(Only need step 9&10 about 5 pages) Software Development Life Cycle For Data In the Cloud Computing environment

System Design Specifications

There are various methods of protecting data-in-transit, also referred to as data-in-motion. However, the most significant vulnerability with cloud storage is not securing the data in transit; it is the security of the data at rest. Therefore, before transmitting data, it is essential to ensure the data is encrypted with tools such as VeraCrypt, which is a tool that enables the use of encrypted containers to protect data at rest. 

Secure encryption must be used in order to maintain confidentiality and integrity when transmitting data between the cloud server and the client. Encryption will ensure that only users with the key that was used to encrypt the data will be able to decrypt the data and view the contents (Alsulami, Alharbi, & Monowar, 2015). One method of encryption would be a technique such as the hybrid cryptographic scheme shown in Figure 1.   

Figure 1. Hybrid Cryptographic Scheme.

As we see in Figure 1, Alice is sending an encrypted message to Bob using the Hybrid Cryptographic Scheme, which utilizes a combination of Public Key Crypto, Secret Key Crypto, and a Hash Function. Alice’s Private Key and the Hash Function are used to creating a digital signature, and Bob’s public key is combined with a random session key and public key crypto to create the encrypted session key. Alice’s message and the random session key are used in conjunction with the hash function and secret key crypto to formulate the encrypted message.

The combination of the encrypted message and the encrypted session key becomes what is known as the digital envelope. The hash function is a one-way encryption algorithm that uses no key, but instead uses a fixed-length hash value that computes based upon the plaintext, which makes it impossible for both the contents and length of the plaintext to be recovered, thus providing a digital fingerprint to ensure the integrity of the file. Bob recovers the hash value by decrypting the digital signature with Alice's public key. Then Bob recovers the secret session key using his private key and decrypts the encrypted message. If the resultant hash value is different from the value supplied by Alice, then Bob knows that the message has been altered; if the hash values are the same, Bob can have confidence that the message he received is identical to the one that Alice sent (Kessler, 2019). 

Now that the messages are encrypted, we will need to use a secure means of transmitting the messages from point A to point B. Various protocols can provide security, such as Hypertext Transfer Protocol Secure (HTTPS), which is a variant of HTTP that adds a layer of security through an SSL or TLS protocol connection (“What is HTTPS,” n.d.). SSL ensures that before communication is established between a client browser and a cloud server, an encrypted link is created between the two (“What is Secure Sockets Layer,” n.d.). TLS is more efficient and secure than SSL as it has stronger message authentication, key material generation, and other encryption algorithms. For example, TLS supports pre-shared keys, secure remote passwords, elliptical-curve keys, and Kerberos, whereas SSL does not (Kerravala, 2018).

However, for a more secure method of transmitting data, Internet Protocol Security (IPSec), as in Figure 2, would provide the most secure means for data-in-transit. IPSec has two modes, tunnel mode, and transport mode, that utilize two security protocols, encapsulating security payload (ESP) with a protocol ID of 50, and authentication header (AH) with a protocol ID of 51 (Administrator, n.d.).  In order to allow IPSec traffic to pass through the firewall, typically UDP port 500 should be open and permit IP protocol IDs 50 and 51 on both inbound and outbound firewall filters. Although the ports that are utilized will vary depending upon the VPN server and provider, this is the most common port utilized for IPSec.    

Figure 2. IPSec Tunnel Mode.

Below in Figure 3 is an example of what the ideal cloud system design specifications would look like using IPSec tunnel mode. The communications all occur securely over an HTTPS connection to the internet-facing web service of vCloud Air. The Hybrid Cloud Manager also communicates with the Network Services Provisioning API in vCloud Air as needed to support the on-premises operations (Francis, 2016).

Figure 3. VMware vSphere Cloud Architecture.

SDLC’s framework defines steps to be taken in the software development process and includes Planning, Development, Documentation, Testing, Deployment and Maintenance. However, the traditional approach of SDLC must be amended and made suitable for the cloud computing environment.  There are numerous practices for the development of software which includes waterfall, rapid application development, joint application development, and extreme programming with many life cycle models being built upon the traditional waterfall model framework (Software Development). The waterfall model require that one phase is worked on at a time then moving on to the next until done. However, this may not be feasible in practice.

Waterfall Method

In contrast, Agile software development performs tests regularly with prototypes during each phase to demonstrate the application’s functionality and is more focused on the current customer demands rather than a stable, long-term project. With this approach, the cost of change decreases when software applications are put in the cloud. Cloud computing is a new archetypal shift in the computing world providing more scalable, flexible and robust web applications, with almost instant access to software and developmental environments. 

Agile Method

The flexibility and robustness of the cloud aligned the maturity of SDLC frameworks provides for today’s rapidly evolving technological environment which requires faster development processes and higher productivity. Agile thinking should be adopted as this software development approach focuses on product delivery, quality assurance (QA), feature development, and maintenance releases.

Developing applications for public or private cloud platforms entails many of the same characteristics as applications designed for any other platform. There are five characteristics of cloud computing namely: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. There are four cloud deployment models used which are private cloud, community cloud, public cloud and the hybrid cloud. In our particular circumstance, SaaS will be employed for the HR department and their needs as there are many benefits.

