Cloud Computing

Cloud computing is the on-demand delivery of computing resources (servers, storage, databases, networking, software) over the internet on a pay-as-you-go basis, without owning or managing the physical infrastructure.

SaaS (Software as a Service) is a cloud model in which a provider hosts a complete application and delivers it to users over the internet, usually through a web browser and on subscription. Users need not install or maintain it. Examples: Gmail, Google Docs, Salesforce.

A private cloud is a cloud infrastructure used exclusively by a single organization. It may be hosted on-premises or by a third party, and it gives greater control, security and customisation than a public cloud.

Cloud storage is a service in which data is stored on remote servers maintained by a provider and accessed over the internet. Users pay for the space they use and can access, share and back up data from anywhere. Examples: Google Drive, Dropbox, Amazon S3.

SOA (Service-Oriented Architecture) is a software design style in which an application is built from loosely coupled, reusable services that communicate over a network using standard protocols such as SOAP or REST. Each service performs a specific business function.

Virtualization is the technique of creating a virtual (software-based) version of hardware resources such as servers, storage, networks or operating systems, so that many virtual machines can run on one physical machine. It is done using a hypervisor.

Virtual machine security means protecting virtual machines, their guest operating systems, the hypervisor and the data in them from threats such as VM escape, VM sprawl, malware and unauthorized access. It uses isolation between VMs, patching, access control, encryption and monitoring.

Parallel computing is a method in which a large problem is divided into smaller parts that are solved at the same time on multiple processors or cores, and the results are combined. It reduces execution time and is used for large-scale tasks such as simulations and big data processing.

Security monitoring is the continuous observation and analysis of logs, network traffic, user activity and system events in a cloud environment to detect, alert on and respond to threats, intrusions and policy violations in time.

Google App Engine is a Platform as a Service (PaaS) from Google Cloud that lets developers build and host web applications on Google's infrastructure. It handles automatic scaling, load balancing and server management, and supports languages such as Python, Java, Go and Node.js.

PaaS vs IaaS

Public cloud: a cloud whose services are owned and operated by a third-party provider and shared by many customers over the internet, on a pay-per-use basis. Examples: AWS, Microsoft Azure, Google Cloud.

Advantages

• Cost saving: pay-as-you-go, no large upfront hardware cost.
• Scalability and elasticity: resources increase or decrease on demand.
• Accessibility: services available anywhere with an internet connection.
• Reliability and backup: data replication and disaster recovery.
• Automatic updates and maintenance by the provider.

Disadvantages

• Internet dependency: services stop without connectivity.
• Security and privacy concerns: data is held by a third party.
• Vendor lock-in: difficult to move between providers.
• Limited control over the infrastructure.
• Downtime risk if the provider has an outage.

A hypervisor (virtual machine monitor) is software that creates and runs virtual machines by sharing the physical hardware among them. There are two types.

Type 1 (bare-metal / native): runs directly on the physical hardware without a host operating system. It has high performance, better security and is used in data centres. Examples: VMware ESXi, Microsoft Hyper-V, Xen, KVM.

Type 2 (hosted): runs as an application on top of a host operating system, which then manages the hardware. It is easier to install but has more overhead and lower performance, so it suits desktops and testing. Examples: Oracle VirtualBox, VMware Workstation.

Main types of virtualization are:

• Hardware (server) virtualization: one physical server is divided into several virtual machines, each with its own OS. Example: VMware ESXi, Hyper-V.
• Operating-system virtualization: one OS kernel runs multiple isolated user-space instances (containers). Example: Docker, LXC.
• Storage virtualization: multiple physical storage devices are combined and presented as a single storage pool. Example: SAN, RAID-based pools.
• Network virtualization: physical network resources are combined into virtual networks such as VLAN and VPN. Example: VMware NSX.
• Desktop virtualization: the user's desktop environment runs on a central server and is accessed remotely. Example: Citrix VDI.
• Application virtualization: an application runs without being installed on the local OS. Example: Microsoft App-V.

MapReduce achieves parallel efficiency by splitting a large job into independent tasks that run at the same time on many nodes.

• Parallel map phase: the input is divided into splits, and each map task processes its split independently, so work scales with the number of nodes.
• Data locality: tasks are scheduled on the node holding the data, which reduces network transfer.
• Parallel reduce phase: after shuffle and sort, many reducers process different keys at once.
• Fault tolerance: failed or slow tasks are re-executed on other nodes (speculative execution), so the job continues.
• Load balancing: many small tasks keep all nodes busy.

Parallel efficiency is defined as

$E = \frac{T_1}{p \, T_p}$

where $T_1$ is the time on one node and $T_p$ the time on $p$ nodes. It is close to 1 when tasks are independent, but falls because of shuffle communication, stragglers and start-up overhead.

• Data breaches: unauthorized access to sensitive data stored in the cloud.
• Data loss: accidental deletion, hardware failure or provider failure without a backup.
• Insecure interfaces and APIs: weak authentication exposes data.
• Insider threats: misuse of access by employees or the provider's staff.
• Data privacy and compliance: data stored in other countries may breach laws (GDPR and others).
• Multi-tenancy risks: poor isolation may let one tenant see another tenant's data.
• Account hijacking: stolen credentials give control of data.
• Data remanence: data remains after deletion.

Common controls are encryption, access control, multi-factor authentication and regular backups.

