The growth of cloud computing has raised the need for information security and left some other non-traditional security hazards. There is a pressing requirement for an intensified research effort into technology that can enhance security measures in various types of cloud computing applications, thereby supporting infrastructure, goods, and technologies meant to provide safety. Many products offer cloud computing [1]. The rapid growth of centralized computing has meant that information security is undoubtedly a vital issue, and some new types of insecurity have emerged. Research must be done to create more secure cloud-based services for companies to use. This will help to support the technology, infrastructure, and security goods for cloud computing applications as well as services. Some global Information Technology (IT) enterprises have unveiled many products based on cloud computing, but it still poses considerable security challenges [1]. It has experienced few cases of breaches; furthermore, the term' cloud computing' itself has become common among people who are increasingly enlightened about it. Today, when using or moving towards clouds, there are mostly security issues that attract attention more than ever before, hence becoming the greatest problem now. Without resolving this problem, the cloud would not help industries transform or upgrade applications easily. Therefore, studies should be carried out in the field of cloud computing security with great practical significance. These problems include increased threat levels because of the proliferation of computing within organizations and accompanying sensitive data movement trends; besides, system administrators cannot know all the objects on their network ultimately since devices like tablets keep emerging every day [2]. This is due to a few security incidents, as well as the widespread adoption of the cloud computing concept and people's growing awareness of it. As a result, security is now the most significant concern when using cloud computing or migrating to the cloud. This problem is not solved; cloud computing would be complicated for industrial upgrading and applications. Therefore, cloud computing security research has important practical significance.

Cloud security is a set of policies, strategies, controls, procedures, and practices designed to protect the data, resources, and applications hosted on the cloud from various threats. Cloud security entails multiple aspects, such as data center security, access control, threat prevention, detection and mitigation, redundancy, legal compliance, and cybersecurity policy. Virtualization technology has been adopted at a significant level by many data centers in the industry. It provides benefits like server consolidation, live migration, data security, and less power consumption. At the same time, storage virtualization abstracts physical storage (SAN, NAS) resources from front-end applications running in the system. Storage virtualization is helpful for maintaining large volumes of data with a continuous backup facility. Bele and Desai [5] look at the idea or concept of virtualization beyond mere server virtualization and give us other lines to explore when looking at the value of virtualization overall. Any technology that really permeates the market typically can perform multiple functions but is usually part of a larger technology. The main research questions addressed by the literature review are:

I. What are the benefits of cloud security for organizations and users?

II. What are the main challenges and risks associated with cloud security?

III. What are the current and future developments and trends in cloud security?

Identification of cloud security as:

I. Security democratization: cloud security enables organizations to access advanced security solutions and services without requiring extensive resources or expertise.

II. Continuous visibility: cloud security provides organizations with real-time monitoring and reporting of their cloud assets and activities, enhancing their situational awareness and accountability.

III. Increased resiliency: cloud security enhances the availability and reliability of cloud services and resources, reducing the impact of disruptions and disasters.

IV. Comprehensive defense: loud security offers a holistic and multi-layered approach to protect cloud assets from a wide range of existing and emerging threats, such as DDoS attacks, malware infections, data breaches, and identity theft.

V. Automated regulatory compliance: cloud security helps organizations meet the legal and ethical requirements and standards of their industry and jurisdiction, reducing the risk of violations and penalties.

The cloud computing infrastructure's virtualization methods inherently provide a vulnerable surface. The following are the main security issues we can see in a cloud situation. Privilege user access: to reduce the possibility of high privilege role abuse, only a small group of trustworthy users should be able to access sensitive data in the cloud. Reliability and availability: the cloud provider must build up an efficient replication and recovery strategy to restore services in the event of a security breach-lack of data/computation isolation: One instance of client data must be totally isolated from data belonging to other customers [6]. The autonomy of position in the way but to some extent position independence, that is, the user does not know and can't control their resource's physical location while in case some of them have a virtual position at the higher abstract levels such as country, state, province or data center. This word has many meanings because there are different books. There was no strict definition of virtualization during its formative stage, as it was usually used undefinedly. Virtualization is generally taken to be a method where computer components operate on a hypothetical base rather than a real one and can be seen as a solution for simplification of management and optimal usage of resources [7].

The comparative analysis of existing models for cloud security and virtualization revealed several key insights into the strengths, weaknesses, and applicability of different approaches:

I. Cloud security models: the review highlighted diverse frameworks such as ISO/IEC 27017, CSA STAR, CIS, and MITRE ATT&CK, each offering unique perspectives on cloud security architecture and benefits. While ISO/IEC 27017 emphasizes industry-specific security requirements and regulatory compliance, CSA STAR focuses on transparency and assurance in cloud service provider evaluations. CIS offers prescriptive security controls, whereas MITRE ATT&CK focuses on adversary tactics and techniques. Understanding the scope, objectives, and approach of these frameworks is crucial for organizations to select the most suitable model based on their specific needs and requirements.

II. Benefits of cloud security: the analysis underscored the multifaceted benefits of cloud security, including visibility, higher availability, adequate protection against DDoS attacks, data security, and pay-as-you-go flexibility. Cloud security enables organizations to access advanced security solutions without requiring extensive resources or expertise, enhancing their ability to meet legal and ethical requirements while reducing the risk of violations and penalties [21], [22].

III. Virtualization security frameworks: in exploring virtualization security, the study identified the importance of effective organization and management, mainly through virtual system security and virtualization security management modules. Understanding the layers of virtualization, from the physical resource layer to VMs, is essential for implementing robust security mechanisms to protect against vulnerabilities and threats [23], [24].

IV. Levels of virtualization: the analysis delved into different levels of virtualization, including ISA Level, Hardware Abstraction Layer (HAL) level, and operating system level. Each level offers distinct advantages and challenges, from binary compatibility and performance to hardware utilization and resource allocation. Examples such as Xen, VMware, and containerization technologies showcase the diversity of virtualization approaches available to organizations [25].

V. Implications for research and practice: these findings have a significant impact on both research and practice in cloud security and virtualization. By understanding the strengths and weaknesses of existing models and frameworks, organizations can make informed decisions when selecting, implementing, and managing cloud security measures. Future research should focus on addressing gaps in current approaches, exploring emerging trends and technologies, and advancing the state-of-the-art in cloud security and virtualization [26]. In conclusion, the comparative analysis provides valuable insights into the complexities and opportunities inherent in cloud security and virtualization. By leveraging these findings, organizations can enhance their security posture and resilience in an increasingly digital and interconnected landscape.

In conclusion, the comprehensive review of cloud security models and virtualization frameworks illuminates the diverse landscape of approaches available to organizations seeking to fortify their digital infrastructure. The exploration of ISO/IEC 27017, CSA STAR, CIS, and MITRE ATT&CK frameworks underscores the importance of aligning security measures with industry-specific requirements, regulatory compliance, transparency, and adversary tactics. Moreover, the benefits of cloud security, including enhanced visibility, availability, protection against DDoS attacks, and flexible scalability, highlight its pivotal role in modern data protection strategies. Similarly, the examination of virtualization security frameworks emphasizes the necessity of robust organization and management, considering the layers and levels of virtualization. This synthesis not only informs decision-making processes for selecting suitable security models but also underscores the need for ongoing research and innovation in cloud security and virtualization. By addressing existing gaps, exploring emerging technologies, and advancing best practices, organizations can effectively navigate the evolving landscape of cybersecurity threats and challenges in the digital age.