Towards a Unified Secure Cloud Service Development and Deployment Life-Cycle
Abstract
Designing and developing cloud services is a challenging task that includes requirements engineering, secure service deployment, maintenance, assurance that proper actions have been taken to support security and, in addition, considering legal aspects. This is unfortunately not possible by taking current methods and techniques into consideration. Therefore, we require a systematic and comprehensive approach for building such services that starts the integration of security concerns from early stages of design and development, and continuous to refines and integrate them in the deployment phase. In this paper we therefore propose a solution that integrates security requirements engineering and continuous refinement in a comprehensive security development and deployment life-cycle for cloud services and applications. Our approach is focused on iterative refinement of the security-based requirements during both software engineering (development phase) and software maintenance (deployment phase).
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Lack of consistent security policies design and performance measures is a DevOps security challenge.
“The enterprise generally lacks with consistence security polices design and performance measures [6], [19], [52], [72], [73] due to the rigid policy structure.”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [6]
Cites
The NIST Definition of Cloud Computing
Mell, P., & Grance, T. (2011) · doi:10.6028/nist.sp.800-145 · Cited by 15,338 · see citing works
Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., Stoica, I., et al. (2010) · Communications of the ACM · doi:10.1145/1721654.1721672 · Cited by 9,464 · see citing works
Buyya, R., Yeo, C. S., Venugopal, S., Broberg, J., & Brandić, I. (2008) · Future Generation Computer Systems · doi:10.1016/j.future.2008.12.001 · Cited by 5,946 · see citing works
The Unified Software Development Process
Jacobson, I., Booch, G., & Rumbaugh, J. E. (1999) · CERN Document Server (European Organization for Nuclear Research) · Cited by 3,389 · see citing works
A survey on security issues in service delivery models of cloud computing
Subashini, S., & Kavitha, V. (2010) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2010.07.006 · Cited by 2,692 · see citing works
Addressing cloud computing security issues
Zissis, D., & Lekkas, D. (2010) · Future Generation Computer Systems · doi:10.1016/j.future.2010.12.006 · Cited by 1,848 · see citing works
Security and Privacy Challenges in Cloud Computing Environments
Takabi, H., Joshi, J. B. D., & Ahn, G. (2010) · IEEE Security & Privacy · doi:10.1109/msp.2010.186 · Cited by 1,326 · see citing works
Kandukuri, B. R., Ramakrishna Paturi, V., & Rakshit, A. (2009) · IEEE International Conference on Services Computing · doi:10.1109/scc.2009.84 · Cited by 599 · see citing works
Security Requirements Engineering: A Framework for Representation and Analysis
Haley, C. B., Laney, R., Moffett, J., & Nuseibeh, B. (2008) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2007.70754 · Cited by 464 · see citing works
Cloud Migration: A Case Study of Migrating an Enterprise IT System to IaaS
Khajeh‐Hosseini, A., Greenwood, D., & Sommerville, I. (2010) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud.2010.37 · Cited by 355 · see citing works
Critical infrastructure protection: Requirements and challenges for the 21st century
Alcaraz, C., & Zeadally, S. (2014) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2014.12.002 · Cited by 340 · see citing works
Mellado, D., Fernández‐Medina, E., & Piattini, M. G. (2006) · Computer Standards & Interfaces · doi:10.1016/j.csi.2006.04.002 · Cited by 233 · see citing works
Dark clouds on the horizon: using cloud storage as attack vector and online slack space
Mulazzani, M., Schrittwieser, S., Leithner, M., Huber, M., & Weippl, E. R. (2011) · Cited by 194 · see citing works
Department of Defense Trusted Computer System Evaluation Criteria
US Department of Defense (1985) · Palgrave Macmillan UK eBooks · doi:10.1007/978-1-349-12020-8_1 · Cited by 178 · see citing works
Decision Support Tools for Cloud Migration in the Enterprise
Khajeh‐Hosseini, A., Sommerville, I., Bogaerts, J., & Teregowda, P. B. (2011) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud.2011.59 · Cited by 166 · see citing works
Using the Common Criteria for IT Security Evaluation
Herrmann, D. S. (2002) · Auerbach Publications eBooks · doi:10.1201/9781420031423 · Cited by 124 · see citing works
Systems and software engineering � Software life cycle processes
(2020) · doi:10.3403/30363576 · Cited by 94 · see citing works
Applying a Security Requirements Engineering Process
Mellado, D., Fernández‐Medina, E., & Piattini, M. G. (2006) · Lecture notes in computer science · doi:10.1007/11863908_13 · Cited by 64 · see citing works
Service Migration in a Cloud Architecture
Kaisler, S. H., & Money, W. H. (2011) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2011.371 · Cited by 43 · see citing works
Rannenberg, K. (1993) · FreiDok plus (Universitätsbibliothek Freiburg) · Cited by 34 · see citing works
Nanavati, M., Colp, P., Aiello, B., & Warfield, A. (2014) · Communications of the ACM · doi:10.1145/2593686 · Cited by 30 · see citing works
Fehling, C., Leymann, F., Ruehl, S. T., Rudek, M., & Verclas, S. A. W. (2013) · IEEE International Conference on Service-Oriented Computing and Applications (SOCA) · doi:10.1109/soca.2013.41 · Cited by 26 · see citing works
Are industrial control systems ready for the cloud?
