云计算的安全架构与技术_第3节.ppt

Wu Tsu Yang创新信息产业研究中心 Cloud Computing Software Security Fundamentals Tsu-Yang Wu * Goal SaaS, secure software is a critical issue. Consumer’s point of view, using SaaS in the cloud, reduces the need for secure software development by the customer The requirement for secure software development is transferred to the cloud provider. Software security is treated as an add-on to extant software and not as an important element of the development process. Cloud Information Security Objectives Developing secure software is based on applying the secure software design principles that form the fundamental basis for software assurance. Three properties for secure software The Data and Analysis Center for Software (DACS) Dependability Software that executes predictably and operates correctly under a variety of conditions including when under attack or running on a malicious host * Cloud Information Security Objectives Trustworthiness Software that contains a minimum number of vulnerabilities or weaknesses that could sabotage the software’s dependability. Survivability (Resilience) Software that is resistant to or tolerant of attacks and has the ability to recover as quickly as possible with as little harm as possible * Cloud Information Security Objectives Seven complementary principles support information assurance Confidentiality Integrity Availability Authentication Authorization Auditing Accountability * Confidentiality The prevention of intentional or unintentional unauthorized disclosure of information Confidentiality in cloud systems is related to the areas Intellectual property rights Covert channels Traffic analysis Encryption Inference * Confidentiality Covert channel A covert channel is an unauthorized and unintended communication path that enables the exchange of information. Covert channels can be accomplished through timing of messages or inappropriate use of storage mechanisms * Confidentiality Traffic analysis Traffic a