CSA, SAFECode Publish Cloud App Security Guidance

The Cloud Security Alliance (CSA) is partnering with the Software Assurance Forum for Excellence in Code (SAFECode) in an effort to improve the security of cloud applications. The two groups have published a 27-page document on Practices for Secure Development of Cloud Applications, which outlines the approach for what needs to be done.

As more organisations move to the cloud, there is a need to provide guidance for software development in the cloud, John Howie, chief operating officer of the CSA, told eWEEK.

Shifting threats

Said Tabet, senior technologist at EMC and one of the paper’s co-authors, told eWEEK that a key goal of the guidance is to address threat and design issues in software development that are a risk to the cloud. The joint report identifies four key threats to cloud computing: data breaches, data leakage, insecure interfaces/APIs and denial-of-service (DoS) attacks.

From a design perspective, which is where the document provides a lot of guidance, topics include multitenancy, trusted compute pools, the tokenisation of sensitive data, data encryption, and authentication and identity management.

A goal of the guidance, according to Tabet, is to provide content for how security controls should be designed and implemented in the cloud. Among the key challenges is the simple fact that threats keep changing.

“You’re seeing software deployed today that in a very short time is becoming vulnerable to attack, not because the software was written poorly but because the operations and threat landscape has evolved,” the CSA’s Howie said. “We expect to continue to invest in this effort with iterations of the document and supplemental guidance.”

One thing the CSA/SAFECode guidance is not designed to do is help cloud providers and developers circumvent potential snooping from a government agency. Throughout 2013, there has been a lot of talk about snooping from the US National Security Agency (NSA) as a result of leaks made public by whistleblower Edward Snowden.

Illegal access

“We believe the focus should be on illegal access to content by cyber-criminals, terrorists and nation-states engaged in cyber-espionage,” Howie said. “On the face of it, regardless of your political affiliation or personal beliefs, the activities conducted not just in the US, but by governments worldwide, are legal, until the courts or legislatures change the laws.”

This week, a group of tech vendors in the United States, including AOL, Facebook, Google, LinkedIn, Microsoft and Yahoo, published an open letter in an attempt to start a national conversation on the topic of US-government surveillance reform. The tech vendors are looking for more oversight and transparency.

“Our focus has always been on illegal and illicit access, and the best practices in this report reflect that,” Howie said.

Do you know all about the Internet of Things? Take our quiz.

Originally published on eWeek.