Piggin, R. (2014) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2014.12.005 · Cited by 19 · see citing works
A Multi-layer and MultiTenant Cloud Assurance Evaluation Methodology
Hudic, A., Tauber, M., Lorünser, T., Krotsiani, M., Spanoudakis, G., Mauthe, A., & Weippl, E. R. (2014) · IEEE International Conference on Cloud Computing Technology and Science · doi:10.1109/cloudcom.2014.85 · Cited by 11 · see citing works
Self-citationCloudInspector: A Transparency-as-a-Service Solution for Legal Issues in Cloud Computing
Flittner, M., Balaban, S., & Bless, R. (2016) · doi:10.1109/ic2ew.2016.36 · Cited by 8 · see citing works
Self-citationHesse, T.-M., Gärtner, S., Roehm, T., Paech, B., Schneider, K. A., & Bruegge, B. (2014) · doi:10.1109/espre.2014.6890520 · Cited by 7 · see citing works
Impact of Critical Infrastructure Requirements on Service Migration Guidelines to the Cloud
Wagner, C., Hudic, A., Maksuti, S., Tauber, M., & Pallas, F. (2015) · International Conference on Future Internet of Things and Cloud (FiCloud) · doi:10.1109/ficloud.2015.79 · Cited by 5 · see citing works
Self-citationSedinic, I., & Lovrić, Z. (2013) · International Convention on Information and Communication Technology, Electronics and Microelectronics · Cited by 3 · see citing works
Continuous Requirements Engineering and Human-Centered Agile Software Development.
Forbrig, P. (2016) · REFSQ Workshops · Cited by 2 · see citing works
Flagged first, then by citations
3 of the 33 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Prioritization based taxonomy of DevOps security challenges using PROMETHEE
Rafi, S., Yu, W., Akbar, M. A., Alsanad, A., & Gumaei, A. (2020) · IEEE Access · doi:10.1109/access.2020.2998819 · Cited by 50 · see citing works
Iteration Causes, Impact, and Timing in Software Development Lifecycle: An SLR
Mumtaz, M., Ahmad, N., Ashraf, M. U., Alghamdi, A. M., Bahaddad, A. A. S., & Almarhabi, K. A. (2022) · IEEE Access · doi:10.1109/access.2022.3182703 · Cited by 11 · see citing works
The Archistar Secret-Sharing Backup Proxy
Happe, A., Wohner, F., & Lorünser, T. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3104055 · Cited by 6 · see citing works
Lorünser, T., Pöhls, H. C., Sell, L., & Laenger, T. (2018) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3230833.3233765 · Cited by 6 · see citing works
Brídová, I., Segeč, P., Moravčík, M., & Kontšek, M. (2024) · AD ALTA Journal of Interdisciplinary Research · doi:10.33543/j.1401.333340
- Authors
- Hudic, A., Flittner, M., Lorunser, T., Radl, P. M., & Bless, R.
- Affiliations
- AIT Austrian Institute of Technology GmbH (AT)
- Karlsruhe Institute of Technology (DE)
- ORCID
- Bless, Roland
- Venue
- 2016 11th International Conference on Availability, Reliability and Security (ARES)
- Publisher
- IEEE
- Published
- 2016-08
- Volume
- 34
- Pages
- 428-436
- OpenAlex
- W2562326998
- Cited by
- 5
- References
- 33
- Citations by year
- 2024: 1 · 2022: 1 · 2020: 1 · 2018: 1 · 2017: 1
- FWCI
- 0.57
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Availability, Reliability and Security (ARES) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- cloud services, security requirements engineering, secure deployment, iterative refinement, software maintenance, security assurance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
