InfoQ Homepage Security Content on InfoQ
-
/articles/10-tips-prevent-business-value-risk/en/smallimage/red rose.jpg)
10 tips on how to prevent business value risk
One category of risk that project teams need to ensure they address is business value failure – delivering a product that fails to provide value for the business investor. The authors provide insight into the underlying causes of business value risk and provide ten tips on how to avoid them.
-
/articles/ieee-software-engineeering-services-cloud-computing/en/smallimage/small image.jpg)
Software Engineering Meets Services and Cloud Computing
In this IEEE article, authors Stephen Yau and Ho An talk about application development using service-oriented architecture and cloud computing technologies. They also discuss application development challenges like security in a multi-tenant environment, quality-of-service monitoring, and mobile computing.
-
/articles/regulatory-compliant-cloud-computing/en/smallimage/article icon.jpg)
Regulatory Compliant Cloud Computing: Rethinking web application architectures for the cloud
Not all data is sensitive and hence an equal and balanced investment in securing all data categories is not justified. This article presents an architecture that leverages cloud-computing, cloud-storage and enterprise key-management Infrastructure(EKMI) to lower costs while complying to data-security regulations.
-
/articles/cloud-security-architecture-intro/en/smallimage/art icon.jpg)
Introduction to Cloud Security Architecture from a Cloud Consumer's Perspective
Security concerns are the number one barrier to cloud services adoption. How do we evaluate a vendor's solution? What is an optimal security architecture? What are consumer versus provider responsibilities? What are industry standard patterns in this regard? This article answers some of these questions based on first hand experience dealing with large scale cloud adoption.
-
/articles/intrusion-tolerant-system-architectures/en/smallimage/article icon.jpg)
Comparison of Intrusion Tolerant System Architectures
In this IEEE article, authors Quyen L. Nguyen and Arun Sood discuss three types of intrusion tolerant system (ITS) architectures and their efficiency for intrusion tolerance and survivability. For the ITS architectures, they propose a taxonomy with four categories: detection triggered, algorithm driven, recovery based, and hybrid.
-
/articles/nosql-data-security-virtual-panel/en/smallimage/nosql image.jpg)
Virtual Panel: Security Considerations in Accessing NoSQL Databases
NoSQL databases offer alternative data storage options for storing unstructured data compared to traditional relational databases. Though the NoSQL databases have been getting a lot of attention lately, the security aspects of storing and accessing NoSQL data haven't been given much emphasis. This article focuses on the security considerations and best practices in accessing the NoSQL databases.
-
/articles/developer-driven-threat-modeling/en/smallimage/article icon.jpg)
Developer-Driven Threat Modeling
Threat modeling is critical for assessing and mitigating the security risks in software systems. In this IEEE article, author Danny Dhillon discusses a developer-driven threat modeling approach to identify threats using the dataflow diagrams.
-
/articles/mobile-attacks-and-defense/en/smallimage/article icon.jpg)
Mobile Attacks and Defense
In this IEEE article, author Charlie Miller talks about the mobile security vulnerabilities. He explains how smart phones are becoming targets of attackers and discusses security models of two smart phone operating systems: Apple's iOS and Google's Android. The attackers can get remote code to run on a mobile device in two ways: mobile malware and drive-by downloads.
-
/articles/agile-scale-fail-risk/en/smallimage/red rose.jpg)
Agile is at a crossroad: Scale or fail?
Risk management is the hottest topic in IT. Processes for effective risk management and investment decision making will allow Agile techniques to scale beyond projects to the enterprise. Without them, Agile will be confined to the ghetto of development. In this article Chris and Olav present some tools and techniques to identify and manage risks on Agile projects.
-
/articles/resilient-security-architecture/en/smallimage/small image.jpg)
Resilient Security Architecture
In this IEEE article, author John Diamant talks about how to improve security quality of software applications using a proactive approach with techniques like Security requirements gap analysis and Architectural threat analysis in the early phases of software development life cycle.
-
/articles/architecting-cloud-scale-identity/en/smallimage/small image.jpg)
Architecting a Cloud-Scale Identity Fabric
In this IEEE article, author Eric Olden discusses an identity fabric that links multiple applications to a single identity to manage the volume of user identities that network administrators must secure and to enable a full-scale cloud adoption.
-
/articles/caralli-risk-management-model/en/smallimage/small image.jpg)
Interview and Book Excerpt: CERT Resilience Management Model
CERT Resilience Management Model (CERT-RMM), developed at Software Engineering Institute (SEI), defines the processes for managing operational resilience in complex risk-evolving environments. InfoQ spoke with Rich Caralli, Technical Manager of the CERT Resilient Enterprise Management Team, about RMM framework and the book he co-authored.