Deployment-Time Multi-Cloud Application Security

Craig Sheridan,Philippe Massonet,A. Phee
DOI: https://doi.org/10.1109/SMARTCOMP.2017.7947000
2017-05-01
Abstract:The Internet is an open networked system containing much inherent vulnerability, especially around the implementation and management of the services that run there. Application owners and service providers require automated deployment time security in order to protect the services that will be exposed to public and private networks. At the moment, manual intervention is required causing a period of vulnerability to these exposed services. The topic of the paper is how better to address this vulnerable period with automated solutions. We want cloud deployments to be secure from cyber attack as quickly as possible during the transition from deployment to a runtime environment without the need for manual intervention. Commonly, current practice involves making services live and undertaken reactive security measures manually, resulting in costly cyber security breaches. There is an identifiable cyber security issue highlighting the lack of deployment time security automation. The problem is addressed, solvable and we suggest a potential solution. A solution is proposed and claimed as the most effective approach in comparison to other options. This entails implementing all required security measures to an application and its container in an automated way at the point of deployment. The contribution of the paper therefore is to identify how today's cyber threats are potentially serious in particular to newly deployed applications in a cloud space. Subsequently, an elegant solution is put forward involving automated techniques to protect an application both inside and outside the application container. The solution consists of a vulnerability assessment of the system containing the application, the creation of an automatic firewall perimeter and automatically patching applications against vulnerabilities. This is an approach based on prevention rather than detection.
What problem does this paper attempt to address?