all transport layers, including TCP, SSL, and message transport such as HTTP or message-oriented middleware (MOM). With the latter in particular, the policy air gap may break QoS characteristics (such as transactional context, guaranteed one time delivery, end-to-end delivery reliability, etc.) unless explicitly propagated using protocols like XA.

Propagation, however, may not be entirely desirable in cloud environments. The policy-mediated air gap is an important design pattern because it establishes a clear, customer-managed demarcation between the inside of the cloud and the outside Internet. Both sides have a distinct set of security challenges and demand different approaches to threat mitigation and establishment of trust.

The air gap pattern also serves as a reminder to application designers to build for resiliency. Cloud providers are highly visible and accessible, making these natural targets for system cracking attempts. Recent attacks against public cloud-resident applications such as Bitbucket (Nohr 2009) underscore the need to recognize that all cloud services may be subject to continuous assault and should be hardened in the manner of traditional DMZ-based applications – notwithstanding the protective capacity of the PEP. This is not a typical design imperative for on-premise SOA applications.

18.4.9  Binding PEPs and Applications

As with any multi-tenant facility, the internal cloud network must be considered a hostile environment. All communications to or from application instances must pass through the PEP security and management layer. There are two strategies to bind PEP and managed application in the cloud: intermediary isolation and the protected application stack.

18.4.9.1  Intermediary Isolation

In the intermediary isolation model, a single PEP can simultaneously protect one or more virtualized cloud application instances. The PEP runs in its own virtual instance; this is self-contained, hardened against attack, and optimized for high throughput.

The challenge here is providing last mile security and isolation of the application. Protect the hop between the PEP and each application instance with SSL with mutual certificate authentication. Application servers universally support SSL and it is appropriate for such point-to-point transmissions in a single hop, synchronous environment. Use of WS-Security message-oriented security models is not recommended as this does not add any value for such a localized transmission and suffers from increased processing overhead, complexity, and uneven support. An exception to this is some WS-Security token profiles, as these solve trust problems in a standardized framework. If there is a need to propagate a statement describing attributes, entitlements,