Lucy in the sky without diamonds: Stealing confidential data in the cloud

TLDR

Cloud computing offers pay‑per‑use and elasticity benefits, yet it raises security concerns for organizations handling critical data, such as medical records, because data is stored in provider‑owned data centers. The study calls for intensified research into cloud data security. The authors present insider attack scenarios that show how passwords, cryptographic keys, files, and other confidential data can be easily exfiltrated. They demonstrate that malicious insiders can readily steal confidential data and that current protective measures are inadequate.

Abstract

Cloud Computing is a recent paradigm that is creating high expectations about benefits such as the pay-per-use model and elasticity of resources. However, with this optimism come also concerns about security. In a public cloud, the user's data storage and processing is no longer done inside its premises, but in data centers owned and administrated by the cloud provider. This may be a concern for organizations that deal with critical data, such as medical records. We show that a malicious insider can steal confidential data of the cloud user, so the user is mostly left with trusting the cloud provider. The paper achieves this goal by showing a set of attacks that demonstrate how a malicious insider can easily obtain passwords, cryptographic keys, files and other confidential data. Additionally, the paper shows that recent research results that might be useful to protect data in the cloud, are still not enough to deal with the problem. The paper is a call to arms for research in the topic.