Cloud Security Basics: Architecture and Development Practices
Posted by Ian Huynh on March 16, 2010
We’ve talked a great deal about how data and processes are secured with cloud-based solutions. But just as important is the security principles the vendor follows in building the cloud solution in the first place. The key here is to understand the architecture of your provider’s cloud applications, as well as their coding and development practices.
Architecture
- Since a cloud solution is single-instance, multi-tenant architecture, your cloud vendor’s solution needs to keep your data separate from that of other cloud tenants using the platform. This should be a primary concern when your data resides in “virtual private clouds” where there is an expectation of stronger segregation controls. As your data is stored in the same storage space as your neighboring tenants, you need to know how your cloud vendor will ensure that your data isn’t illegally accessed.
- Also, the overall level of security for cloud applications needs to be addressed. Depending on your vendor’s architecture, there may be customers with differing security needs operating within the same multi-tenant environment. In these cases, the entire system needs to be operating at the highest level of security to avoid the ‘weakest link syndrome’. Incidentally, this highlights one of the benefits of cloud computing – you can have the benefits of world-class security without the equivalent upfront cost of building and the maintaining such infrastructure.
- At Hubspan, our minimum standard is to automatically encrypt all of our customer data and business documents within our network. Ask your provider what their minimum standard is.
Coding & Design Practices
- I’d argue that a truly secure cloud platform is built for security through and through. That means security starts from “ground zero” – i.e., the design phase of the application as well as the platform. It simply isn’t enough to operate your system with a security-centric mindset; you have to design your system using the same guiding principles, following an unbroken chain of secure procedures from conception in the lab to real-life implementation. For that reason, design reviews, development practices and quality assurance plans must be engineered using the same strict security guidelines you would use in a production data center.
- At Hubspan, at least 30% of the total design and code review effort is focused on security issues.
As you are evaluting a cloud solution, ask the vendor to walk through their secure development and architectural principles.
Tags: Application Architecture, Cloud Security, Data Encryption, Key Management
No Comments »
No comments yet.