Cloud security requirements analysis and security policy development using a high-order object-oriented modeling technique
Kenneth Kofi Fletcher · 2010
Security continues to be a major challenge for cloud computing, and it is one that must be addressed if cloud computing is to be fully accepted. Most technological means of securing non-cloud computing systems can be either applied directly or modified to secure a cloud; however, no integrated model-based methodology is yet available to analyze cloud security requirements and develop policy to deal with both internal and external security challenges. This work proposes just such a methodology and demonstrates its application with specific cases. Cloud assets are represented by highorder object models, and misuse cases together with malactivity swimlane diagrams are developed to assess security threats hierarchically. Cloud security requirements are then specified, and policies are developed to meet them. Examples show how the methodology can be used to elicit, identify, analyze, and develop cloud security requirements and policies using a structured approach, and a case study evaluates its application by a cloud service provider. Finally, the work shows how the prevention and mitigation security policies presented here can be conveniently incorporated into the normal functionality of a cloud computing system.