Security Service Level Agreements Research Articles

Security and Privacy Service Level Agreement composition for Internet of Things systems on top of standard controls

The growing markets of Cloud services and IoT platforms have dramatically raised system flexibility and deployment options. However, increasing complexity and dependency on third-party providers make it difficult to assess the security and privacy levels that distributed systems can offer to their users. In the last years, machine-readable Service Level Agreements (SLAs) have been studied as an optimal method for copying with security and privacy policies. Still, the computation of the SLAs of applications distributed in diverse infrastructures remains a challenging task. This paper presents a methodology to compose security SLAs (SecSLAs) and privacy SLAs (PLAs) of Cloud-based IoT applications on top of standard controls. The composition considers individual components’ SLAs and the control delegation relationships between the components with respect to different types of controls (common, system-specific or hybrid controls). Furthermore, we propose a technique to calculate the Service Level Objectives (SLO) of the controls declared in the composite SLA based on the SLOs granted by individual components. Finally, the paper presents the validation of the methodology carried out to create the SecSLAs and PLAs of a real multiCloud-based IoT application in the eHealth domain.

A novel Security-by-Design methodology: Modeling and assessing security by SLAs with a quantitative approach

Recent software development methodologies, as DevOps or Agile, are very popular and widely used, especially for the development of cloud services and applications. They dramatically reduce the time-to-market of developed software but, at the same time, they can be hardly integrated with security design and risk management methodologies. These cannot be easily automated and require big economic investments, due to the necessity of security experts in the development team and to the lack of automatic tools to evaluate risk and to assess security in the design and operation phases. This paper presents a novel Security-by-Design methodology based on Security Service Level Agreements (SLAs), which can be integrated within modern development processes and that is able to support the risk management life-cycle in an almost-completely automated way. In particular, it relies upon a guided risk analysis process and a completely automated security assessment phase, which enable to assess the security properties granted by a cloud application and to report them in a Security SLA. We validated the proposed methodology with respect to a real case study, which showed its effectiveness in improving the awareness of designer and developer teams on security aspects and in reducing the secure design process time.

Model-based deployment of secure multi-cloud applications

The wide diffusion of cloud services, offering functionalities in different application domains and addressing different computing and storage needs, opens up the possibility of building multi-cloud applications relying upon heterogeneous services, offered by multiple cloud service providers. This flexibility not only enables an efficient usage of resources, but also allows to cope with specific requirements in terms of security and performance, while requiring, however, a typically high development effort. The MUSA framework leverages a DevOps approach to develop multi-cloud applications with desired Security Service Level Agreements (SSLA). This paper describes the MUSA Deployer models and tools, which aim at decoupling the multi-cloud application modelling and development from application deployment and cloud services provisioning. With MUSA tools, designers and developers are able to express and easily evaluate the application security requirements, and to deploy it automatically by acquiring and configuring cloud services with the needed software components.

A broker-based framework for standardization and management of Cloud Security-SLAs

Security is still one of the main barriers discouraging companies and businesses which deal with sensitive information and confidential data from migrating toward the Cloud. Recent efforts have tried to specify the security level of the Cloud service with the help of Security Service Level Agreements (Security-SLAs). However, Security-SLAs in their current format and with their present terms are not fully measurable and are hard to monitor. Quantification and standardization of Security-SLAs will surely speed up the Cloud adoption process and attract more customers to benefit from the advantages of Cloud computing in a more confident and secure fashion. In this paper, we propose a broker-based framework that manages the Cloud Security-SLA. We first develop a standard, quantitative, and measurable form to represent the agreement. Then we propose an evaluation and selection model that is fundamentally based on computing the adequate trade-off between the security CIA triad attributes (Confidentiality, Integrity, and Availability) in the context of a multi-objective optimization problem. Simulation results show the set of Pareto-optimal solutions and how the customer can select the most suitable service provider using higher level information that is related to the nature of the service and financial cost.

Per-service security SLAs for cloud security management: model and implementation

In the cloud computing context, Service Level Agreements (SLAs) 'tailored' to specific Cloud Service Customers (CSCs) seem to be still an utopia, and things are even worse as regards the security terms to be guaranteed. In fact, existing cloud SLAs focus only on a few service terms, and Cloud Service Providers (CSPs) mainly provide uniform guarantees for all offered services and for all customers, regardless of any particular service characteristics or of customer-specific needs. This paper presents a framework that enables the adoption of a per-service SLA model, supporting the automatic implementation of cloud security SLAs tailored to the needs of each customer for specific service instances. In particular, the process and the software architecture for per-service SLA implementation are shown. A case study application, related to the provisioning of a secure web container service, is presented and discussed, to demonstrate the feasibility and effectiveness of the proposed solution.

