Attack, Vulnerability and Defense Approaches in Cloud Security
Özet
Cloud computing has revolutionized digital infrastructure by offering scalable, highly cost-effective service models—public, private, and hybrid—spanning Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and serverless architectures. However, storing vital organizational data and hosting critical applications in centralized environments makes the cloud a prime target for cyber adversaries. Major cloud vulnerabilities stem from security misconfigurations, insecure application programming interfaces (APIs), loss or theft of intellectual property, unmonitored insider actions, compliance violations, and systemic software flaws. These security gaps expose cloud systems to multi-level threats across application, network, and user domains, including malware injection attacks like SQL injection and cross-site scripting (XSS), ARP and cookie poisoning, backdoors, domain name system (DNS) exploits, Denial of Service (DoS), Man-in-the-Middle (MitM) interceptions, and phishing schemes. To mitigate these pervasive risks, organizations must deploy comprehensive defense mechanisms. Core countermeasures include Web Application Firewalls (WAF), Host and Network Intrusion Detection/Prevention Systems (HIDS/NIDS), robust end-to-end encryption, strict identity and access management, routine penetration testing, and periodic security audits. Ultimately, while specialized technological tools are essential, achieving robust cloud security depends fundamentally on establishing well-defined security policies, user training, and an effective incident response framework.
Referanslar
Aksakallı, İ.K. (2019). Bulut bilişimde güvenlik zafiyetleri, tehditleri ve bu tehditlere yönelik güvenlik önerileri. Uluslararası Bilgi Güvenliği Mühendisliği Dergisi, 5(1), 8-34.
Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security problem. arXiv preprint arXiv:1609.01107.
Andi, H. K. (2021). Analysis of serverless computing techniques in cloud software framework. Journal of IoT in Social, Mobile, Analytics, and Cloud, 3(3), 221-234.
Bendiek, A., & Schulze, M. (2021). Attribution: A major challenge for EU cyber sanctions. An analysis of WannaCry, NotPetya, Cloud Hopper, Bundestag Hack and the attack on the OPCW (No. 11/2021). SWP Research Paper.
Bharadwaj, D. R., Bhattacharya, A., & Chakkaravarthy, M. (2018, November). Cloud threat defense–A threat protection and security compliance solution. In 2018 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM) (pp. 95-99). IEEE.
Bisong, A., & Rahman, M. (2011). An overview of the security concerns in enterprise cloud computing. arXiv preprint arXiv:1101.5613.
Bruschi, D., Ornaghi, A., & Rosti, E. (2003, December). S-ARP: a secure address resolution protocol. In 19th Annual Computer Security Applications Conference, 2003. Proceedings. (pp. 66-74). IEEE.
Byrne, P. (2006). Application firewalls in a defence-in-depth design. Network Security, 2006(9), 9-11.
Christen, M., Gordijn, B., & Loi, M. (2020). The ethics of cybersecurity (p. 384). Springer Nature.
Çelik, K. (2021). Bulut Bilişim Teknolojileri. Bartın Üniversitesi İktisadi ve İdari Bilimler Fakültesi Dergisi, 12(24), 436-450.
Dokuz, A.Ş., & Çelik, M. (2017). Bulut Bilişim Sistemlerinde Verinin Farklı Boyutları Üzerine Derleme. Niğde Ömer Halisdemir Üniversitesi Mühendislik Bilimleri Dergisi, 6(2), 316-338.
Ersever, B., Doğru, İ. A., & Dörterler, M. (2017). Büyük ölçekli veri merkezleri için bulut bilişim kullanarak sunucu sanallaştırma. Gazi Mühendislik Bilimleri Dergisi, 3(1), 20-26.
Giessmann, A., & Stanoevska-Slabeva, K. (2012). Business models of platform as a service (PaaS) providers: Current state and future directions. JITTA: Journal of Information Technology Theory and Application, 13(4), 31.
Göv, S.A., & Erdoğan, D. (2020). Dördüncü Endüstri Devriminin (Endüstri 4.0) Neresindeyiz?. İstanbul Gelişim Üniversitesi Sosyal Bilimler Dergisi, 7(2), 299-318.
