Forensic by-design framework for cyber-physical cloud systems

•

0 likes•57 views

Forensic by-design framework for cyber-physical cloud systems +91-9994232214,7806844441, ieeeprojectchennai@gmail.com, www.projectsieee.com, www.ieee-projects-chennai.com IEEE PROJECTS 2016-2017 ----------------------------------- Contact:+91-9994232214,+91-7806844441 Email: ieeeprojectchennai@gmail.com

Education

Forensic-by-Design Framework for Cyber-Physical Cloud Systems
Abstract:
As businesses continue to offer customers and employees increased access,
improved software functionality, and continued improvements in supply chain
management opportunities, it raises the risk of cyber-physical attacks on cyber-
physical cloud systems (CPCS). In this article, the authors discuss the challenges
associated with a CPCS attack and highlight the need for forensic-by-design, prior
to presenting their conceptual CPCS forensic-by-design model. The six factors of
the framework are discussed, namely, risk management principles and practices,
forensic readiness principles and practices, incident handling principles and
practices, laws and regulation, CPCS hardware and software requirements, and
industry-specific requirements. Future research topics are also identified.

This document discusses adding event reconstruction to a cloud forensic readiness model. It proposes enhancing the model to include event reconstruction, which examines evidence to identify what caused it and helps create hypotheses for digital forensic investigations. It outlines key aspects of event reconstruction, including posing questions about evidence properties and where/when items were created. The proposed enhanced cloud forensic readiness model incorporates a process for event reconstruction that uses similarity measures and distance functions to distinguish between events, predict their behavior, and discover their underlying structures based on their relationships.

A Resiliency Framework For An Enterprise Cloud

Jeff Nelson

The document summarizes a research paper that proposes a resiliency framework called the Cloud Computing Adoption Framework (CCAF) for enterprise clouds. CCAF includes four major emerging services - software resilience, service components, guidelines, and real case studies - that are designed to improve an organization's security when adopting cloud computing. The framework was validated through a large survey that provided user requirements to guide the system's design and development. CCAF aims to illustrate how software resilience and security can be improved for enterprises moving to the cloud.

Why CCSK with InfosecTrain (1).pdf

infosec train

Security in Cloud Computing For Service Delivery Models: Challenges and Solut...

IJERA Editor

Cloud computing, undoubtedly, is a path to expand the limits or add powerful capabilities on-demand with almost no investment in new framework, training new staff, or authorizing new software. Though today everyone is talking about cloud but, organizations are still in dilemma whether it’s safe to deploy their business on cloud. The reason behind it; is nothing but Security. No cloud service provider provides 100% security assurance to its customers and therefore, businesses are hesitant to accept cloud and the vast benefits that come along with it. The absence of proper security controls delimits the benefits of cloud. In this paper, a review on different cloud service models and a survey of the different security challenges and issues while providing services in cloud is presented .The paper focuses on the security issues specific to service delivery model (SaaS, IaaS and PaaS) of cloud environment. This paper also explores the various security solutions currently being applied to protect cloud from various kinds of intruders.

1376843836 94879193

Editor Jacotech

This document summarizes and compares various encryption algorithms for providing security in cloud computing environments. It first discusses key-policy attribute-based encryption (KP-ABE) which associates attributes with keys and policies with data. It also covers ciphertext-policy attribute-based encryption (CP-ABE) which associates policies with ciphertext and attributes with keys. The document then analyzes expressive KP-ABE and ciphertext-policy attribute set-based encryption (CP-ASBE) which uses hierarchical attribute sets. It concludes that improving previous work to leverage hierarchical attribute sets of users may enhance security and access control when utilizing cloud computing.

