Cloud Computing — Privacy & Security Study Guide

Cloud Computing Service Models

4 types — memorize with SIPE

🔑 Mnemonic

S · I · P · E

SaaS → IaaS → PaaS → EaaS — "Services Involving Platforms, Even equipment"

SaaS

Software as a Service

Ready-to-use apps over the internet

The provider hosts the application — you just log in and use it. Nothing to install or maintain.

📌 Gmail, Google Docs, Dropbox, Office 365

IaaS

Infrastructure as a Service

Renting hardware: CPUs, storage, bandwidth

You get the raw computing power — servers, storage, networking — managed externally. Build what you want on top.

📌 Microsoft Azure, Amazon AWS

PaaS

Platform as a Service

Infrastructure + development platform

Beyond hardware — you also get tools to build, test, and deploy apps quickly and cheaply.

📌 Google App Engine, Heroku

EaaS

Equipment as a Service

Connecting physical devices via IoT

The newest model — connecting equipment and devices through the Internet of Things. Growing more affordable.

📌 Smart factory sensors, IoT devices

🧠 Zoom-in trick

Think of each layer building on the previous: SaaS = just use it. IaaS = rent the building. PaaS = rent the building + workshop. EaaS = connect everything in the building.

6 Key Industry Facts

Who uses the cloud and how

Amazon and Microsoft earn an ever-growing share of revenues from cloud services.

Security fears are fading — 60% of IT experts feel adequately protected against database hacks.

Cloud investment is rising across all industries because it saves money by using staff more efficiently.

Nearly half of US Government agencies use the cloud — it's thought to be the largest cloud user of all.

Banks are the most active users due to mobile banking, PayPal, and digital currencies like Bitcoin.

Most companies currently use the cloud primarily for file storage and backup — but this is changing.

12 Advantages of Cloud Computing

Memorize with E·S·F·M·I — then 7 more

🔑 Mnemonic for first 5

E · S · F · M · I

Economical · Storage · Flexibility · Mobility · IT focus — "Every Smart Firm Moves to IT-cloud"

💰

Economical

Pay-as-you-go. No costly hardware to buy or maintain.

🗄️

Increased Storage

Far more storage capacity than any private system.

🔄

Flexibility

Scale up or down as your needs change.

📱

Mobility

Access your data from anywhere, on any device.

🎯

IT Focus Shift

Free IT staff to focus on business goals, not servers.

📊

Insight & Analytics

Built-in analytics give a bird's-eye view of your data.

🤝

Collaboration

Teams share and edit files securely in real-time.

✅

Quality Control

One version of every document — no conflicting files.

🆘

Disaster Recovery

Quick data recovery from any emergency scenario.

🔒

Loss Prevention

Data stays safe in the cloud even if your device fails.

🔁

Auto Software Updates

Apps update automatically — no IT intervention needed.

🌱

Sustainability

Reduces energy use, paper waste, and commuter emissions.

🧠 For the remaining 7

Remember I·C·Q·D·L·A·S — "I Can Quite Directly List All Solutions" (Insight, Collaboration, Quality, Disaster, Loss, Auto-updates, Sustainability)

Disadvantages of Cloud Computing

The flip side — 5 risks

🔑 Mnemonic

D · S · S · L · B

Downtime · Slow internet · Security & legal · Lack of support · Bankruptcy data loss — "Don't Store Secrets, Lawyers Bite"

Downtime — service outages mean you can't access your data or tools
Slow internet = slow work — cloud speed is only as fast as your connection
Security & legal issues — data stored off-site raises jurisdiction and privacy concerns
Lack of support — smaller clients may not receive adequate help in some situations
Bankruptcy = data loss — if the provider goes bankrupt, your data could disappear

Data Breaches

The #1 cloud security threat

May be caused by targeted attacks, human error, app vulnerabilities, or poor security practices
Can expose: health info, financial data, personally identifiable info (PII), trade secrets, IP
Data may be accessed by a hacker, the cloud provider itself, or a third party
Users may never know who accessed their data or how it was misused

⚠️ Why This Is Serious

A breach isn't always from an outside attack — insiders and the cloud provider itself could be the threat. Once your data is breached, you lose control of it permanently.

🧠 Memory Trick

Data breach = H.A.T. — Hacker, Accident (human error), Third-party. Any of these three can cause one.

Hijacking of Accounts

Stolen credentials = total access

Attackers use stolen login info to remotely access sensitive cloud data
They can eavesdrop, falsify data, manipulate transactions, and redirect users to fake sites
With credentials, attackers gain access to critical cloud areas
Compromises the CIA triad: Confidentiality, Integrity, and Availability

🧠 Remember the CIA Triad

Hijacking attacks all three pillars: Confidentiality (data is exposed), Integrity (data is altered), Availability (service is disrupted). CIA = what we're trying to protect.

