Consider a cloud based storage-as-a-service provider. It provides a storage serv

Question

Consider a cloud based storage-as-a-service provider. It provides a storage service similar to Dropbox, where user files on their personal storage (e.g. laptop hard drives) are synchronized and saved in the cloud. 1. What is the attack surface of this storage service (i.e. where are the places the system (or user data) can be attacked?). 2. What are the assets in this system that should be protected? 3. Who can be the attacker and what capability can they have? (i.e. are they external or internal? What can an external attacker do? What can an internal attacker do? What is their motivation:?)

Explanation / Answer

1) What is the attack surface of this storage service (i.e. where are the places the system (or user data) can be attacked?).

Attack Surfaces are below

1) Cloud Storage/ Hard Drive/Physical Attack Surface ( Storage / Database area that can be compromised)

2) Communication/Network Attack Surface ( Network that is it is opearting can be compromised)

3) Software Attach Surface (software that is running can be compromised)

What are the assets in this system that should be protected?

Assets that are protected are below

1) Physical Storage/ Database Storage

2) Network Communication ( can be protected using secure network communication / HTTPS)

3) Software Program / Software Assets (like security keys)

Who can be the attacker and what capability can they have? (i.e. are they external or internal? What can an external attacker do? What can an internal attacker do? What is their motivation:?)

Attaccker can be anyone external or internal , external attacker can be hacker, and internal attacker can be any internal individual who wants to distrupt the security of company(e.g employee)

-> External attacker can snif the network traffic if it is unsecured then it will steal the information from network, external attacker can hack the internal system to gain the access to the system.

-> Internal attack always has the credentials so it might bring down the cloud server , exposes private assets outside etc.

Chhers :) Do upvote if you are satisfied.

Related Questions

Navigate

• Browse (All)
• Browse C
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.