*3.1. Cloud-Related Aspects*

The majority of today's networks and the idea of storing data remotely is greatly inclined to technologies relating to Cloud computing. One of the exceptional demands is for the Cloud to see that services are always made available consistently, the reliability is maintained, and data are supplied as demanded. As mentioned earlier, one of the prime reasons organizations or individuals are reluctant to embrace the quick movement to the Cloud model is the huge concern for information security and privacy. Some acknowledged issues tied to security and privacy in Cloud computing include confidentiality, data security, phishing, and multi-tenancy [50]. This section looks into the various threats aligned with security and privacy within the Cloud computing system and suggests some modalities for threat mitigation.

Cloud computing users adopt different distributed Cloud models based on their specific needs, and because of this, the Cloud security and privacy threats differ according to the infrastructure hosted in the Cloud. According to the Cloud Security Alliance (CSA), major regular threats are information leakages, Denial of Service (DoS) Attack, and Advanced Persistent Threats (APT) [51].

Adequate Cloud infrastructural security largely depends on the established protective technologies with many layers. This brings about the importance of adapting an Intrusion Detection System (IDS) specifically to trace suspected threats intelligently and intercept potential attacks over a network. Furthermore, the various events witnessed can be separated to carry out network status analysis. Resources and services of Cloud CIA are said to encounter different types of threats originating from either inside or outside intruders [52].

### 3.1.1. Cloud Data Security

Data security is an essential aspect that plays a significant role in handling Cloud devices and keeps them running. This may involve protection and restoration guides for data and centers for Cloud services, and data involved in transmissions or transfers must always be protected.

Generally, there is a need for simple ye<sup>t</sup> robust mechanisms that offer a smooth method of learning about Cloud service capabilities before deployment and those that align with Cloud security features during the establishing stage. The presence of Cloud

service providers and Cloud customers also plays a role in the deployment plan since both parties must meet certain data security requirements [53]. Here, issues such as service level negotiation, information traffic, and especially data security will arise [54]. It is important for Cloud service suppliers to properly protect customers' data stored in the Cloud to reduce or eliminate security shortcomings. Techniques used in encrypting data must be very strong to guarantee better data security and implement authentication mechanisms that monitor other information access. Access control through data encryption should be established so that only the rightfully selected employees can reach the data.

### 3.1.2. Cloud Data Privacy

The public Cloud faces more privacy threats, although these threats are very different based on their Cloud model variants. Some of the concerns of the danger here are the proliferation of information, malicious usage by an unauthorized person, and incapability to control by clients [55]. Clients' sensitive documents stored in the Cloud can be reached by attackers using the file's hash codes, with the help of a mechanism used in duplicating information [56]. Risks about privacy are regarded from several angles, such as access control, Cloud systems, customers, and stored information [57]. Knowing data privacy and other relating privacy principles will enormously assist in dealing with the known threat concerns. One vital setback holding some organizations from moving to the Cloud is the fear of losing classified data through information leakage [58].

Most often, people's privacy is breached either knowingly or unknowingly. Accessing a person's private data without their knowledge or authorization is strongly considered an invasion of privacy. Different trends can occur, such as open disclosure, privacy attack, data violation, and other means of attacks. Privacy leakage can be very damaging, but privacy issues can be better managed with the points mentioned below:

	- - Who? The privileged persons to access certain data and who not to.
	- - What? Some detailed data are not made accessible to every worker. So what specific files are permitted for whom?
	- - When? Some data are needed for a period of time, and that period must strictly be controlled when that information has been accessed.

These can be made functional by establishing managemen<sup>t</sup> policies, checks on multidomain, and providing strong managemen<sup>t</sup> keys.

• Encryption of data needs to be sufficiently strong to protect the privacy of the client's files. Weak encryption of data poses a serious challenge to Cloud privacy [61].
