RESEARCH OF CYBER SECURITY TECHNOLOGIES OF CLOUD SERVICES IAAS, PAAS AND SAAS

Abstract

Cybersecurity threats are constantly evolving, and cloud computing is no exception. Attackers are improving attack techniques aimed at identifying vulnerabilities in IaaS, PaaS, and SaaS. The work examines the following problematic issues: insufficient analytical tools; data privacy and security; financial and organizational costs to ensure cyber security of IaaS, PaaS and SaaS cloud technologies. The aim of the work is to investigate how the common models of cloud computing: infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS) need to properly implement adequate and appropriate protection measures to ensure cyber security. For this purpose, the paper examined models of cloud technologies, it was determined that cloud services include various models that allow users to access various types of resources via the Internet. It has been found that there are three generally accepted models of cloud services: infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS), and two main players: the cloud provider and the cloud subscriber. The set of levels over which each of these players has control depends on the model of the cloud service or environment. For each of these cloud services, its description was given, recommendations were given for access control, privacy assurance, terms of use were defined, advantages and disadvantages were given, and market trends of these services were considered. Proposed approaches to the formation of a secure application development environment in cloud services. Features such as wide network access, resource pooling, fast elasticity, service metering, and data sharing are also summarized. Guidelines for designing access control for IaaS, PaaS, and SaaS according to their different characteristics are proposed. In addition, the security policy rules for each cloud system are summarized. Technologies are proposed to protect security at each of the three main layers of cloud services: the application, middleware, and virtual machine layers, due to differences in the organization that controls each of these layers. It was found that for any level it is possible to provide more effective protection if the same subject controls the level below. Since the network, hardware, and resource abstraction layer in all cloud service models are controlled by the cloud provider, it has more effective protections at its disposal.