Per-service security SLAs for cloud security management: model and implementation

In the cloud computing context, Service Level Agreements (SLAs) 'tailored' to specific Cloud Service Customers (CSCs) seem to be still an utopia, and things are even worse as regards the security terms to be guaranteed. In fact, existing cloud SLAs focus only on a few service terms, and Cloud Service Providers (CSPs) mainly provide uniform guarantees for all offered services and for all customers, regardless of any particular service characteristics or of customer-specific needs. This paper presents a framework that enables the adoption of a per-service SLA model, supporting the automatic implementation of cloud security SLAs tailored to the needs of each customer for specific service instances. In particular, the process and the software architecture for per-service SLA implementation are shown. A case study application, related to the provisioning of a secure web container service, is presented and discussed, to demonstrate the feasibility and effectiveness of the proposed solution.

SLA-based Secure Cloud Application Development

The perception of lack of control over resources deployed in the cloud may represent one of the critical factors for an organization to decide to cloudify or not its own services. The flat security features offered by commercial cloud providers to every customer, from simple practitioners to managers of huge amounts of sensitive data and services, is an additional problem. In recent years, the concept of Security Service Level Agreements (Security SLAs) is assuming a key role for the secure provisioning of cloud resources and services. This paper illustrates how to develop cloud applications that deliver services covered by Security SLAs by means of the services and tools provided by the SPECS framework, developed in the context of the SPECS (Secure Provisioning of Cloud Services based on SLA Management) European Project. The whole (SPECS) application life cycle is dealt with, in order to give a comprehensive view of the different parties involved and of the processes needed to offer security guarantees on top of cloud services. The discussed development process is exemplified by means of a real-world case study consisting in a cloud application offering a secure web container service.

Introduction to the Special Issue on New Approaches for Infrastructure Services

The special issue is dedicated to the current research and innovation challenges encountered at infrastructure-as-a-service level generated by the desire to improve the user experiences and the efficient use of the available resources. The current trends are including the integration of special devices from high performance computing ones to mobile devices, the design of decentralised service-oriented systems, the improvement of the virtualization technologies, the overcome of portability and interoperability issues, or the automation the organisation and management of the back-end resources. Cloud-based applications from the fields of Internet-of-Things and Big Data are expected to challenge the new services. The first paper, entitled SLA-based Secure Cloud Application Development, reports an implementation of the concept of security service level agreements (Security SLAs) and presents a framework that allows application developers to intervine in the secure provisioning of cloud resources and services. The second paper, with the title Impact of Single Parameter Changes on Ceph Cloud Storage Performance, shows how a change of a global parameter of Ceph distributed file system can effect the performance for a range of access patterns when tested with an OpenStack cloud system. The third paper, entitled Multi-objective middleware for distributed VMI repositories in federated Cloud environment, explains the design of easy-to-use interface capable of receiving unmodified and functionally complete virtual machine images from its users, as well as of a system that transparently distribute them to a specific Cloud infrastructure in a federation achieving an improved quality of service. The fourth paper, with the title Architecture of a Scalable Platform for Monitoring Multiple Big Data Frameworks is dedicated to a new, distributed, scalable software platform able to collect, store, query and process monitoring data obtained from multiple Big Data frameworks. The fifth paper, entitled Exposing HPC services in the Cloud: the CloudLightning Approach, refers to a novel a self-organizing and self-managing cloud service delivery system with capabilities to deliver dynamic and tailored services offered by coalitions of heterogeneous cloud resources.

A novel approach to manage cloud security SLA incidents

Cloud computing is increasingly playing an important role in the service provisioning domain given the economic and technological benefits it offers. The popularity of cloud services is increasing but so are their customers’ concerns about security assurance and transparency of the Cloud Service Providers (CSPs). This is especially relevant in the case of critical services that are progressively moving to the cloud. Examples include the integrated European air traffic control system or public administrations through the governmental clouds. Recent efforts aim to specify security in cloud by using security service level agreements (secSLAs). However, the paucity of approaches to actually control the fulfillment of secSLAs and to react in case of security breaches, often results in distrust in cloud services. In this paper, we present a solution to monitor and enforce the fulfillment of secSLAs. Our framework is able to (a) detect occurrences that lead to unfulfillment of commitments, and (b) also provide mitigation to the harmful events that may or do compromise the validity of secSLAs.

