1. Current Security Threats and Prevention Measures Relating to Cloud Services, Hadoop Concurrent Processing, and Big Data ATHER SHARIF, SARAH COONEY, SHENGQI GONG, DREW VITEK DEPARTMENT OF COMPUTER SCIENCE SAINT JOSEPH’S UNIVERSITY

2. Introduction and Motivation  “Big Data” has become a buzzword in almost every industry  Cloud based services are becoming increasingly popular for data storage and analysis  Massive data breaches are still all too common  The security of cloud services is very much reliant on the measures taken by the service provider  As future computer scientists, we feel that knowledge of Big Data and Cloud security measures is invaluable.

3. Cloud Services  In 2013 50% of US businesses were using some type of cloud service  “Notorious Nine Cloud Computing Threats” 1.Abuse of Cloud Services 2.Account or Service Traffic Hijacking 3.Data Breaches 4.Data Loss 5.Denial of Service 6.Insecure Interfaces and APIs 7.Insufficient Due Diligence 8.Malicious Insiders 9.Shared Technology Vulnerabilities

4. Verizon Cloud Security  4 Layered Approach… Base Security Logical Security Value Added Security Governance Risk & Compliance

5. Big Data  In general, security risks associated with Big Data can be categorized by three V’s… 1. Volume… 2. Velocity… 3. Variety…

6. Theoretical Sticky Policy Framework  Proposed by S. Li, T. Zhang, J. Gao, and Y. Park  Based on the EnCoRe project  Data Center Domain versus Trusted Authority Domain

7. Inside the Trusted Authority Domain  Identity and Key Management Engine  Policy Engine  Policy Portal  Policy Controller  Policy Negotiation Component  Policy Update Component  Enforcement Component  Policy Store

8. Hadoop  Security Vulnerabilities in the Cloud Based System  Difficult to locate and track the node holding a specific file chunk  Chunk Stealing  Chunk Injection

9. Twilio  Implementation of Hadoop via Amazon cloud services  Access Control Based on:  Job Roles  Bucket Policies  Access Control Lists  Physical Security Measures  Third Party Penetration Testing Every 6 Months  Safe Harbor Compliance

10. Conclusion With the continued increase in available data and growth in the use of cloud services, knowledge of how to secure these systems is imperative for any computer science professional, and will provide continued opportunity for jobs and research as we leave school to enter the professional world.