Gupta, S., & Gupta, B. B. (2017). Cross-Site Scripting (XSS) attacks and defense mechanisms: classification and state-of-the-art. International Journal of System Assurance Engineering and Management, 8(1), 512-530.
Hao, S., Syed, N. A., Feamster, N., Gray, A. G., & Krasser, S. (2009, August). Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine. In USENIX security symposium (Vol. 9).
Kavzoğlu, T., & Şahin, E. K. (2012). Bulut Bilişim Teknolojisi Ve Bulut Cbs Uygulamaları. IV. Uzaktan Algılama ve Coğrafi Bilgi Sistemleri Sempozyumu, Zonguldak.
Khan, A. Y., Latif, R., Latif, S., Tahir, S., Batool, G., & Saba, T. (2019). Malicious insider attack detection in IoTs using data analytics. IEEE Access, 8, 11743-11753.
Ma, X., Wang, Z., Zhou, S., Wen, H., & Zhang, Y. (2018, June). Intelligent healthcare systems assisted by data analytics and mobile computing. In 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC) (pp. 1317-1322). IEEE.
Magklaras, G. B., & Furnell, S. M. (2005). A preliminary model of end user sophistication for insider threat prediction in IT systems. Computers & Security, 24(5), 371-380.
Modi, C., Patel, D., Borisaniya, B., Patel, A., & Rajarajan, M. (2013). A survey on security issues and solutions at different layers of Cloud computing. The journal of supercomputing, 63(2), 561-592.
Morrow, B. (2012). BYOD security challenges: control and protect your most sensitive data. Network Security, 2012(12), 5-8.
Neto, N. N., Madnick, S., Paula, A. M. G. D., & Borges, N. M. (2021). Developing a global data breach database and the challenges encountered. Journal of Data and Information Quality (JDIQ), 13(1), 1-33.
Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020, June). Backstabber’s knife collection: A review of open source software supply chain attacks. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 23-43). Springer, Cham.
Özdemir, A., & Gökgöz, B. (2018). Bulut bilişimde felaket kurtarma tekniklerinin incelenmesi. Internatıonal Symposium on Innovative Approaches in Scientific Studies, 3, 202-213.
Padhy, R. P., Patra, M. R., & Satapathy, S. C. (2011). Cloud computing: security issues and research challenges. International Journal of Computer Science and Information Technology & Security (IJCSITS), 1(2), 136-146.
Paşaoğlu, C., & Cevheroğlu, E. (2020). Bulut Bilişim Sistemleri Kapsamında Kişisel Verilerin Şifreleme Yöntemleri ile Korunması. Bilişim Teknolojileri Dergisi, 13(2), 183-195.
Prapty, R. T., Md, S. A., Hossain, S., & Narman, H. S. (2020, April). Preventing session hijacking using encrypted one-time-cookies. In 2020 Wireless Telecommunications Symposium (WTS) (pp. 1-6). IEEE.
Sarıtaş, T., & Üner, N. (2013). Eğitimdeki yenilikçi teknolojiler: Bulut teknolojisi. Eğitim ve Öğretim Araştırmaları Dergisi, 2(3), 192-201.
Seyrek, İ. H. (2011). Bulut Bilişim: İşletmeler için Fırsatlar ve Zorluklar. Gaziantep University Journal of Social Sciences, 10(2). 701-713.
Tang, C., & Liu, J. (2015). Selecting a trusted cloud service provider for your SaaS program. Computers & Security, 50, 60-73.
Tayaksi, C., Ada, E., & Kazançoğlu, Y. (2016). Bulut Üretim: İşlemler Yönetiminde Yeni Bir Bulut Bilişim Modeli. Ege Academic Review, 16, 71-84.
Tsai, W., Bai, X., & Huang, Y. (2014). Software-as-a-service (SaaS): perspectives and challenges. Science China Information Sciences, 57(5), 1-15.
Uslu, B., Eren, T., & Özcan, E. (2021). Bulut Bilişim Güvenliği Etki Düzeylerinin Değerlendirilmesi. Uluslararası Bilgi Güvenliği Mühendisliği Dergisi, 7(1), 47-60.
