NIST looks to define the pros and cons of cloud models
Connecting state and local government leaders
New National Institute for Standards and Technology report describes the variety of cloud systems and discusses their strengths and weaknesses for government users.
Cloud computing has been identified as a tool for bringing greater efficiency, functionality and flexibility to government computing, but the variety of models for service delivery and customer needs complicates any discussion of the technology.
The National Institute of Standards and Technology is developing a synopsis of cloud models and of their strengths and weaknesses. A draft of Special Publication 800-146 has been released for public comment.
“Cloud computing is a developing area and its ultimate strengths and weakness are not yet fully researched, documented and tested,” according to Cloud Computing Synopsis and Recommendations. “This document presents what is known, gives recommendations on how and when cloud computing is an appropriate tool, and indicates the limits of current knowledge and areas for future analysis.”
Related stories:
At last, a solid definition of what a cloud looks like
NIST guide tackles security challenges of public cloud computing
Cloud computing spans a spectrum of technologies, configurations, service models and deployment models, and the appropriate mix depends on an organization’s requirements. The most recently released document builds on earlier NIST publications, including a draft definition of cloud computing included in SP 800-145 and “Guidelines for Security and Privacy in Cloud Computing” in draft 800-144.
“This is a general document,” NIST computer scientist Lee Badger said of the latest publication. “There is an opportunity and need for writing companion documents that explain subject areas in a lot of detail.”
Subject areas covered in SP 800-146 include deployment models, service models, economic considerations, operational characteristics, service-level agreements and security.
“Inherently, the move to cloud computing is a business decision,” the report concludes. Relevant factors to be considered include the readiness of existing applications for cloud deployment, transition and life-cycle costs, maturity of service orientation in the existing infrastructure, and security and privacy requirements.
The short definition of cloud computing used by NIST is “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”
Essential characteristics include on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
The types of environments described in detail in the document are:
- Software-as-a-service (SaaS).
- Platform-as-a-service (PaaS).
- Infrastructure-as-a-service (IaaS).
The environments have different levels of maturity and complexity, Badger said. IaaS is a relatively new service offering, but many of its components are well-known equipment such as routers and switches. This makes assessing strengths and weaknesses easier.
On the other hand, PaaS offerings are evolving rapidly with a variety of middleware and stacks. SaaS is not a new concept, but the scale being offered in the cloud is greater and the details depend on the operation of the applications being offered.
The document offers general recommendations for management, data governance, security and reliability, virtual machines, and software and applications. It also identifies a number of issues to be resolved by users.
“Cloud computing is not a solution for all consumers of IT services,” the document advises. “Complex computing systems are prone to failure and security compromise” and “it is important to understand that cloud systems, like all complex computing systems, will contain flaws, experience failures, and experience security compromises.”
While these considerations do not eliminate cloud computing as a viable option, issues to be resolved in each case in making decisions about cloud computing include:
- Computing performance.
- Cloud reliability.
- Economic goals.
- Compliance.
- Data and application security.
Comments should be sent to 800-146comments@nist.gov by June 13.