Cloud Security : A Review of Recent Threats and Solution Models

The most significant barrier to the wide adoption of cloud services has been attributed to perceived cloud insecurity (Smitha, Anna and Dan, 2012). In an attempt to review this subject, this paper will explore some of the major security threats to the cloud and the security models employed in tackling them. Access control violations, message integrity violations, data leakages, inability to guarantee complete data deletion, code injection, malwares and lack of expertise in cloud technology rank the major threats. The European Union invested €3m in City University London to research into the certification of Cloud security services. This and more recent developments are significant in addressing increasing public concerns regarding the confidentiality, integrity and privacy of data held in cloud environments. Some of the current cloud security models adopted in addressing cloud security threats were – Encryption of all data at storage and during transmission. The Cisco IronPort S-Series web security appliance was among security solutions to solve cloud access control issues. 2-factor Authentication with RSA SecurID and close monitoring appeared to be the most popular solutions to authentication and access control issues in the cloud. Database Active Monitoring, File Active Monitoring, URL Filters and Data Loss Prevention were solutions for detecting and preventing unauthorised data migration into and within clouds. There is yet no guarantee for a complete deletion of data by cloud providers on client requests however; FADE may be a solution (Yang et al., 2012)

An Analysis of Various Methods to Identify Web Based Applications Vulnerabilities

Recently Web based applications takes a noteworthy palace in people’s daily routine furthermore as in progress of nation’s different domains as well. Web based applications have undergone a reasonably express improvement within the last few decades and their appreciation is moving faster than that was predictable few years ago. Presently, huge volumes of transactions are prepared online using various Web based applications. Even though these Webs based applications are utilized by a lot of people, in some cases the defense level is vulnerable, and that compiles them prone to obtain negotiation. In most of the eventualities, a client has to be recognized previous to any contact is set upped with the backend data. A precipitate client shouldn't be permitted entrée to the scheme without legal credentials. However, a crafted injection query provides illegal entrée to illegal clients. This is regularly accomplished via SQL Injection input. In spite of the occurrence of dissimilar procedures to discover and avoid SQL injection, still there stays a shocking threat into Web based applications. While working on this paper, we studied and did analysis on various manners of SQL Injection vulnerabilities, different types of assaults, and their recognition and avoidance techniques. Flanking we present our assessment of this analysis. We also clarified future research direction for probabilities and possible expansion of challenge proceedings against different web application attacks. Keywords: Vulnerability, SQL injection, XSS, Web based application, WWW, ID

A survey on SQL injection prevention methods

Database plays a very important role in everyone’s life including the organizations since everything today is connected via Internet and to manage so many data. There is a need of database which helps organizations to organize, sort and manage the data and to ensure that the data which a user is receiving and sending through the mean of database is secure since the database stores almost everything such as Banking details which includes user id, Password and so. Thus, it means that the data are really valuable and confidential to us and therefore security really matters for database. SQL Injection Attacks on the database are becoming common in this era where the hackers are trying to steal the valuable data of an individual through the mean of SQL Injection Attack by using malicious query on the application. This application reveals the individual data by an efficient and the best SQL Injection Prevention technique is required in order to protect the individual data from being stolen by the hackers. Therefore, this paper will be focusing on reviewing different types of SQL Injection prevention methods and SQL injection types. The initial finding of this paper can make comparison of different types of SQL Injection Prevention methods which will enable the Database Administrator to choose the best and the efficient SQL Injection Prevention Method for their organization. Consequently, Preventing of SQL Injection Attack from happening which would ultimately result in no data loss of an user

Shielding against Web Application Attacks - Detection Techniques and Classification

The field of IoT web applications is facing a range of security risks and system attacks due to the increasing complexity and size of home automation datasets. One of the primary concerns is the identification of Distributed Denial of Service (DDoS) attacks in home automation systems. Attackers can easily access various IoT web application assets by entering a home automation dataset or clicking a link, making them vulnerable to different types of web attacks. To address these challenges, the cloud has introduced the Edge of Things paradigm, which uses multiple concurrent deep models to enhance system stability and enable easy data revelation updates. Therefore, identifying malicious attacks is crucial for improving the reliability and security of IoT web applications. This paper uses a Machine Learning algorithm that can accurately identify web attacks using unique keywords. Smart home devices are classified into four classes based on their traffic predictability levels, and a neural system recognition model is proposed to classify these attacks with a high degree of accuracy, outperforming other classification models. The application of deep learning in identifying and classifying attacks has significant theoretical and scientific value for web security investigations. It also provides innovative ideas for intelligent security detection by classifying web visitors, making it possible to identify and prevent potential security threats