Mobile Agent based Multi-layer Security Framework for Cloud Data Centers

Objectives: This paper proposes a new mobile agent based cloud security framework comprising four different security and authentication layers to establish the trust relationship between two entities before using cloud services. Methods/Analysis: The proposed framework is divided into four layers with each layer performing authentication, verification and integrity at different levels of communication between two entities. An algorithm is used to check and analyze the validity and functionality of each layer. Mobile agents are used as main components for performing different tasks assigned and requested by clients from cloud service providers. Findings: The framework uses authenticated mobile agents from both clients and cloud service provider to perform the tasks on behalf of users to establish trustworthy computing relationship. This makes the whole process transparent and clear according to users and cloud service providers’ perspective. The proposed framework effectively ensures privacy and security of client data and gives control to client over his data using the security agents. Conclusion/Application: The main contribution of this paper is undoubtedly the agreement of trustworthy relationship between two entities to agree on security service level agreements to dynamically configure and add mobile agents on virtual machines handled by task managers in their respective mobile agent platforms.

Leveraging the Potential of Cloud Security Service-Level Agreements through Standards

Despite the undisputed advantages of cloud computing, customers-in particular, small and medium enterprises (SMEs)-still need meaningful understanding of the security and risk-management changes that the cloud entails so they can assess whether this new computing paradigm meets their security requirements. This article presents a fresh view on this problem by surveying and analyzing, from the standardization and risk assessment perspective, the specification of security in cloud service-level agreements (secSLA) as a promising approach to empower customers in assessing and understanding cloud security. Apart from analyzing the proposed risk-based approach and surveying the relevant landscape, this article presents a real-world scenario to support the creation and adoption of secSLAs as enablers for negotiating, assessing, and monitoring the achieved security levels in cloud services.

Toward "Hypergalactic-Scale" Computing?

It seems that nearly every day brings new features and pricing models from established competitors; launch announcements from enterprise players; new entrants with new angles; and acquisition of cloud pure-plays by legacy players. IEEE Cloud Computing strives to eschew the technobabble for solid technology and trend analysis, focusing on technology, business, economics, and legal issues through dedicated columns and departments. The May/June 2015 issue features five articles covering topics ranging from context-aware mobile cloud computing, to the use of standards to leverage cloud security service-level agreements, to the intersection of containerization and platform-as-a-service (PaaS) clouds.

A non‐repudiable negotiation protocol for security service level agreements

SummarySecurity service level agreements (SSLAs) provide a systematic way for end users at home or in the office to guarantee sufficient security level when doing business or exchanging sensitive personal or organizational data with an online service. In this paper, we propose an SSLA negotiation protocol that implements non‐repudiation with cryptographic identities and digital signatures and includes features that make it resistant to denial of service attacks. The basic version of the protocol does not rely on the use of a trusted third party, and it can be used for all kinds of simple negotiations. For the negotiation about SSLAs, the protocol provides an option to use an external knowledge base that may help the user in the selection of suitable security measures. We have implemented a prototype of the system, which uses JSON Web Signature for the message exchange and made some performance tests with it. The results show that the computational effort required by the cryptographic operations of the negotiation protocol remains at a reasonable level. Copyright © 2014 John Wiley & Sons, Ltd.

Tailored Security: Building Nonrepudiable Security Service-Level Agreements

The security features of current digital services are mostly defined and dictated by the service provider (SP). A user can always decline to use a service whose terms do not fulfill the expected criteria, but in many cases, even a simple negotiation might result in a more satisfying outcome. This article aims at building nonrepudiable security service-level agreements (SSLAs) between a user and an SP. The proposed mechanism provides a means to describe security requirements and capabilities in different dimensions, from overall targets and risks to technical specifications, and it also helps in translating between the dimensions. A negotiation protocol and a decision algorithm are then used to let the parties agree on the security features used in the service. This article demonstrates the feasibility and usability of the mechanism by describing its usage scenario and proof-of-concept implementation and analyzes its nonrepudiability and security aspects.

