CLOUD AND INTERNET SECURITY: SECURITY MATTERS

A while back I wrote two documents called 'Building a Cloud Service' and the 'Convergence Report'. They basically documented my past experiences and detailed some of the issues that a cloud company may face as it is being built and run. Based on what had transpired since, a lot of the concepts mentioned in that particular document are becoming widely adopted and/or are trending towards them. This is a continuation of that particular document and will attempt to analyse the issues that are faced as we move towards the cloud especially with regards to security. Once again, we will use past experience, research, as well as current events trends in order to write this particular report.

Personal experience indicates that keeping track of everything and updating large scale documents is difficult and depending on the system you use extremely cumbersome. The other thing readers have to realise is that a lot of the time even if the writer wants to write the most detailed book ever written it’s quite simply not possible. Several of my past works (something such as this particular document takes a few weeks to a few months to write depending on how much spare time I have) were written in my spare time and between work and getting an education. If I had done a more complete job they would have taken years to write and by the time I had completed the work updates in the outer world would have meant that the work would have meant that at least some of the content would have been out of date. Dare I say it, by the time that I have completed this report itself some of the content may have come to fruition as was the case with many of the technologies with the other documents? I very much see this document as a starting point rather than a complete reference for those who are interested in technology security.

Note that the information contained in this document is not considered to be correct nor the only way in which to do things. It’s a mere guide to how the way things are and how we can improve on them. Like my previous work, it should be considered a work in progress. Also, note that this document has gone through many revisions and drafts may have gone out over time. As such, there will be concepts that may have been picked up and adopted by some organisations while others may have simply broken cover while this document was being drafted and sent out for comment. It also has a more strategic/business slant when compared to the original document which was more technically orientated.

No illicit activity (as far as I know and have researched) was conducted during the formulation of this particular document. All information was obtained only from publicly available resources and any information or concepts that are likely to be troubling has been redacted. Any relevant vulnerabilities or flaws that were found were reported to the relevant entities in question (months have passed).

Feedback/credit on any ideas that are subsequently put into action based on the content of this document would be appreciated. Any feedback on the content of this document is welcome. Every attempt has been made to ensure that the instructions and information herein are accurate and reliable. Please send corrections, comments, suggestions and questions to the author. All trademarks and copyrights are the property of their owners, unless otherwise indicated. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark. The author would appreciate and consider it courteous if notification of any and all modifications, translations, and printed versions are sent to him.

Please note that this is an organic document that will change as we learn more about this new computing paradigm. The latest copy of this document can be found either on the author’s website, blog, and/or http://www.tldp.org/