Application Security in Cloud

Cloud is the no more a new buzz, and slowly the world is moving towards cloud to save cost and transfer ownership of their own infra challenges to cloud vendors. There are many considerations for cloud and which model to follow completely depends on requirements and vision of an organizations moving to cloud.

While cost plays a major role, still security challenges will still be in place when cloud is considered for the applications.

There may be a case when applications are still developed in house and hosting happens on cloud as production. It is very important to simulate cloud security considerations when development of applications is in process. In many cases, development environment may not be more secure compared to production as it is required for testing, however this could also pose challenge as to make application fast and scalable, some security points may be left.

In order to ensure cloud applications are secure enough for business purpose, few points are mentioned below, which can help us secure our environment.

• Secure Coding Practice : This forms the first layer of security. Developers should ensure that they are not using any vulnerable version of open source technologies like jquery or css to bring in more customization, while they open doors to ease of access or user interface design, but they create a big challenge for security reasons.

• Source Code Review : Security Testers should be in picture all the time till development is happening and ensuring that each module being developed is free from vulnerabilities. The modules should be tested independently as well as overall application function. This is crucial phase as many times vulnerabilities are not in module but when connected together, makes business logic challenge for security.

• Threat Modelling to be conducted : Security testers should ensure threat modelling is performed keeping all business testing, user testing and other challenges while performing security testing of applications. Since applications may be developed on cloud, there are chances of unauthorized access to code changes if access controls are not tested. 

• Developers Understanding on Security : This is completely a focused area as developers and project managers are more focused towards getting the code to production, however during this they completely forget the needs and security understanding of the organizations and how application access will work. Just in case, developers need to understand how IAM(Identity and Access Management) works in an organizations so the same can be considered when application development happens.

• Encryption is the key : This is very critical for developers as they should encrypt whatever possible while transactions happens so the first level of security is implemented directly to applications. Any traversal of data should happen using encryption mechanisms.

• Penetration Testing of Applications : This will always be the most important part as this is done keeping in view the hackers approach. In order to make this exercise more effective, all 3 types of exercise (Black Box, Grey Box, White Box)  should be performed. This will ensure maximum pointers are in place while moving applications to production.

There can be more pointers to secure applications in cloud, however above mentioned pointers will definitely create a secure atmosphere for applications to run.