Access Control As a Service in Cloud: Challenges, Impact and Strategies

Abstract

The evolution of service-oriented architecture has given birth to the promising cloud technology, which enables the outsourcing of existing hardware and software information technology (IT) infrastructure via the Internet. Since the cloud offers services to a variety of organizations under the same umbrella, it raises security issues including unauthorized access to resources and misuse of data stored in third-party platform. The fact that the cloud supports multiple tenants is the cause for the biggest concern among organizations: how to prevent malicious users from accessing and manipulating data they have no right to access. In this regard, various access control techniques have been proposed, which concentrate on certain authorization issues like the ease of privilege assignment or the resolution of policy conflicts, while ignoring other important weaknesses such as the lack of interoperability and management issues which arise in the dynamic cloud environment. To cover all these challenges, access control as a service (ACaaS), which stems from its significantly more popular parent, security as a service (SECaaS), is considered a viable solution for mediating cloud service consumers' access to sensitive data. In this chapter, we assist the cloud community in understanding the various issues associated with providing authorization services in the cloud that may be technical, such as privilege escalation and separation of duties, or managerial, such as the steep requirement of time and money for this purpose. ACaaS is the comprehensive

Security-as-a-service: a literature review

“…The group’s policies can address common issues such as data theft. However, Group 1 still faces some challenges: for example, internal data leakage and unauthorized access (Furfaro et al , 2014; Shibli et al , 2014). If the data protection policy is flawed or the EN key is lost, the system may attack more.…”

“…The access controls clause addresses requirements to control access to information assets and information processing facilities (Harter et al , 2018). The controls are focused on the protection against accidental damage or loss (Furfaro et al , 2014), overheating, threats (Shibli et al , 2014), etc. It links to Category 1 IAM in CSA obviously (McLaren et al , 2013; Waters, 2016).…”

Untitled

“…Unauthorized persons have a bar to access that information outside of the organization. Different social engineering attacks, cybercrime has been employed to penetrate into the cloud storage by any unauthorized hacker [31].…”