Cloud Computing Software Security Fundamentals

Cloud Computing Software Security Fundamentals

• Cloud software security is crucial, especially with Software as a Service (SaaS). The responsibility for secure software development now lies with the cloud provider.

• Software Assurance, as defined by the U.S. Department of Defense (DoD), is the confidence level that software functions as intended and is free from vulnerabilities. The Data and Analysis Center for Software (DACS) specifies three key properties for secure software: dependability, trustworthiness, and survivability.

Cloud Information Security Objectives

• CIA Triad: Confidentiality, integrity, and availability are essential pillars of cloud software assurance.

• Confidentiality: Protecting sensitive information from unauthorized access. Crucial aspects include intellectual property rights, covert channels (hidden communication paths), traffic analysis, and inference (deducing sensitive data from publicly available information). Encryption is key to protect data in transit.

• Integrity: Maintaining the accuracy and trustworthiness of data. Modifications by unauthorized users or processes must be prevented. Important aspects are internal and external data consistency (data consistency between systems and across different views).

• Availability: Ensuring reliable and timely access to cloud data and resources by authorized personnel. System functionality, security service operation, and resilience against denial-of-service attacks are crucial aspects. The reverse of CIA (confidentiality, integrity, and availability), is disclosure, alteration, and destruction.

Cloud Security Services

• Authentication: Verifying user identities and establishing their claimed identities (who they say they are).

• Authorization: Defining the rights and privileges granted to individuals or processes, determining the extent of their access to resources and information.

• Auditing: Monitoring and recording activities. The audit trail or logs contain records of all processing activities in the system, helping to trace the origin of transactions and follow backward from reports/records. This encompasses activities such as who processed the transaction, the date/time of the transaction, the terminal used, along with security events related to transactions.

• Accountability: Determining accountable individuals and actions within the cloud system. Tracking who performed specific actions (or denying accountability). Audit logs and trails directly support this characteristic.

Threat Identification in Cloud

• Cloud security leverages technologies and techniques to protect data, applications, and infrastructure. Cloud service providers use a shared responsibility model, dividing security concerns between the provider and the customer as cloud users.

• Stage 1: Monitoring Data: Systems should identify deviation from typical behaviour, which then triggers alarms and initiates monitoring by security experts. This can utilize machine learning for efficient event flagging.

• Stage 2: Gaining Visibility: Identifying the source of the threat using tools. AWS CloudTrail is an example of a logging service that records API calls, helping trace activity and find compromised users.

• Stage 3: Managing Access: Identifying and restricting access by malicious actors (hackers) and wiping out related spam/malicious activity. AWS IAM (Identity and Access Management) can be used for granular management of permissions and access controls.

Cloud Security Design Principles

• Principle 1: Protection of Data in Transit: Secure the movement of data via encryption, service authentication, and network security.

• Principle 2: Asset Protection and Resilience: Safeguard data and systems, encompassing compliance with laws and resilience against loss, damage, and seizure using encryption and data center security.

• Principle 3: Separation Between Customers: Implement security boundaries to prevent interactions between customers.

• Principle 4: Governance Framework: Establish security governance that ensures continuous security improvement through the service lifespan.

• Principle 5: Operational Security: Methods to protect from external attacks (malicious actors) and internal threats. Includes protective monitoring, configuration/change management and incident management.

• Principle 6: Personnel Security: Management of personnel with access to data and systems, using comprehensive technical measures.

• Principle 7: Secure Development: Cloud services are designed, developed, and deployed to mitigate security threats using a strong software development lifecycle.

• Principle 8: Supply Chain Security: Ensuring the security of the supply chain to customer data and services. The security measures used by the supplier should match the customer's security standards.

• Principle 9: Secure User Management: Tools that enable secure user access management, preventing unauthorized access to resources and applications. Implements role-based access control for data access control.

• Principle 10: Identity and Authentication: Restrict access to service interfaces for authenticated and authorized identities.

• Principle 11: External Interface Protection: Secure external APIs, web consoles, and command lines.

• Principle 12: Secure Service Administration: A secure design, implementation, and management for the provider's administrative systems, complying with industry best practices.

• Principle 13: Audit Information and Alerting for Customers: Providing audit logs and alert mechanisms in case of attempted attacks or security breaches.

• Principle 14: Secure Use of the Service: Cloud providers aid user in maintaining compliance with security obligations, by enabling secure use.