(Only need step 9&10 about 5 pages) Software Development Life Cycle For Data In the Cloud Computing environment

Functional Design

To provide the best product one of the first steps is gathering, reviewing and then defining requirements.  Hans Jonasson (2007), presenting at the PMI Global Congress is quoted as stating, “defining scope [requirements] is a critical part of succeeding on a project”.  Without proper requirements, projects trend towards ending up over-budget on both time and money.  In the realm of cybersecurity, improper requirements often mean security requirements were subject to the same lack of definition which in today’s cyber-climate this can be a devastating mistake.  Because of this many organizations look towards defined processes to ensure that they do not end up with ill-defined requirements of any variety.  

One of which is the System Quality Requirements Engineering (SQUARE) process which was developed at Carnegie Mellon University.  According to the United States Computer Emergency Readiness Team (US-CERT) website, “[SQUARE] provides a means for eliciting, categorizing, and prioritizing security requirements for information technology systems and applications.” (2013) SQUARE defines nine steps that help an organization better define their security requirements and in order they can be seen in Table 1.

Table 1. AWS System Quality Requirements Engineering Process (SQUARE).

Number	Step	Input	Techniques	Participants	Output
1	Agree on definitions	Candidate definitions from IEEE and other standards	Structured interviews, focus group	Stakeholders, requirements engineer	Agreed-to definitions
2	Identify assets and security goals	Definitions, candidate goals, business drivers, policies and procedures, examples	Facilitated work session, surveys, interviews	Stakeholders, requirements engineer	Assets and goals
3	Develop artifacts to support security requirements definition	Potential artifacts (e.g., scenarios, misuse cases, templates, forms)	Work session	Requirements engineer	Needed artifacts: scenarios, misuse cases, models, templates, forms
4	Perform risk assessment	Misuse cases, scenarios, security goals	Risk assessment method, analysis of anticipated risk against organizational risk tolerance, including threat analysis	Requirements engineer, risk expert, stakeholders	Risk assessment results
5	Select elicitation techniques	Goals, definitions, candidate techniques, expertise of stakeholders, organizational style, culture, level of security needed, cost/benefit analysis, etc.	Work session	Requirements engineer	Selected elicitation techniques
6	Elicit security requirements	Artifacts, risk assessment results, selected techniques	Joint Application Development (JAD), interviews, surveys, model-based analysis, checklists, lists of reusable requirements types, document reviews	Stakeholders facilitated by requirements engineer	Initial cut at security requirements
7	Categorize requirements as to level (system, software, etc.) and whether they are requirements or other kinds of constraints	Initial requirements, architecture	Work session using a standard set of categories	Requirements engineer, other specialists as needed	Categorized requirements
8	Prioritize requirements	Categorized requirements and risk assessment results	Prioritization methods such as Analytical Hierarchy Process (AHP), Triage, Win-Win	Stakeholders facilitated by requirements engineer	Prioritized requirements
9	Inspect requirements	Prioritized requirements, candidate formal inspection technique	Inspection method such as Fagan, peer reviews	Inspection team	Initial selected requirements, documentation of decision-making process and rationale

Note. Reprinted from SQUARE process, by United States Computer Emergency Readiness Team, retrieved from https://www.us-cert.gov/bsi/articles/best-practices/requirements-engineering/square-process.

Different Ways to Secure Cloud Data

Many in the IT industry tout the cloud as the future of data storage.  CIO’s online magazine indicated it’s because of the cloud’s ability to, “reduce costs and increase business efficiency” and because the cloud provides increased security (2018).  Part of this is that the cloud providers are often held to a very exacting standard to get their accreditations.  As their business relies on providing this trust, it is often a much higher standard than the average medium-to-small businesses’ IT staff can maintain.  According to their documentation Amazon Web Services (2019) complies with a variety of IT security standards, some of which include: FISMA, DIACAP, and ISO 9001. This allows the security architects to utilize and leverage the cloud’s performance and scalability to provide security services that often would far exceed the normal budget of many businesses.

An important distinction does exist in cloud security however with Amazon Web Services (2019) pointing out, “AWS manages the security of the cloud, you are responsible for security in the cloud.”  This distinction is very important to cyber architects, as what and how the architecture is defined in the cloud perimeter is vitally important to the delivery of a secure product.  In other words, while cloud providers like AWS can provide a safe and secure house, they can’t help if all the doors and windows are left open and unlocked.  While sounding like common sense, it is often why many security breaches in the cloud occur; the cloud wasn’t hacked, the company’s instance in that cloud was. To prevent this, cyber architects should follow the same methods as they have always, just with the added benefit that they can now leverage much more powerful and distributed resources. 

Define and enforce good role-based access control (RBAC) and use either Platform as a Service (PaaS) to create duplicate domain controllers, or leverage AWS Managed Microsoft Active Directory, which is AWS Software as a Service (SaaS) offering.  If using a hybrid solution, set up a VPN and implement IPSec to ensure that the data in transit is between the cloud and the premises.  AWS offers Virtual Private Cloud (VPC) for organizations that want to have their own private chunk of the cloud.  These VPC’s are akin to leasing private lines from an ISP to set up a private network but cost a fraction of the price. No matter what the security architect can dream up, the cloud enables it to be bigger, faster, and cheaper than attempting to do the same in-house.

References

Amazon Web Services. (2019). Security and Compliance. Retrieved from 

docs.aws.amazon.com: https://docs.aws.amazon.com/aws-technical-content/latest/aws-overview/security-and-compliance.html

CIO. (2018). The Future of Cloud Services. Retrieved from cio.com:

https://www.cio.com/article/3328547/the-future-of-cloud-services.html

Jonasson, H. (2007). Determining project requirements-best practices and tips. PMI global 

Congress 2007. Newtown Square, PA: Project Management Institute.

United States Computer Emergency Readiness Team. (2013, July 05). SQUARE Process. Retrieved from us-cert.gov: https://www.us-cert.gov/bsi/articles/best-practices/requirements-engineering/square-process