The SeCA Model

Introduction

According to both commercial reports as academic research, security issues are paramount when adoption of cloud solutions are being considered (Foster, Zhao, Raicu, & Lu, 2008; Ghinste, 2010; Mowbray & Pearson, 2009). However, no clear model exists to determine security issues and solutions.

Better yet, there is much debate which security threats and risks are applicable to computer networks, end-users or are actually cloud specific (Chen, Paxson, & Katz, 2010:4). They state that “arguably many of the incidents described as ‘cloud security’ in fact just reflect traditional web application and data-hosting problems [..] such as phishing, downtime, data loss, password weaknesses, and compromised hosts running botnets.”. Moreover, they hold that most cloud security issues aren’t new, but do need new implementations to provide the level of security wanted.

Therefore this chapter will provide an overview of the security issues and describe the Secure Cloud Architecture (SeCA) model to determine the security issues one might expect in a certain cloud environment and what solutions might be used to secure those issues. This framework will be developed by answering the following question:

This model was developed in three steps. First, a literature review has been conducted. Second a delphi study was conducted to identify the perceived security issues by experts in the field. Third, the model was verified by the same experts in the last round of the delphi study.

By reading the overall themes in security, followed by cloud specific topics, an overview has been created that is used as the starting point in the development of the SeCA model.

A delphi study has been considered to be the best method for research in this chapter, as it provides the researchers with a qualitative data set which would allow to create and verify the model. It also allows the experts to see answers and be able to respond to these answers in upcoming rounds (Dalkey & Helmer, 1963). The first answer in question two is not per se answered by the same expert as answer one in question one, creating double-blind survey results. This way, a consensus can be reached on the various topics discussed in the delphi study. The delphi method was executed consisting of three rounds of surveys with qualitative questions. Three rounds were chosen instead of two, which is more common (Skulmoski, Hartman, & Krahn, 2007), so that a first round could be used to obtain general information on the topic, not specifically regarding to the model to be developed, while still having enough rounds to reach a consensus. The first round consisted of open questions where the experts were questioned on their experience with security and the cloud, issues and concerns regarding security in the cloud. These questions gave a wide result set that strengthened the results of the literature research earlier performed. Seventeen respondents answered all the questions in the survey in all three rounds, a rate of 65%. See Table 1 for an overview.