InfoQ Homepage Security Content on InfoQ

Articles

RSS Feed

Newer Older

Automating Data Protection Across the Enterprise

This article builds on the foundational Regulatory Compliant Cloud Computing (RC3) architecture for application security in the cloud by defining a Data Encryption Infrastructure(DEI) which is not application specific. DEI encompasses technology components and an application architecture that governs the protection of sensitive data within an enterprise.

Arshad Noor
on Feb 07, 2013
Do we really need identity propagation in SOA and Clouds?

Identity Propagation through Single Sign-On(SSO) has been assumed to be a panacea for all identity issues in SOA and Clouds. In this article, Michael Poulin raises questions around the business feasibility of propagation and proposes a delegate model of representation instead.

Michael Poulin
on Aug 20, 2012
Don't SCIM over your Data Model

This opinion piece discusses three specific suggestions for improving the SCIM data model: 1. Both the enterprise client and cloud provider should map their internal IDs to a shared External ID, which is the only ID exposed through the API. 2. Multi-valued attributes of a resource must be converted from an array into a dictionary with unique keys. 3. 3 ways to improve the PATCH command

Ganesh Prasad
on Aug 08, 2012
Defending against Web Application Vulnerabilities

In this article, authors discuss the security in software development life cycle and how to defend against web application vulnerabilities using techniques like white-box analysis and black-box testing. They also talk about secure coding practices based on the defense-in-depth approach using three lines of defense: input validation, hotspot protection, and output validation.

Marco Vieira Nuno Antunes
on Jul 27, 2012
Standardizing the Cloud for Security

Orlando Scott-Cowley discusses security in the cloud and the need for industry standards to lower the barriers to entry while ensuring that customer data is safe.

Orlando Scott-Cowley
on Jul 05, 2012
A Distributed Access Control Architecture for Cloud Computing

Cloud computing’s multitenancy and virtualization features pose unique security and access control challenges. In this article, authors discuss a distributed architecture based on the principles from security management and software engineering to address cloud computing’s security challenges.

Muhammad I. Sarfraz Saleh Basalamah Arif Ghafoor Walid G. Aref Abdulrahman A. Almutairi
on Jun 12, 2012
Managing Security Requirements in Agile Projects

Managing security requirements from early phases of software development is critical. Most security requirements fall under the scope of Non-Functional Requirements (NFRs). In this article, author Rohit Sethi discusses how to map NFRs to feature-driven user stories and also how to make security requirements more visible to the stakeholders.

Rohit Sethi
on Jun 04, 2012
The Future of Authentication

In this IEEE roundtable discussion hosted by guest editors Richard Chow, Markus Jakobsson, and Jesus Molina, the panelists discuss current authentication approaches, how to authenticate users on mobile devices and the future direction of authentication.

Markus Jakobsson Paul van Oorschot Dirk Balfanz Richard Chow Steve Kirsch Scott Matsumoto Jesus Molina Ori Eisen
on May 04, 2012
Commitment – Writing a Graphic Novel explaining Real Options

Building on their work on Real Options, Chris Matts and Olav Maassen are writing a graphic novel to explain the concepts and share their knowledge in the area. They discussed the novel, the process of producing it and the crowdsourcing model of funding with Shane Hastie from InfoQ. A sample chapter is available for InfoQ readers to download.

Shane Hastie
on Apr 05, 2012
Interview and Book Review: The CERT Oracle Secure Coding Standard for Java

"The CERT Oracle Secure Coding Standard for Java" book covers the rules for secure coding using Java programming language and its libraries with the goal to help Java developers eliminate insecure coding practices that can lead to vulnerable code. InfoQ spoke with book authors about how the security rules discussed in the book compare to other security coding frameworks.

Srini Penchikala
on Feb 15, 2012
10 tips on how to prevent business value risk

One category of risk that project teams need to ensure they address is business value failure – delivering a product that fails to provide value for the business investor. The authors provide insight into the underlying causes of business value risk and provide ten tips on how to avoid them.

Olav Maassen Chris Matts
on Feb 07, 2012
Software Engineering Meets Services and Cloud Computing

In this IEEE article, authors Stephen Yau and Ho An talk about application development using service-oriented architecture and cloud computing technologies. They also discuss application development challenges like security in a multi-tenant environment, quality-of-service monitoring, and mobile computing.

Ho G. An Stephen S. Yau
on Jan 04, 2012