A survey on security issues and solutions at different layers of Cloud computing <s> Security issues related to auditing, regulatory compliance and laws <s> The computational world is becoming very large and complex. Cloud Computing has emerged as a popular computing model to support processing large volumetric data using clusters of commodity computers. According to J.Dean and S. Ghemawat [1], Google currently processes over 20 terabytes of raw web data. It's some fascinating, large-scale processing of data that makes your head spin and appreciate the years of distributed computing fine-tuning applied to today's large problems. The evolution of cloud computing can handle such massive data as per on demand service. Nowadays the computational world is opting for pay-for-use models and Hype and discussion aside, there remains no concrete definition of cloud computing. In this paper, we first develop a comprehensive taxonomy for describing cloud computing architecture. Then we use this taxonomy to survey several existing cloud computing services developed by various projects world-wide such as Google, force.com, Amazon. We use the taxonomy and survey results not only to identify similarities and differences of the architectural approaches of cloud computing, but also to identify areas requiring further research. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Security issues related to auditing, regulatory compliance and laws <s> One of the essential but formidable tasks in cloud computing is to detect malicious attacks and their types. A cloud provider's constraints or inability in monitoring its employees, and lack of transparency, may make the detection process even harder. We found these insiders' activities form similar pattern in the monitoring systems as some other cyber attacks because these also uses huge computer resources. In this paper we first provide a brief overview on the importance of monitoring insiders' activities through a literature survey on cloud computing security. Then, we observe some of the real life insiders' activities that can be detected from the performance data in a hyper visor and its guest operating systems. Rule based learning is successfully used for identification of these activities in this research. We further observe that some of these insiders' activities can on occasions turn into a malicious insider's attack, and thus, need constant monitoring in the cloud environment. <s> BIB002
Audit and compliance to internal processes and external processes must be met with classified requirement and customer agreements, laws, and regulations. Therefore, such policies should be monitored. The multi-tenancy nature of Cloud increases the difficulty of monitoring and logging process of VMs. Due to the dynamic nature of the Cloud, it is difficult to audit and manage compliance by coordination with external auditing and regulatory bodies. There are different types of compliance. The risks associated with each of this compliance are discussed below. Privacy compliance: Only owners of the data are responsible for the security and privacy of their outsourced data even if the data is held by a service provider. This is due to the various laws and regulations in different countries. It poses a risk of data security, confidentiality, and availability. This is an open problem for providing transparency and controlled environment to owners about their data. Geographic compliance: If the tenant or cloud customer operates in the United States, Canada, or the European Union, they are subject to numerous regulatory requirements. These include control objectives for information and related technology. These laws might relate to where the data is stored or transferred, as well as how well this data is protected from a confidentiality aspect. Most of the cloud-based services have lengthy and onerous license agreements that very few businesses and consumers read or understand in their entirety. As a result, Cloud services are often controlled by the terms and conditions that limit a user's right of control and access or give the Cloud service certain rights over the user's own data. Placing geographical and other restrictions on the collection, processing, and transfer of personally identifiable information (PII) and sensitive information limit the usage of Cloud services. Privacy laws in various countries limit organizations to transfer some type of information to other countries, for example, UK businesses storing personal data with the Cloud provider like Salesforce on the basis of their standard terms and conditions could find themselves in breach of UK data protection law [48] . In the Asia-Pacific (APAC) region, Japan, Australia, and many other countries have implemented data protection laws, which require reasonable measures to protect privacy of personal data based on security guidelines of the Organization for Economic Cooperation and Development (OECD) and Asia Pacific Economic Cooperation's (APEC) privacy framework  . In Europe, the European Economic Area (EEA) has enacted data protection laws that follow the European data protection directives  . A set of standards [11] like HIPAA, SOX, FDA, PCI, FISMA, GLBA, OSHA, ISO 27002, Basel II, etc. should be implemented in Cloud to address compliance issues. There is a need here to frame a unified regulatory compliance. Wang et al.  proposed an approach called Oruta (one ring to rule them all) that provides a new privacy-preserving public auditing mechanism for shared data in an untrusted cloud. In this approach, the third party auditor is used that uses ring signatures to build homomorphic authenticators to verify the integrity of the shared data for a static group of users without retrieving the entire data. However, it is not an efficient solution, when user groups are dynamic. Time taken to verify information increases linearly as the number of users increases in a group. Khorshed BIB002 surveyed on the gaps that is slowing down cloud adoption and reviewed challenges on threat remediation. In this work, the author investigated and compared performances of several machine learning techniques to monitor insider activities in the Cloud and concluded that rule based technique C4.5 (decision tree classifier) is an efficient technique to solve the problem of monitoring insiders' activities having similar patterns of some other cyber attacks. Table 4 summarizes security issues at different levels in the Cloud environment. Security measures adopted by major Cloud providers are summarized in Table 5   BIB001 .