicious intentions. These people may be current or former employees, contractors, or business Partner. They gain access to networks, systems or data with malicious intent. In scenarios where cloud services are poorly designed, malicious insiders may cause greater damage. From Infrastructure as a Service (IaaS), Platform as a Service (PaaS) to Software as a Service (SaaS), malicious insiders have higher levels of access than outsiders, allowing them to access important systems and ultimately data. .
Security Threat 7: Abuse of Cloud Services
The seventh major security threat is the abuse of cloud services. For example, bad guys use cloud services to crack encryption keys that are difficult for ordinary computers to crack. Another example is malicious hackers using cloud servers to launch distributed denial-of-service attacks, spread malware, or share pirated software.

1. Virtualization security issues: If the physical host is damaged, the virtual server it manages may be compromised due to communication with the physical host. If the physical host and the virtual machine do not communicate, it may There is a virtual machine escape. If the virtual network on the physical host is compromised, the virtual machine will also be compromised due to the communication between the physical host and the virtual machine, and the scenario where one virtual machine monitors another virtual machine.
2. Security issues in data concentration: User data storage, processing, network transmission, etc. are all related to cloud computing systems, including how to effectively store data to avoid data loss or damage, how to isolate data for multi-tenant applications, How to avoid data services being blocked, etc.
3. Cloud platform availability issues: Users’ data and business applications are in a problem system where the cloud platform is attacked. Its business processes will depend on cloud platform service continuity, SLA and IT processes, security policies, event handling and Analysis etc. pose challenges. In addition, when a system failure occurs, how to ensure the rapid recovery of user data has also become an important issue.
4. The problem of attacks on cloud platforms: Due to the high concentration of users and information resources, cloud computing platforms are easy to become targets of hacker attacks. The consequences and destructiveness caused by the denial of service will be significantly greater than that of traditional enterprises. Internet application environment.