1376843836 94879193

Editor Jacotech

This document summarizes and compares various encryption algorithms for providing security in cloud computing environments, including key-policy attribute-based encryption (KP-ABE), ciphertext-policy attribute-based encryption (CP-ABE), and ciphertext-policy attribute set-based encryption (CP-ASBE). KP-ABE associates attributes with keys and policies with data, while CP-ABE associates policies with data and attributes with keys. CP-ASBE improves on CP-ABE by organizing user attributes in a recursive set structure rather than a single set, allowing more flexibility in attribute combination and policy specification. The document analyzes the strengths and weaknesses of each approach for providing fine-grained access control and security for user data

SECURITY CONCERN ON CLOUD BASED ON ATTRIBUTES: AN SURVEY

Editor Jacotech

Database Security Assessment Transcript You are a contracting office.docx

whittemorelucilla

Database Security Assessment Transcript You are a contracting officer's technical representative, a Security System Engineer, at a military hospital. Your department's leaders are adopting a new medical health care database management system. And they've tasked you to create a request for proposal for which different vendors will compete to build and provide to the hospital. A Request For Proposal, or RFP, is when an organization sends out a request for estimates on performing a function, delivering a technology, or providing a service or augmenting staff. RFPs are tailored to each endeavor but have common components and are important in the world of IT contracting and for procurement and acquisitions. To complete the RFP, you must determine the technical and security specifications for the system. You'll write the requirements for the overall system and also provide evaluation standards that will be used in rating the vendor's performance. Your learning will help you determine your system's requirements. As you discover methods of attack, you'll write prevention and remediation requirements for the vendor to perform. You must identify the different vulnerabilities the database should be hardened against. Modern healthcare systems incorporate databases for effective and efficient management of patient healthcare. Databases are vulnerable to cyberattacks and must be designed and built with security controls from the beginning of the life cycle. Although hardening the database early in the life cycle is better, security is often incorporated after deployment, forcing hospital and healthcare IT professionals to play catch-up. Database security requirements should be defined at the requirements stage of acquisition and procurement. System security engineers and other acquisition personnel can effectively assist vendors in building better healthcare database systems by specifying security requirements up front within the request for proposal (RFP). In this project, you will be developing an RFP for a new medical healthcare database management system. Parts of your deliverables will be developed through your learning lab. You will submit the following deliverables for this project: Deliverables • An RFP, about 10 to 12 pages, in the form of a double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations. There is no penalty for using additional pages. Include a minimum of six references. Include a reference list with the report. • An MS-Excel spreadsheet with lab results. There are 11 steps in this project. You will begin with the workplace scenario and continue with Step 1: "Provide an Overview for Vendors." Step 1: Provide an Overview for Vendors As the contracting officer's technical representative (COTR), you are the liaison between your hospital and potential vendors. It is your duty to provide vendors with an overview of your organization. To do so, identify infor.

The document summarizes security issues related to the software as a service (SaaS) model of cloud computing. It discusses traditional security challenges like authentication, authorization, availability and data confidentiality that also affect the SaaS model. It also describes new security issues introduced by the cloud computing paradigm, such as data being stored across multiple locations and servers owned by different providers. The document analyzes these security challenges and proposes some potential solutions discussed in other literature.

IMPROVING PRIVACY AND SECURITY IN MULTITENANT CLOUD ERP SYSTEMS

acijjournal

This paper discusses cloud ERP security challenges and their existing solutions. Initially, a set of definitions associated with ERP systems, cloud computing, and multi-tenancy, along with their respective challenges and issues regarding security and privacy, are provided. Next, a set of security challenges is listed, discussed, and mapped to the existing solutions to solve these problems. This thesis aims to build an effective approach to the cloud ERP security management model in terms of data storage, data virtualization, data isolation, and access security in cloud ERP. The following proposed techniques are used to improve the security for multi-tenant SaaS: database virtualization, implementation of data encryption and search functionality on databases and developed systems, distribution of data between tenant and ERP providers, secure application deployment in multi-tenant environments, implementation of the authentication and developed systems together as a two-factor authentication, and improved user access control for multi-tenant ERP clouds.

