Cloud - Top 5 Risks with PAAS - Revision history

Ken Huang at 20:32, 21 October 2009

2009-10-21T20:32:01Z

Ken Huang at 20:17, 21 October 2009

2009-10-21T20:17:32Z

Ken Huang at 20:01, 21 October 2009

2009-10-21T20:01:29Z

Ken Huang: moved Cloud-10 Risks with PAAS to Cloud - Top 5 Risks with PAAS

2009-10-21T20:00:43Z

moved Cloud-10 Risks with PAAS to Cloud - Top 5 Risks with PAAS

Ken Huang: Created page with 'According to wikipedia, Platform as a service' (PaaS) is the delivery of a computing platform and solution stack as a service. It facilitates deployment of applications without t…'

2009-10-21T19:59:21Z

Created page with 'According to wikipedia, Platform as a service' (PaaS) is the delivery of a computing platform and solution stack as a service. It facilitates deployment of applications without t…'

New page

According to wikipedia, Platform as a service' (PaaS) is the delivery of a computing platform and solution stack as a service. It facilitates deployment of applications without the cost and complexity of buying and managing the underlying hardware and software layers providing all of the facilities required to support the complete life cycle of building and delivering web applications and services entirely available from the Internet—with no software downloads or installation for developers, IT managers or end-users. PaaS offerings include workflow facilities for application design, application development, testing, deployment and hosting as well as application services such as team collaboration, web service integration and marshalling, database integration, security, scalability, storage, persistence, state management, application versioning, application instrumentation and developer community facilitation. These services are provisioned as an integrated solution over the web. 

The top 5 security concerns are: 

1: Business Continuity Planning and Disastor Recovery with PAAS vendor. Example: Windows Azure platform, Microsoft's cloud computing platform, suffered an outage one weekend in March, 2009. Had your enterprise been using the service, how would the outage have affected the organization's ability to conduct business? Alternatively, it would have been Microsoft's responsibility to fix it, not your IT team's (but be careful; your executive team may not see the distinction). 

2: Lack of Secure Software Development Process with PAAS vendor. One PAAS offering is the SDLC. The Secure SDLC (SSDLC) is still new and not widely used. The lack of SSDLC could mean insecure code.

3: Vendor Lock In: Platform as a Service (PaaS) vendors tend to dictate the database, storage and application framework used, so what about those legacy applications? Enterprises will still require the skills and infrastructure to be able to run them.

4: Lack of adequate provisions in SLA. the Cloud Computing Bill of Rights provides a useful checklist of protection with which to benchmark a supplier's offering. The upcoming National Institute of Standards and Technology (NIST) Cloud Computing Security publication will do a lot to standardize federal-compliant cloud infrastructures and need to be followed.

5: How to meet compliance demands and control risks when work with a PAAS Vendor 

 

Reference 

http://searchsecurity.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid14_gci1361723,00.html 

http://en.wikipedia.org/wiki/Platform_as_a_service http://www.cloudsecurityalliance.org/ 

http://social.msdn.microsoft.com/Forums/en-US/windowsazure/thread/6c1cd8a2-8d9d-43e9-a1d8-928e0ca4de78

← Older revision		Revision as of 20:32, 21 October 2009
Line 19:		Line 19:
	http://en.wikipedia.org/wiki/Platform_as_a_service<br>http://www.cloudsecurityalliance.org/		http://en.wikipedia.org/wiki/Platform_as_a_service<br>http://www.cloudsecurityalliance.org/

−	http://social.msdn.microsoft.com/Forums/en-US/windowsazure/thread/6c1cd8a2-8d9d-43e9-a1d8-928e0ca4de78<br><br><br>	+	http://social.msdn.microsoft.com/Forums/en-US/windowsazure/thread/6c1cd8a2-8d9d-43e9-a1d8-928e0ca4de78<br><br><br>
		+
		+	[[Category:OWASP Cloud ‐ 10 Project]]

@@ Line 17: / Line 17: @@
 http://searchsecurity.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid14_gci1361723,00.html<br>
 http://en.wikipedia.org/wiki/Platform_as_a_service<br>http://www.cloudsecurityalliance.org/
 http://social.msdn.microsoft.com/Forums/en-US/windowsazure/thread/6c1cd8a2-8d9d-43e9-a1d8-928e0ca4de78<br><br><br>

@@ Line 1: / Line 1: @@
 According to wikipedia, Platform as a service' (PaaS) is the delivery of a computing platform and solution stack as a service. It facilitates deployment of applications without the cost and complexity of buying and managing the underlying hardware and software layers providing all of the facilities required to support the complete life cycle of building and delivering web applications and services entirely available from the Internet—with no software downloads or installation for developers, IT managers or end-users. PaaS offerings include workflow facilities for application design, application development, testing, deployment and hosting as well as application services such as team collaboration, web service integration and marshalling, database integration, security, scalability, storage, persistence, state management, application versioning, application instrumentation and developer community facilitation. These services are provisioned as an integrated solution over the web.<br>
 The top 5 security concerns are:<br>
 : Business Continuity Planning and Disastor Recovery with PAAS vendor. Example: Windows Azure platform, Microsoft's cloud computing platform, suffered an outage one weekend in March, 2009. Had your enterprise been using the service, how would the outage have affected the organization's ability to conduct business? Alternatively, it would have been Microsoft's responsibility to fix it, not your IT team's (but be careful; your executive team may not see the distinction).<br>
 : Lack of Secure Software Development Process with PAAS vendor. One PAAS offering is the SDLC. The Secure SDLC (SSDLC) is still new and not widely used. The lack of SSDLC could mean insecure code.
 : Vendor Lock In: Platform as a Service (PaaS) vendors tend to dictate the database, storage and application framework used, so what about those legacy applications? Enterprises will still require the skills and infrastructure to be able to run them.
-: Lack of adequate provisions in SLA. the Cloud Computing Bill of Rights provides a useful checklist of protection with which to benchmark a supplier's offering. The upcoming National Institute of Standards and Technology (NIST) Cloud Computing Security publication will do a lot to standardize federal-compliant cloud infrastructures and need to be followed.
+Reference<br>
-: How to meet compliance demands and control risks when work with a PAAS Vendor<br>
+http://social.msdn.microsoft.com/Forums/en-US/windowsazure/thread/6c1cd8a2-8d9d-43e9-a1d8-928e0ca4de78<br><br><br>

← Older revision	Revision as of 20:00, 21 October 2009
(No difference)