Elements of application security in the cloud computing environment

Abstract

Cloud services can be interweaved as modular building blocks to a multi-component application. This is very appealing because of ready-to-use specialized services and supporting integration APIs from cloud service providers. However, securing and integrating the cloud-based services add challenges compared to having all components within the boundaries of the corporate network. These services can be user-centric, application-centric or machine-centric. The security issues range from channel protection to services chaining. Combining cloud services calls for building transactional interconnects of on-the-shelf services that are secure end-to-end in the wild. Using services from different providers and integrating them securely can be a challenge. An assessment framework for evaluating risks in moving a service to the cloud is also presented. We focus on the security issues in building a cloud application by loosely coupled services designed for transparency in drop-n-replacement of a component service. Security patterns and approaches are presented to realize this transparency.