ANÁLISIS DE BRECHAS DE SEGURIDAD EN EL ACCESO A DATOS EN LA NUBE PARA SOLUCIONES BIG DATA

Abstract

Providers of data storage in the cloud, allow their customers to share or save any type of information, such as files or documents from any device connected to the Internet. The user seeks that these providers manage to keep their data safe and protected from external attacks, ransomware or any type of data leakage that makes the stored information vulnerable. The purpose of this research work is to identify security breaches in access, existing in two of the storage service providers in the cloud. For the present study, Amazon and Google Cloud were taken as references, the same ones that were chosen under the analysis of international and local surveys (Ecuador); The use of public services in the cloud was defined as indicators, as indicated by SADA Systems, highlighting Google Cloud with 49% as one of the first at the international level. Another of the indicators was by the suppliers of public IaaS, which leads in the part of economic income placing Amazon in the number one position, having more than 51.80% of the entire market. To identify the trend in Ecuador, eleven SMEs were surveyed whose dedication is of different types and they are located in different geographical points of the country. One of the main requirements of the SMEs surveyed to opt for a storage solution in the cloud is access control (Authentication of users and applications), identifying that Google Cloud and Amazon are the cloud service providers most required by them. To identify security gaps in the access of the two selected providers, we worked with the Information Security and Privacy Model (SPI), presenting at the beginning the characteristics of each of the providers for the storage of data in the cloud in regards to access control. The comparison of the two providers in Identification, Authentication and Authorization was made, evaluating the existing security gaps between Amazon and Google Cloud, it was identified that the incorrect administration and the ignorance of the multiple resources that the providers possess, generate an access door to attacks and becomes a vulnerability for those involved.