Clearing the Cloud Part II | A Ray of Sunshine On A Cloudy Day || Cloud Computing Security (1)

In the first in this series of "Clearing the Cloud" columns, I explored the dangers of jumping too soon into cloud computing. In this article, the second in the series, I continue my vision on how to manage and secure cloud-computing solutions.

Clearing the Cloud Part II – A Ray of Sunshine On A Cloudy Day

In the weeks that passed since the publication of my first article, it seemed that new information and new “Cloud Solutions” were popping out every day, and sometimes every hour. I am gratified to see that NIST, the National Institute of Science and Technology, has published their (15^th) draft on Cloud computing, and with it, agreed with much of the definition I proposed in part I of this article – “Service based data processing and storage capability which is flexible, extensible and virtual”. NIST suggested that cloud computing has the following salient characteristics: That it would be:

• On-demand self-service, based upon
• Ubiquitous network access, using
• Location independent resource pooling, feature
• Rapid elasticity and provide
• A Measured Service.

It is interesting to note that NIST specifically called out the piece about the service having to be measured.   I wholeheartedly agree and take this to be a step in the maturity of Cloud Computing.

Security Models

The Jericho Forum proposed an interesting approach to cloud computing security. Starting with a description of Cloud Layers below, allows us to envision the problem:

Figure 1: Jericho Forum's Cloud Layers

Here, the Forum proposed that Security (and Identity Management) are elements that cross all layers and in effect provide a design they call Collaboration Oriented Architecture (COA). Once this foundation has been laid, they defined Cloud Security as a proposed a cube-shaped model that highlights various possibilities of architecture, the one addressed here is, of course, the outsourced / external / De-Parameterized option.

At about the same time, the Cloud Security Alliance, of which I am a member, designed a not-too-different view. The CSA broke down Cloud computing into three delivery types:

1. Infrastructure as a Service (IaaS)
2. Platform as a Service (PaaS)
3. Software as a Service (SaaS)

1. Private
2. Public
3. Managed
4. Hybrid

Figure 3: Cloud Computing Cube

The CSA’s model of service delivery stacks, however, is very complicated.    While I do not disagree with their reference model, I find it to be exceedingly complex.  So, allow me here to define the problem statement a bit differently than above. Because these are the early days of any cloud discussion, and that translates usually into this time being the formative years, let’s expand the basic three tenets of security, which are:

1. Confidentiality
2. Availability and
3. Integrity

And add additional controls.   We will borrow from Donn Parker’s Hexad, and add:

1. Possession (or Control)
2. Authenticity and
3. Utility

Clearly, in the case of Cloud computing, and especially in the Public/External case, we no longer have any control. Once the bits “leave our network,” control passes elsewhere.   And then there were five. The next article in this series will continue with anaylzing the other Control, and will follow up in a future article with my suggestions for improvment. Come visit me at www.arielsilverstone.com !