A secure service provisioning framework for cyber physical cloud computing sy...

ijdpsjournal

Cyber physical systems (CPS) are mission critical systems engineered by combination of cyber and physical systems respectively. These systems are tightly coupled, resource constrained systems and have dynamic real time applications. Due to the limitation of resources, and in order to improve the efficiency of the CPS systems, they are combined with cloud computing architecture, and are called as Cyber Physical Cloud Computing Systems (CPCCS). These CPCCS have critical care applications where security of the systems is a major concern. Therefore, we propose a Secure Service provisioning architecture for Cyber Physical Cloud Computing Systems (CPCCS), which includes the combination of technologies such as CPS, Cloud Computing and Wireless Sensor Networks. In addition to this, we also highlight various threats/attacks; security requirements and mechanisms that are applicable to CPCCS at different layers and propose two security models that can be adapted in a layered architectural format.

Maintaining Secure Cloud by Continuous Auditing

ijtsrd

Increases in cloud computing capacity, as well as decreases in the cost of processing, are moving at a fast pace. These patterns make it incumbent upon organizations to keep pace with changes in technology that significantly influence security. Cloud security auditing depends upon the environment, and the rapid growth of cloud computing is an important new context in world economics. The small price of entry, bandwidth, and processing power capability means that individuals and organizations of all sizes have more capacity and agility to exercise shifts in computation and to disrupt industry in cyberspace than more traditional domains of business economics worldwide. An analysis of prevalent cloud security issues and the utilization of cloud audit methods can mitigate security concerns. This verification methodology indicates how to use frameworks to review cloud service providers (CSPs). The key barrier to widespread uptake of cloud computing is the lack of trust in clouds by potential customers. While preventive controls for security and privacy are actively researched, there is still little focus on detective controls related to cloud accountability and auditability. The complexity resulting from large-scale virtualization and data distribution carried out in current clouds has revealed an urgent research agenda for cloud accountability, as has the shift in focus of customer concerns from servers to data. M. Kanimozhi | A. Aishwarya | S. Triumal"Maintaining Secure Cloud by Continuous Auditing" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-2 | Issue-3 , April 2018, URL: http://www.ijtsrd.com/papers/ijtsrd10829.pdf http://www.ijtsrd.com/engineering/computer-engineering/10829/maintaining-secure-cloud-by-continuous-auditing/m-kanimozhi

ADVANCED CLOUD PRIVACY THREAT MODELING

csandit

Privacy-preservation for sensitive data has become a challenging issue in cloud computing.Threat modeling as a part of requirements engineering in secure software development provides a structured approach for identifying attacks and proposing countermeasures against the exploitation of vulnerabilities in a system. This paper describes an extension of Cloud Privacy Threat Modeling (CPTM) methodology for privacy threat modeling in relation to processing sensitive data in cloud computing environments. It describes the modeling methodology that involved applying Method Engineering to specify characteristics of a cloud privacy threat modeling methodology, different steps in the proposed methodology and corresponding products. We believe that the extended methodology facilitates the application of a privacy preserving cloud software development approach from requirements engineering to design

ADVANCED CLOUD PRIVACY THREAT MODELING

cscpconf

Privacy-preservation for sensitive data has become a challenging issue in cloud computing. Threat modeling as a part of requirements engineering in secure software development provides a structured approach for identifying attacks and proposing countermeasures against the exploitation of vulnerabilities in a system. This paper describes an extension of Cloud Privacy Threat Modeling (CPTM) methodology for privacy threat modeling in relation to processing sensitive data in cloud computing environments. It describes the modeling methodology that involved applying Method Engineering to specify characteristics of a cloud privacy threat modeling methodology, different steps in the proposed methodology and corresponding products. We believe that the extended methodology facilitates the application of a privacypreserving cloud software development approach from requirements engineering to design.

Whitepaper: Moving to Clouds? Simplify your approach to understand the risks ...

Happiest Minds Technologies

CPS, Cybersecurity Workshop, Cyber Physical Systems (CPS) Workshop

Bryan Len

This 3-day workshop organized by Cyber Physical Systems (CPS) focuses on security and privacy issues related to cyber-physical systems, including medical devices, manufacturing systems, SCADA systems, robotics, autonomous vehicles, and smart cities. The workshop aims to cover security standards, threats, vulnerabilities and mitigation strategies for cyber-physical systems. It will provide an overview of cyber-physical systems and their domains, examine cyber attack vectors, and discuss techniques used in both the physical and cyber domains.

