Saudi cloud infrastructure: a security analysis

Abstract

The growing demand and dependence upon cloud services have garnered an increasing level of threat to user data and security. Some of such critical web and cloud platforms have become constant targets for persistent malicious attacks that attempt to breach security protocol and access user data and information in an unauthorized manner. While some of such security compromises may result from insider data and access leaks, a substantial proportion continues to remain attributed to security flaws that may exist within the core web technologies with which such critical infrastructure and services are developed. This paper explores the direct impact and significance of security in the Software Development Life Cycle (SDLC) through a case study that covers some 70 public domain web and cloud platforms within Saudi Arabia. Additionally, the major sources of security vulnerabilities within the target platforms as well as the major factors that drive and influence them are presented and discussed through experimental evaluation. The paper reports some of the core sources of security flaws within such critical infrastructure by implementation with automated security auditing and manual static code analysis. The work also proposes some effective approaches, both automated and manual, through which security can be ensured throughout the SDLC and safeguard user data integrity within the cloud.

μVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection

“…M OST cyber attacks are caused by the exploitation of one or multiple vulnerabilities [1], [2]. It is unfortunate that vulnerabilities are inevitable, for many reasons (e.g., software complexity, steady growth in internet complexity [3]). Given that vulnerabilities cannot be prevented, an alternate defense approach is to detect and patch vulnerabilities sooner rather than later, leading to the field of vulnerability detection.…”

“…Algorithm 1 elaborates Step I. 3. Consider a library/API function call f vi made in a statement p v , which is represented as a node n in the SDG in question.…”