Model based security for cloud services

A system for applying a security scheme to a network environment within which an application, comprising a cloud service, is to be instantiated comprising:

• a security component configured to:
• create the security scheme based upon an application service model for the application comprising the cloud service that is to be instantiated within the network environment, the security scheme comprising a file resource management security derived from the application service model, the file resource management security defining a file size limitation for the cloud service;
• instantiate the cloud service within a virtual machine hosted by the network environment;
• apply the security scheme to the network environment;
• and
• enforce the file resource management security upon the cloud service instantiated within the virtual machine, comprising:
• restricting the cloud service from maintaining a file comprising a size greater than the file size limitation.

A method for applying a security scheme to a network environment within which an application is to be instantiated comprising:

• creating the security scheme based upon an application service model corresponding to the application which is to be instantiated within the network environment, the security scheme comprising:
• a network filter security configured to isolate resources of a virtual machine in which the application is to be instantiated;
• a virtual machine security configured to define resource access of the virtual machine;
• an operating system security configured to define access to system resources based upon the application service model;
• a file security configured to define access to files, directories, and volume resources based upon the application service model;
• a file resource management security configured to define file size limitations based upon the application service model;
• an endpoint security configured to define access to one or more network endpoints based upon the application service model;
• a virtual account security configured to restrict the application from accessing operating system specific operations and resources not specified in the application security model;
• a process security configured to define at least one of memory access, CPU limits, or global object access within the virtual machine based upon the resource allocation plan;
• and
• an application security configured to:
• restrict access to operating system resources;
• and
• restrict execution of privileged operations specified within the application service model;
• and
• apply the security scheme to the network environment.