Software Reliability and Quality Assurance Challenges in Cyber Physical Syste...

CSCJournals

Software Reliability is the probability of failure-free software operation for a specified period of time in a specified environment. Cyber threats on software security have been prevailing and have increased exponentially, posing a major challenge on software reliability in the cyber physical systems (CPS) environment. Applying patches after the software has been developed is outdated and a major security flaw. However, this has posed a major software reliability challenge as threat actors are exploiting unpatched and insecure software configuration vulnerabilities that are not identified at the design phase. This paper aims to investigate the SDLC approach to software reliability and quality assurance challenges in CPS security. To demonstrate the applicability of our work, we review existing security requirements engineering concepts and methodologies such as TROPOS, I*, KAOS, Tropos and Secure Tropos to determine their relevance in software security. We consider how the methodologies and function points are used to implement constraints to improve software reliability. Finally, the function points concepts are implemented into the CPS security components. The results show that software security threats in CPS can be addressed by integrating the SRE approach and function point analysis in the development to improve software reliability.

Cyber-insurance and liability caps proposed as incentives by Department of Co...

David Sweigert

It is important to note that while the incentives study was required within 120 days of the date of EO 13636, the preliminary version of the Framework is required within 240 days of the date of EO 13636. In addition, DHS will be establishing a voluntary program to support Framework adoption within 365 days of the signing of EO 13636. This report is limited by the current understanding of what the Framework will entail and would benefit from more specifics to inform the analysis and recommendation of the incentives designed for promoting its adoption. For example, knowledge of the Framework would allow the cost of Framework adoption to be quantified. Since the Framework is still under development, this was not possible, and so the incentives considered were evaluated at a more general level with the understanding that the analysis would be updated as needed as the Framework is developed. Since the Framework is still in development at the time of this writing, the incentives that are intended to promote its adoption were assessed prospectively, in terms of the likelihood that they will motivate organizations to adopt the Framework in the future. It is expected that the most effective incentives will not only promote adoption of the Framework.

A Systematic Literature Review On Cloud Computing Security Threats And Mitig...

Claire Webber

This systematic literature review examines research on cloud computing security threats and mitigation strategies published between 2010 and 2020. The review identified 7 major security threats to cloud services, including data tampering, data leakage, and issues with data storage and intrusion. Data tampering and leakage were highly discussed topics. The findings also indicated that outsourcing data remains a challenge and suggested blockchain as a technology that could help address security issues. The review revealed needs to improve data confidentiality, integrity, and availability in future work.

A Proposed Security Model for Web Enabled Business Process Management System

CSCJournals

Many organizations in industry and civilian government start deploying Business Process Management systems (BPMS) and technology in their IT applications. This could lead to a dramatic operational efficiency improvement on their business and administrative environments. With these atmospheres, the security issue is becoming a much more important challenge in the BPMS literature. The Role-Based Access Control (RBAC) model has been accepted as a promise security model solution and standard. RBAC is able to accomplish the central administration of an organizational specific security policy. It is also able to meet the secure processing needs of many commercial and civilian government organizations. In spite of these facts, RBAC model is not reliable when applying to the BPMS without further modifications and extensions. RBAC is modified to fit with Service oriented (SRBAC), but still not reliable enough to handle BPMS. Authors of that research proposed a security model based on SRBAC model to be more reliable when using with BPMS. Authors of that research named that proposed security model as Improved Role Based Access Control (IRBAC). The IRBAC model is directly applicable to the BPMS. Authors defined a graphical representation and technical implementation of the IRBAC model. This IRBAC model is tested using simple case study. The test compares between the IRBAC model and SRBAC model where IRBAC is implemented in two cases (IRBAC with caching and IRBAC with no caching). The test results show the validity and performability of the IRBAC model.

final security ppt.pptx

SukhpreetSingh519414

This document discusses security challenges and mitigation strategies in cloud computing. It explores common attack types like denial of service attacks, malware injection, and man-in-the-middle attacks. It also covers security challenges, controls, and best practices for cloud environments. These include encryption, access control, logging and monitoring. The document concludes that while adoption of cloud computing is increasing, continued research is still needed to address security threats and develop more robust solutions.

