Facilitando o acesso às melhores práticas de segurança para ambientes cloud

Abstract

Cloud infrastructure has increasingly been adopted by small businesses, as it brings greater efficiency, ease, and convenience to these startups. However, these models can give a false sense of security that their applications are fully protected against cyber attacks. Following best security configuration practices in cloud environments is crucial to mitigate risks, but startups often face difficulties due to lack of experience and limited utilization of complex materials. Failure to implement these practices can result in significant financial impacts, with studies showing that more than half of the small businesses interviewed stated they could go bankrupt after an attack. Based on the best security practices of Amazon Web Services (AWS), an application was developed that filters these practices according to the context of a startup, simplifying access to the material and making it more efficient than reading the AWS documentation directly. The startup’s context is determined by a Mealy state machine, which recommends appropriate practices based on the user’s responses to a questionnaire. The application was designed to be reusable in contexts beyond information security, allowing other questionnaires to recommend practices and controls by leveraging what was developed in this work. The application received positive feedback, indicating that it is on the right track. Future improvements include creating an interface for generating new questionnaires, adding new ways to visualize practice prioritization, such as an Eisenhower matrix, and expanding the scope of security practices to other cloud service providers like Google Cloud Platform (GCP) and Microsoft Azure.