Security-by-design in Clouds: A Security-SLA Driven Methodology to Build Secure Cloud Applications

Procedia Computer Science

Volumn 97, Issue , 2016, Pages 53-62

  Casola, Valentina ^a   De Benedictis, Alessandra ^a   Rak, Massimiliano ^b   Rios, Erkuden ^c  

^a UNIVERSITY OF NAPLES FEDERICO II   (Italy)

^b SECOND UNIVERSITY OF NAPLES   (Italy)

^c TECNALIA RESEARCH AND INNOVATION   (Spain)

Author keywords

Secure Cloud Applications; Secure Multi cloud Applications; Security by design; Security SLA; Threat analysis

Indexed keywords

RISK ANALYSIS; RISK ASSESSMENT;

CLOUD APPLICATIONS; DESIGN METHODOLOGY; MULTI-CLOUDS; RISK ASSESSMENT TOOL; SECURITY CONTROLS; SECURITY REQUIREMENTS; SECURITY SLA; THREAT ANALYSIS;

DESIGN;

EID: 84999025090     PISSN: None     EISSN: 18770509     Source Type: Conference Proceeding    
DOI: 10.1016/j.procs.2016.08.280     Document Type: Conference Paper

References (27)

1. Deloitte,. Executive forum - cloud computing: risks, mitigation strategies, and the role of internal audit. 2010. URL:. http://www.deloitte.com.
2. European Network and Information Security Agency (ENISA),. Procure secure. a guide to monitoring of security service levels in cloud. contracts. 2012.
3. SPECS project web site. 2016. URL: http://www.specs-project.eu.
4. MUSA project web site. 2016. URL: http://www.musa-project.eu.
5. The proof-of-concept SLA Generation application. 2016. URL: http://37.48.247.125/TESI-0.0.1-SNAPSHOT/welcome.
6. V. Casola, A. De Benedictis, M. Rak, and U. Villano Preliminary Design of a Platform-as-a-Service to Provide Security in Cloud. In:. CLOSER 2014 Proc. of the 4th Int. Conf. on Cloud Computing and Services Science, Barcelona, Spain April 3-5 2014 2014 752 757
7. M. Rak, N. Suri, J. Luna, D. Petcu, V. Casola, and U. Villano Security as a service using an SLA-based approach via SPECS Proc. of CloudCom, 2013 IEEE 5th Int. Conf. on; 2 2013 1 6 10.1109/CloudCom.2013. 165
8. National Institute of Standards and Technology,. SP 800-53 Rev 4: Recommended Security and. Privacy Controls for Federal Information Systems and Organizations. Tech. Rep.; 2013. URL:. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf.
9. A. Andrieux, K. Czajkowski, A. Dan, K. Keahey, H. Ludwig, T. Nakata, and et al. Web services agreement specification (WS-Agreement) Global Grid Forum. The Global Grid Forum (GGF) 2004
10. International Organization for Standardization,. ISO/IEC NP 19086-1. Information Technology-Cloud computing-Service level agreement. (SLA) framework and technology-Part 1: Overview and concepts. 2014.
11. European Commission - C-SIG (Cloud Select Industry Group) subgroup,. Cloud Service Level Agreement Standardisation Guidelines. 2014.
12. Cloud Standard Customer Council - CSCC,. The CSCC practical guide to cloud service level agreements. April 2012.
13. V. Casola, A. De Benedictis, M. Rak, J. Modic, and M. Erascu Automatically enforcing Security SLAs in the cloud IEEE Transactions on. Services Computing (PrePrints) 2016
14. V. Casola, A. De Benedictis, M. Rak, and U. Villano SLA-Based Secure Cloud Application Development: The SPECS Framework 2015 17th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC). 2015 337 344 10.1109/SYNASC. 201559
15. Cloud Security Alliance. Cloud Control Matrix v3.0. https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3/;. 2016.
16. The OWASP Top 10 2013. Project Home Page. 2016. URL: https://www.owasp.org/index.php/Category:OWASP Top Ten Project.
17. The STRIDE Threat Model. 2016. URL: https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).asp.
18. The OWASP Risk Rating MethodologyWiki Page. 2016. URL: https://www.owasp.org/index.php/OWASP Risk Rating Methodology.
19. Kreizman, G., Robertson, B. Incorporating security into the enterprise architecture process. 2006. URL:. https://www.gartner.com/doc/488575/incorporating-security-enterprise-architecture-process.
20. R. Crook, D. Ince, L. Lin, and B. Nuseibeh Security requirements engineering: When anti-requirements hit the fan Requirements. Engineering, 2002. Proceedings. IEEE Joint International Conference on. IEEE; 2002 203 205
21. J. Rushby Security requirements specifications: How and what Symposium on Requirements Engineering for Information Security. (SREIS); Citeseer; 441 2001
22. S. Myagmar Threat Modeling as a Basis for Security Requirements StorageSS'05: Proceedings of the 2005 ACM workshop on Storage. security and survivability 2005 94 102
23. Oladimeji, E.a., Supakkul, S., Chung, L. Security threat modeling and analysis: A goal-oriented approach. Proc of the 10th IASTED International Conference on Software Engineering and Applications SEA 2006 2006;:13-15URL:. https://pipeline.utdallas.edu/eao015100/documents/SecurityThreatModeling.pdf.
24. S. Gupta, V. Muntes-Mulero, P. Matthews, J. Dominiak, A. Omerovic, J. Aranda, and et al. Risk-driven framework for decision support. in cloud service selection Cluster, Cloud and Grid Computing (CCGrid), 2015 15th IEEE/ACM International Symposium on. 2015 545 554 10.1109/CCGrid.2015. 111
25. Martens, B., Teuteberg, F. Decision-making in cloud computing environments: A cost and risk based approach. Information Systems. Frontiers 2012;14(4):871-893. URL: http://dx.doi.org/10.1007/s10796-011-9317-x. doi:10.1007/s10796-011-9317-x.
26. SLA-Ready project web site. 2016. URL: http://www.sla-ready.eu.
27. SLALOM project web site. 2016. URL: http://slalom-project.eu.