Strategic Techniques for Enhancing Web Services Security in Cloud Computing Model

The 21st century has witnessed an integration of enterprise business process with emerging techniques in a quest to maximize opportunities and organisational strength. In spite of these, vulnerabilities and risks still abound due to the integration for an effective operational mechanism. Mitigating against these requires strategic techniques for enhancing web services security. It is on this background that this paper has been presented. A critical study of web services architecture and cloud computing model as an emerging technology has been given a succinct digest. Furthermore, an evaluation of recent trends in web services and cloud computing model security issues were x-rayed. The threat to web services application deployed in cloud computing were identified hence presenting strategic techniques for enhancing web services security as a proactive measure to enhancing enterprise success. This paper concludes by re-iterating the need to understanding various security threats and proactively and dynamically reacting to them. Keywords: Web Services, Cloud Computing, Cross Site Scripting, SQL Injection and Web Securit

Optimization and Evaluation of Authentication System using Blockchain Technology

User data security innovation is a particular concern in protecting one's privacy rights, which is one of the serious violations when an attacker can bypass the user authentication so that it looks like something legitimate and becomes legal. Based on these issues, the research aims at optimizing and evaluating the blockchain-based authentication systems to minimize data leakage, manipulate the data, and modify the data. Blockchain is one of the innovations that can solve this problem. Data or transactions in the blockchain are saved in hash form to make it difficult for hackers to break into them. The Blockchain implementation uses the Solidity programming language to build smart contracts and other tools such as MetaMask, Ganache, and Truffle. The Network Forensics Development Life Cycle (NFLDC) is used as a framework with the following five stages: Initiation, Acquisition, Implementation, Operation, and Disposition. Based on the research conducted, the attack strategy against blockchain-based systems consists of several scenarios covering the Burp Suite, XSS, SQL Injection, and DoS. The results show that the percentage of authentication optimization reaches a value of 90.1%, and 8.9% is the percentage for evaluating systems such as the possibility of cyberattack. Based on these results, this research has achieved its goals and may assist in further research. Doi: 10.28991/esj-2021-SP1-015 Full Text: PD

Security Enhanced Applications for Information Systems

Every day, more users access services and electronically transmit information which is usually disseminated over insecure networks and processed by websites and databases, which lack proper security protection mechanisms and tools. This may have an impact on both the users’ trust as well as the reputation of the system’s stakeholders. Designing and implementing security enhanced systems is of vital importance. Therefore, this book aims to present a number of innovative security enhanced applications. It is titled “Security Enhanced Applications for Information Systems” and includes 11 chapters. This book is a quality guide for teaching purposes as well as for young researchers since it presents leading innovative contributions on security enhanced applications on various Information Systems. It involves cases based on the standalone, network and Cloud environments

What is a Secure Programming Language?

Our most sensitive and important software systems are written in programming languages that are inherently insecure, making the security of the systems themselves extremely challenging. It is often said that these systems were written with the best tools available at the time, so over time with newer languages will come more security. But we contend that all of today\u27s mainstream programming languages are insecure, including even the most recent ones that come with claims that they are designed to be "secure". Our real criticism is the lack of a common understanding of what "secure" might mean in the context of programming language design. We propose a simple data-driven definition for a secure programming language: that it provides first-class language support to address the causes for the most common, significant vulnerabilities found in real-world software. To discover what these vulnerabilities actually are, we have analysed the National Vulnerability Database and devised a novel categorisation of the software defects reported in the database. This leads us to propose three broad categories, which account for over 50% of all reported software vulnerabilities, that as a minimum any secure language should address. While most mainstream languages address at least one of these categories, interestingly, we find that none address all three. Looking at today\u27s real-world software systems, we observe a paradigm shift in design and implementation towards service-oriented architectures, such as microservices. Such systems consist of many fine-grained processes, typically implemented in multiple languages, that communicate over the network using simple web-based protocols, often relying on multiple software environments such as databases. In traditional software systems, these features are the most common locations for security vulnerabilities, and so are often kept internal to the system. In microservice systems, these features are no longer internal but external, and now represent the attack surface of the software system as a whole. The need for secure programming languages is probably greater now than it has ever been