Cps sec sg sg2017 conf_iran

Ahmadreza Ghaznavi

IRJET- Cyber Physical Systems (CPS) and Design Automation for Healthcare Syst...

IRJET Journal

This document discusses cyber-physical systems (CPS) and their potential applications in healthcare. It provides an introduction to CPS, describing them as integrated cyber and physical systems that interact in feedback loops. The document outlines some key challenges in CPS design like integrating heterogeneous components, handling hybrid discrete-continuous dynamics, and adapting to dynamic environments. It then discusses potential applications of CPS in areas like smart traffic control, smart power grids, and medical systems. The document concludes by discussing security challenges in medical CPS and opportunities for future work in this area.

Legal And Regulatory Issues Cloud Computing...V2.0

David Spinks

The document provides an overview of 11 domains related to security in cloud computing. It summarizes recommendations for governance, risk management, compliance, auditing, information lifecycle management, portability and interoperability, traditional security practices, data center operations, incident response, application security, and encryption in cloud environments. The document emphasizes the importance of thorough risk analysis, contractual agreements, ongoing assessment and monitoring when adopting cloud services.

Smart and Secure Healthcare Administration over Cloud Environment

IRJET Journal

This document discusses secure healthcare administration over cloud computing. It proposes using attribute-based encryption and fully homomorphic encryption to securely share health information over the cloud. Attribute-based encryption allows sensitive data to be accessed based on user attributes rather than identities, improving privacy. Fully homomorphic encryption allows computations on encrypted data without decryption, enabling analysis of sensitive data. The document also outlines security measures for the cloud system, including deterrents, prevention, physical security, personnel security and privacy controls.

Presentation_Borne

P. Neil Borne CISSP,CEH,CHFI

1) The document outlines a capstone project on integrating PCI-DSS compliance. The presenter has 17 years of experience in IT networking and infrastructure and various certifications. 2) The project was chosen to gain a deeper understanding of PCI compliance requirements and best practices for network security. It aims to simplify the complex requirements for organizations without dedicated security expertise. 3) A five phase approach is outlined to guide organizations through the PCI compliance process from initiation to ongoing monitoring and maintenance. Each phase is designed to break the requirements into manageable segments.

A Study On Service Level Agreement Management Techniques In Cloud

Tracy Drey

This document discusses techniques for managing service level agreements (SLAs) in cloud computing. It begins with an introduction to cloud computing and SLAs. SLAs establish performance standards and consequences for violations between cloud service providers and their customers. The document then reviews several proposed techniques for SLA management from other researchers: (1) allowing multiple SLAs with different performance metrics, (2) using third-party auditing to verify SLA fulfillment, and (3) a layered approach to prevent SLA violations through self-management of cloud resources. The techniques aim to help cloud providers better satisfy SLAs and retain customers.

IRJET- SAAS Attacks Defense Mechanisms and Digital Forensic

IRJET Journal

This document discusses security challenges and digital forensic techniques for Software as a Service (SaaS) applications in cloud computing environments. It first describes SaaS and its benefits and outlines common security issues like data security, application security, and deployment security. It then reviews related work on securing cloud data storage and integrity. Various digital forensic challenges of investigating crimes in cloud environments are discussed, like lack of transparency and complex virtualized systems. A proposed cloud forensic strategy is described to help investigators collect and analyze evidence from cloud systems in an effective manner. Key security attacks on SaaS like SQL injection and cross-site scripting are also mentioned.

Demand aware network function placement

Forensic by-design framework for cyber-physical cloud systems

Recommended

Recommended

More Related Content

Similar to Forensic by-design framework for cyber-physical cloud systems

Similar to Forensic by-design framework for cyber-physical cloud systems (20)

More from ieeepondy

More from ieeepondy (20)

Recently uploaded

Recently uploaded (20)

Forensic by-design framework for cyber-physical cloud systems