Building Secure Cloud Apps: CSA, SAFECode Provide Guidance
New guidance aims to enable developers and cloud implementors to build secure deployments, but don't expect any secret tips on how to avoid government snooping.The Cloud Security Alliance (CSA) is partnering with the Software Assurance Forum for Excellence in Code (SAFECode) in an effort to improve the security of cloud applications. The two groups have published a 27-page document on Practices for Secure Development of Cloud Applications, which outlines the approach for what needs to be done. As more organizations move to the cloud, there is a need to provide guidance for software development in the cloud, John Howie, chief operating officer of the CSA, told eWEEK. Said Tabet, senior technologist at EMC and one of the paper's co-authors, told eWEEK that a key goal of the guidance is to address threat and design issues in software development that are a risk to the cloud. The joint report identifies four key threats to cloud computing: data breaches, data leakage, insecure interfaces/APIs and denial-of-service (DoS) attacks. From a design perspective, which is where the document provides a lot of guidance, topics include multitenancy, trusted compute pools, the tokenization of sensitive data, data encryption, and authentication and identity management.
A goal of the guidance, according to Tabet, is to provide content for how security controls should be designed and implemented in the cloud. Among the key challenges is the simple fact that threats keep changing.