Malware Injection / Abuse of Cloud Services

Hiding evil code inside the cloud

The cloud's massive storage makes it easy to host and spread malware and illegal software
Malware injections are scripts embedded into cloud services that disguise themselves as valid instances
They run as SaaS components — appearing legitimate to cloud servers
Once executed, attackers can eavesdrop, steal data, and corrupt information

⚠️ The Sneaky Part

The injected code looks like a normal part of the service. The cloud server itself doesn't know it's running malicious code — making it very hard to detect.

Shared Vulnerabilities

Security is a two-way responsibility

Cloud security is a shared responsibility — both provider and client must do their part
Major providers (Google, Microsoft, Dropbox) secure their infrastructure, but fine-grain control is yours
Client responsibilities include: strong passwords, access restrictions, multi-factor authentication
Weak client-side protection can undermine even the best provider security

🧠 Analogy

Think of cloud security like a safe in a secure building. The building (provider) has guards and locks — but you're responsible for the combination to your own safe. If you leave it open, the guards can't help you.

Data Loss

When data disappears forever

Can occur through malicious attack, natural disaster, or accidental deletion by the provider
Fire, earthquake, lightning, or power failure at data centers can cause permanent loss
Amazon permanently destroyed customer data in 2011
Google lost data when its power grid was struck by lightning four times
Solution: carefully review your provider's backup procedures for physical storage and disaster recovery

Key distinction from breaches: A data breach = someone takes your data. Data loss = your data is gone forever. Both are catastrophic but for different reasons.

Ethical Issues in Cloud Computing

5 ethical concerns — memorize with C·S·P·I·D

🔑 Mnemonic

C · S · P · I · D

Compliance · Spiteful activity · Policies ignoring customers · Intellectual property · Discrimination — "Cloud Services Pose Interesting Dilemmas"

📋 Compliance

Providers must follow relevant legal and ethical standards. If they violate compliance requirements, clients legally cannot use them.

😈 Spiteful Activity

Disgruntled employees, ex-contractors, or competitors can sabotage cloud-stored data far more easily than a physical server.

🚫 Policies Ignoring Customers

IT professionals must apply utilitarianism — policies should serve everyone's interests, whether the user is a citizen, a small firm, or a government.

🎬 Intellectual Property

Cloud's easy storage and sharing enables piracy — one person with access can upload copyrighted content for anyone to download for free.

⚖️ Discrimination

In a crisis, vendors may prioritize big-paying accounts over small ones — this is a form of discrimination, since providers owe duty to all customers.

Legal Issues

Jurisdiction, data rights, and compliance across borders

Unknown storage location: Users don't know where their data is stored or who manages it — raising serious privacy concerns.

Cross-border jurisdiction: Data stored in another country falls under that country's laws — users may unknowingly break local regulations.

Conflicting international laws: Processing data in one country, storing in a second, transferring through a third — regulations can conflict and damage international relations.

Third-party access: Customers must know if provider partners or third-party companies have access to their data.

Leftover data rights: If a company stops using a service, who owns the files left behind? This remains a legal grey area.

Unread terms: Users agree to terms without reading them, yet are legally bound — creating silent obligations.

National records: Storing national or government data in the cloud triggers an entirely separate set of legal rules.

🧠 Key concept

Legal problems in cloud = WHERE is data stored + WHO can access it + WHICH laws apply. These three questions drive all cloud legal issues.

Social Issues

The digital divide and inequality

Cloud resources cost money — those who can't afford them are left out
Small companies can't access the same tools and resources as large corporations
This creates an uneven playing field — big businesses can outcompete small ones simply due to budget
Small accounts may receive less attention and support from cloud providers than large paying clients

The core social problem: Cloud computing promised to democratize technology, but cost barriers mean it can actually widen the gap between large and small businesses.

⚡ Quick Cheat Sheet — All Mnemonics

Cloud Models S·I·P·E — "Services Involving Platforms, Even equipment" (SaaS, IaaS, PaaS, EaaS)

Advantages (1–5) E·S·F·M·I — "Every Smart Firm Moves to IT-cloud" (Economical, Storage, Flexibility, Mobility, IT focus)

Advantages (6–12) I·C·Q·D·L·A·S — "I Can Quite Directly List All Solutions" (Insight, Collaboration, Quality, Disaster recovery, Loss prevention, Auto-updates, Sustainability)

Disadvantages D·S·S·L·B — "Don't Store Secrets, Lawyers Bite" (Downtime, Slow, Security, Lack of support, Bankruptcy)

Data Breach Causes H·A·T — Hacker, Accident (human error), Third-party

Account Hijacking Attacks the CIA Triad — Confidentiality, Integrity, Availability

Ethical Issues C·S·P·I·D — "Cloud Services Pose Interesting Dilemmas" (Compliance, Spiteful, Policies, Intellectual property, Discrimination)

Legal Issues Ask WHERE (stored?) + WHO (accesses?) + WHICH (law applies?)

Shared Vulnerability Provider = building security. You = the safe combination. Both must do their part.

Breach vs Loss Breach = someone TAKES your data. Loss = your data is GONE. Both are irreversible.

Network Security & Privacy in the Cloud

⚡ Quick Cheat Sheet — All Mnemonics