carried out, as the most vulnerable link in security is often the employee. White-box testing Testing under the condition that the “attacker” has full knowledge of the internal network, its design, and implementation. Grey-box testing Testing under the condition that the “attacker” has partial knowledge of the internal network, its design, and implementation. Black-box testing Testing under the condition that the “attacker” has no prior knowledge of the internal network, its design, and implementation. Data security There are numerous security threats associated with cloud data services. This includes traditional threats and non-traditional threats. Traditional threats include: network eavesdropping, illegal invasion, and denial of service attacks, but also specific cloud computing threats, such as side channel attacks, virtualization vulnerabilities, and abuse of cloud services. In order to mitigate these threats security controls often rely on monitoring the three areas of the CIA triad. The CIA Triad refers to confidentiality, integrity, as well as access controllability which can be further understood from the following. It is important to note that many effective security measures cover several or all of the three categories. Encryption for example prevents unauthorized access and as a result ensures the confidentiality, availability, and integrity of the data. Backups on the other hand generally cover integrity and firewalls only cover confidentiality and access controllability. Confidentiality Data confidentiality is the property in that data contents are not made available or disclosed to illegal users. Outsourced data is stored in a cloud and out of the owners' direct control. Only authorized users can access the sensitive data while others, including CSPs, should not gain any information about the data. Meanwhile, data owners expect to fully utilize cloud data services, e.g., data search, data computation, and data sharing, without the leakage of the data contents to CSPs or other adversaries. Confidentiality refers to how data must be kept strictly confidential to the owner of said data An example of security control that covers confidentiality is encryption so that only authorized users can access the data. Symmetric or asymmetric key paradigm can be used for encryption. Access controllability Access controllability means that a data owner can perform the selective restriction of access to their data outsourced to the cloud. Legal users can be authorized by the owner to access the data, while others can not access it without permission. Further, it is desirable to enforce fine-grained access control to the outsourced data, i.e.,