Traditional vs Cloud Priorities

SaaS is a complete operating environment with applications, management and a user interface. There are no installation or hardware concerns, backups occur automatically, differently located employees can access same data, large data sets are easier to work with, there are no compatibility issues and upgrades are handled in the cloud (Miyachi, 2013).

Software Development Plan

This is the phase during which design specifications are refined and coded with supporting documentation. A complete information system will be completed in the development phase. This will include acquiring and installing systems environment, creating and testing databases, preparing test case procedures and test files, coding, compiling, refining and performing test readiness (Kommalapati & Zack, 2011).  There are numerous outlined steps:

· Set up development environment

· Develop service through iterative process

· Deploy and test continuously throughout the iteration

· Enlighten application with instrumentation

· Integrate application security [e.g. single sign-on, authorization policies]

· Integrate with cloud and on-premise systems, if necessary

· Streamline data synchronization, extraction and uploading

· Integrate support and helpdesk processes

· Test service as well as integrated business processes

· Test support and helpdesk processes

IT implementation, if the case refers to the new system, involves preliminary assessment of both external and internal factors that contribute to costs of implementation, the usability of the system, and business need of organization. The need for new system implementation usually derives from the need to replace or upgrade the process that is no longer effective, or to support a new business process that requires technical support. Externally, the company should be exposed to the following aspects.

First, the company should seek vendors that have already experienced the implementation process or best practices of successful implementation in other companies that have probably faced some issues and found the way to deal with them. Second, the company should consider the hardware and software requirements that fit the capacity of a new system. The implementation of a new system will require more efforts due to the need to upgrade some existent infrastructure in order to synchronize data exchange and processing functions.

Internally, Tycoon Solutions must conduct an in-depth analysis of the user’s needs and preferences regarding the tasks that the system will have to replace or support. There are numerous examples in IT industry when implemented systems have not been used due to not being able to resolve a user’s problem completely, offering partial solution to the problem. This needs can be identified by using questionnaires, user stories, interviews, or job analysis, where the critical elements are identified before the system implementation. Moreover, communication with users is a continuous process; thus, even after the system implementation, the communication must be followed in order to receive feedback on the system functionality. This implementation might require reverting to external resources again, seeking for methods to improve the functionality of the system by installing additional modules or system patching.

The transit of the data from and to a cloud environment could be protected through the application of several technology considerations. First, it is worth mentioning that the data is hard to intercept by intruders if the protocols the data transfer process relies on a protected by the firewall. Second, the data should be encrypted using the recent encryption algorithms that prevent the data from decoding during the transition. Secure encoding and decoding algorithms also ensure that the data is encoded and decoded using the primary and secondary key, which prevents the intruder from obtaining it off one protected and was not shared before the encoding process was initiated (Washer, 2014). It means that the use of the most hashing algorithms will also contribute to better data encapsulation, hence leading to higher data integrity.

Meanwhile, it is worth admitting that the data still could be compromised during the transit based on the interruption because of the contrasting server settings. For instance, if the cloud server is not configured appropriately, there is a risk of facing the slow process of data exchange, which consequently creates a timely opportunity for intruders to interfere and decode it. Moreover, it is essential to use the most modern equipment and perform ping tests that would demonstrate if the speed of data exchange is secure and satisfy the requirements of users and administrators.

 

References

Administrator. (n.d.). Understanding VPN IPSec Tunnel Mode and IPSec Transport Mode - What's the Difference? Retrieved from http://www.firewall.cx/networking-topics/protocols/870-ipsec-modes.html

Alsulami, N., Alharbi, E., & Monowar, M. (2015, March 3). A Survey on Approaches of Data Confidentiality in the Cloud Computing Systems. Journal of Emerging Trends in Computing and Information Sciences. Retrieved August 25, 2019, from http://www.cisjournal.org/journalofcomputing/archive/vol6no3/vol6no3_9.pdf

Alsulami, N., Alharbi, E., & Monowar, M. (2015). A Survey on Approaches of Data Confidentiality in the Cloud Computing Systems. Journal of Emerging Trends in Computing and Information sciences, 6(3), 188-197.

Francis, M. (2016, December 21). Hybrid Cloud Manager Deployment Considerations. Retrieved from https://blogs.vmware.com/consulting/2016/12/hybrid-cloud-manager-deployment.html

Kerravala, Z. (2018, November 9). What is Transport Layer Security (TLS)? Retrieved from https://www.networkworld.com/article/2303073/lan-wan-what-is-transport-layer-security-protocol.html

Kessler, G. C. (2019, August 14). An Overview of Cryptography. Retrieved from https://www.garykessler.net/library/crypto.html#why3

Kommalapati, H. & Zack, W. H. (2011, October 3). The SaaS development lifecycle. InfoQ. Retrieved from https://www.infoq.com/articles/SaaS-Lifecycle

Miyachi, C. (2013). Software systems architecture in a world of cloud computing. Retrieved from https://sdm.mit.edu/news/news_articles/webinar_052013/miyachi_052013.pdf

Washer, E. (2014). Leveraging Cloud-Based Business Networks For Collaboration. Retrieved from http://blogs.sap.com/innovation/cloud-computing/leveraging-cloud-based-business-networks-collaboration-01251933

What is HTTPS? - Definition from Techopedia. (n.d.). Retrieved from https://www.techopedia.com/definition/5361/hypertext-transport-protocol-secure-https

What Is Secure Sockets Layer (SSL), (n.d.). Retrieved from https://www.digicert.com/ssl/