Cloud services must meet certain requirements so that users receive reliable, usable and secure service.

• On-demand self-service: users provision resources such as servers or storage automatically without contacting the provider. Example: launching an EC2 instance from the AWS console.
• Broad network access: services are reachable from any device (phone, laptop) over the internet. Example: using Google Docs from a mobile.
• Resource pooling (multi-tenancy): the provider's resources serve many customers, dynamically assigned. Example: many companies sharing the same physical servers in Azure.
• Rapid elasticity and scalability: resources scale up or down quickly with demand. Example: an e-commerce site adding servers during a festival sale.
• Measured service (pay-per-use): usage is metered and billed. Example: paying per GB in Amazon S3.
• Availability and reliability: high uptime guaranteed through SLAs and redundancy.
• Security and privacy: authentication, encryption and compliance.
• Interoperability and portability: ability to move or integrate applications across clouds.
• Performance and low latency: consistent response time.

Cloud security is the set of policies, technologies, controls and procedures used to protect cloud data, applications and infrastructure from threats, unauthorized access, data leaks and loss.

Security goals (CIA triad)

• Confidentiality: only authorized users can see the data (encryption, access control).
• Integrity: data is not altered without authorization (hashing, digital signatures).
• Availability: services and data are accessible when needed (redundancy, backups, DDoS protection).

Key components

• Identity and access management (IAM) with multi-factor authentication.
• Data encryption at rest and in transit.
• Network security: firewalls, VPN, intrusion detection.
• Security monitoring, logging and auditing.
• Compliance and governance, and backup and disaster recovery.

Shared responsibility model: the provider secures the underlying infrastructure, while the customer secures its data, user access and application configuration. The split depends on the service model (IaaS, PaaS, SaaS).

Common threats: data breaches, account hijacking, insecure APIs, insider threats and denial of service.

MapReduce is a programming model for processing large datasets in parallel on a cluster. In Hadoop, its architecture has a master and several workers.

Components

• JobTracker / ResourceManager (master): schedules jobs and tasks and monitors failures.
• TaskTracker / NodeManager (workers): run the map and reduce tasks on their nodes.
• HDFS: stores the input and output data.

Working steps

1. Input splitting: input data in HDFS is divided into fixed-size splits.
2. Map phase: each split is processed by a mapper, which emits intermediate key-value pairs $(k_1, v_1) \rightarrow list(k_2, v_2)$.
3. Shuffle and sort: intermediate pairs are partitioned, transferred to reducers and sorted so that all values of the same key come together.
4. Reduce phase: the reducer processes each key and its list of values $(k_2, list(v_2)) \rightarrow list(k_3, v_3)$.
5. Output: results are written to HDFS.

Example (word count): the mapper emits (word, 1) for each word, and the reducer sums the counts for each word.

Fault tolerance is provided by re-running failed tasks on other nodes, and a combiner can reduce network traffic.

Cloud security architecture is the layered design of controls, technologies and policies that protect the cloud environment.

Layers

• Physical security: data-centre protection such as access control, surveillance and power backup.
• Network security: firewalls, intrusion detection/prevention, VPN, segmentation and DDoS protection.
• Infrastructure and virtualization security: hardened hypervisors, VM isolation and patching.
• Identity and access management: authentication, authorization, multi-factor authentication, role-based access.
• Data security: encryption at rest and in transit, key management, backup and data loss prevention.
• Application security: secure coding, API security, web application firewalls and vulnerability testing.
• Monitoring and incident response: logging, SIEM, auditing and response procedures.
• Governance and compliance: policies, SLAs and standards such as ISO 27001.

Shared responsibility: the provider is responsible for security of the cloud (infrastructure), and the customer for security in the cloud (data, access and configuration). The architecture follows principles of defence in depth and least privilege.

Virtualization

Virtualization is the creation of a virtual version of computing resources (servers, storage, networks, operating systems) by abstracting them from the physical hardware. A software layer called the hypervisor lets several isolated virtual machines (VMs) share one physical machine, each with its own OS and applications.

Role in cloud computing

• Resource pooling and multi-tenancy: physical resources are pooled and shared among many customers securely.
• Scalability and elasticity: VMs can be created, resized or removed quickly as demand changes.
• Cost efficiency: higher hardware utilization means fewer physical servers, less power and space.
• Isolation: faults or attacks in one VM do not affect others.
• Flexibility and portability: VMs can be migrated (live migration), cloned and backed up easily.
• Disaster recovery and high availability: VM snapshots allow fast recovery.
• Basis of IaaS: providers offer virtual servers on demand.

Hypervisor types

Type 1 (bare-metal): installed directly on hardware with no host OS. It gives high performance and security and is used in data centres. Examples: VMware ESXi, Microsoft Hyper-V, Xen, KVM.

Type 2 (hosted): runs as an application over a host OS. It is simple to set up but slower, and suits desktops, development and testing. Examples: Oracle VirtualBox, VMware Workstation, Parallels.

Cloud computing places data and applications under a third party's control, which creates security risks. Each risk below has a matching mitigation.

General strategies

• Apply the shared responsibility model: know what the provider and the customer each secure.
• Perform risk assessment before moving to the cloud.
• Apply identity and access management and the principle of least privilege.
• Continuously monitor logs with SIEM tools and have an incident response plan.
• Define security terms in the SLA and audit the provider regularly.
• Train staff on security awareness.