Serviços de segurança sob demanda: um estudo de caso

Abstract

Nowadays, to keep Web systems safe is one of the greatest challenges of the industry and academy. Companies need to spend increasing amounts of money to minimize the risk of security incidents and losses for the business. One way of mitigating risks, while still reducing the amount of investments, is by outsourcing the services that are not part of the business portfolio. This work aims to contribute on fulfilling this gap, i.e., provide a solution for offering on-demand security services. To achieve the goal we propose a architecture for offering security services, in particular Web application vulnerability scanners, in a simplified and elastic way. A solution to this problem can be achieved through an integrated system that receives the clients’ requests, automatically executes vulnerability scanners, as well as process and send the output of the scanners to the customer. The elasticity of the system can be achieved through cloud computing, more precisely by virtual machines that can be dynamically allocated in cloud providers such as Amazon, Google and Rackspace. By having a dynamic pool of resources, the system is capable of supporting a variable number of vulnerability scanners and a potentially unlimited number of clients without affecting or compromising the services provided to the end users. A prototype implementation, named SafeWeb, was developed to evaluation the proposed architecture. Lastly, we also discuss some of the challenges and future work, such as the accurate measurement of the resources required by each scanner, which provides the means for defining the costs of the services and also to optimized the use of the available resources. Another future work is to come up with an adequate financial model for the proposed system, which takes into account the size and complexity of the target systems, for instance.