Implications of security mechanisms and Service Level Agreements (SLAs) of Platform as a Service (PaaS) clouds for geoprocessing services

Cloud computing is an emerging computing paradigm aimed at running services over the internet to provide scalability and flexibility. The advantages in using the cloud for start-up and small businesses that lack infrastructure have been shown to far outweigh the disadvantages. Cloud platform services, also known as Platform as a Service (PaaS), provide a computing platform or solution stack on which software can be developed for later deployment in a cloud. However, there are a number of security challenges because users of the cloud have to rely on third-party companies to provide confidentiality, integrity and availability. Geoprocessing is the manipulation of geographic information, ranging from simple feature overlays and geocoding to raster processing and advanced climate modelling. The Open Geospatial Consortium's Web Processing Service defines a standardized interface that facilitates the publishing of geospatial processes. Parallelization and distribution of geoprocessing services have received much attention lately, including running them in a cloud. However, work on the security aspects of geoprocessing in a cloud is limited. In this paper, we analyse security mechanisms and Service Level Agreements of PaaS clouds and present results of experiments run in PaaS clouds. The implications of these results for the development of geoprocessing services in a PaaS cloud are discussed. Finally, recommendations for future work are presented.

On Game-Theoretic Network Security Provisioning

Service level agreements occasionally come as qualitative claims rather than quantitative statements. Motivated by the well-known fact that different (security) service goals can be conflicting, we present an axiomatic approach to finding an optimal balance between interdependent service quality criteria with distinct performance indicators. As a by-product, we obtain network provisioning strategies that ensure the promised service level at optimized performance. Our results generally apply to any security infrastructure for which attack and provisioning strategy identification is feasible. Standard security audits can thus be exploited twice, because, apart from forming a convincing sales argument, they directly support security service level agreements.

Taking value-networks to the cloud services: security services, semantics and service level agreements

Cloud services have become an emerging solution for organizations striving to address today's need for agility, but little research has addressed transitioning multiple, collaborating organizations to what can be referred to as a "value-network cloud." We know that organizations adopting cloud services to execute business processes must concomitantly reconfigure their security solutions for their integrated intra- and inter-organizational collaborations. We address the question, "What is needed to make it possible for an entire value-network to take secure, collaborative business process executions to the cloud?" Future value-network cloud solutions will require completely new security approaches that will leverage contracted brokering solutions operating as part of the cloud solution. We view value-network cloud security service provisioning as a bundle decision characterized by a mix of communication patterns relevant to intra- and inter-enterprise collaboration. We propose a cloud service broker model--using semantics and SLA based middleware--to serve as a trusted interface between the enterprise, cloud service providers and other organizations collaborating in a value-network. The approach enables IT governance for value-network cloud services. The architectural requirements adapt design principles for infrastructure management tailored from approaches to how business cartels historically conducted secure business dealings.

The role of SLAs in reducing vulnerabilities and recovering from disasters

Many service providers and network operators offer service level agreements (SLAs) supporting various service dimensions, such as price, reliability, and performance, to their customers. SLAs are usually considered more of a luxury item today than a necessity. With the increased focus on homeland security, does it make sense to use security-type SLAs as a vehicle for the government to help secure national critical infrastructures and recover quickly from a disaster? Are network security SLAs a viable option as an umbrella to protect the basic critical infrastructures? This paper discusses (a) the need and value of technical SLAs, (b) SLAs available today and widely used in industry, (c) critical components and content of security SLAs, (d) examples of security SLA architectural design for critical national services, (e) examples of what an SLA can do for homeland security, (f) viability of implementing security SLAs based on the inherent value of security, and (g) improvements required in the future to realize security SLAs as a service provider offering.

A framework for ensuring network security

The current focus of network security is concerned with securing individual components as well as preventing unauthorized access to network services. While these are necessary concerns, they do not represent a complete view of network security. In this paper, we present the Lucent Network Security Framework, which provides a comprehensive, top-down, end-to-end perspective on network security. We show how this framework can be applied to network elements, services, and applications including detecting, correcting, and preventing security vulnerabilities. In addition, we demonstrate how the Network Security Framework can be applied to all types of networks and across all layers of the protocol stack. This framework has been submitted to several government and standards bodies (e.g., ITU-T and ISO), and it has been very well received. Service provider networks developed with attention to the Lucent Network Security Framework will have a comprehensive security architecture enabling new value-added revenue-generating security services such as security service-level agreements (SLAs).

Security service level agreements for outsourced security functions

This article looks at the areas that should be covered in SLAs with regard to information security, and how they can be monitored.