Cloud caveat: Responsibility cannot be outsourced

Cloud computing is becoming a fact of life as agencies are pressed to make IT infrastructures more flexible and efficient. Agencies can off-load much of the work and expense of acquiring and managing hardware, software and services under a variety of cloud models, but responsibility cannot be outsourced.

“The end user is ultimately responsible,” said Carson Sweet, CEO of CloudPassage, a cloud security company. “The agencies are responsible for the data they process,” and that includes data on a third-party infrastructure.

Related coverage:

Congress' piece of the cloud: Supporting open standards, flexible acquisition

NIST plan for cloud encourages innovation

Adapting to this new environment will require new approaches to traditional security challenges.

"How do you determine that required security controls are being appropriately implemented?” Sweet asked. “Auditing a cloud is a totally different matter than auditing a data center that an agency owns.”

Data moved to a third-party platform must be made available to users, but the more remote the assets, the greater the number of devices between them and the users and the greater the risk, said VeriSign Chief Security Officer Danny McPherson.

“The more elements, the more people, the bigger the attack surface at the end of the day,” McPherson said.

Data can be protected by encryption, but managing cryptography can be challenging in the best of circumstances, said Russ Dietz, CTO of SafeNet. Moving data to the cloud adds complexity. “We have to use layers of encryption and different kinds of encryption,” Dietz said.

Crypto challenges

When it comes to cryptography, the real challenge is managing crypto keys. Distributing access controls across a cloud complicates this already complex management challenge, Dietz said. “It’s all about ensuring that the right key for the right asset is delivered to the right place at the right time.”

Adding to the challenges of controlling, securing and auditing cloud resources is the fact that this environment is young and evolving rapidly. In fact, one of the first challenges to be addressed in cloud computing is to define the term.

“Cloud computing can and does mean different things to different people,” the National Institute of Standards and Technology said in recently released draft guidelines for cloud security. So NIST has published a concise definition published in draft Special Publication 800-145 to provide a starting place for discussing and defining security needs.

According to the short definition in the document, “cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

Essential characteristics of cloud computing identified by NIST are on-demand service, broad network access, resource pooling, rapid elasticity and measured service. Service models for providing these include software as a service, platform as a service and infrastructure as a service. These can be deployed in any combination of private, public or community cloud models, depending on their management and how access to the resources is controlled.

Evolving threats, controls 

NIST said cloud computing remains an evolving paradigm, and that the underlying technologies, issues, risks and benefits still are being discovered and refined. This includes security threats and controls.

“The security challenges cloud computing presents are formidable, especially for public clouds whose infrastructure and computational resources are owned by an outside party that sells those services to the general public,” the guidelines in SP 800-144 state. The publication provides an overview of security and privacy challenges, and it identifies considerations that organizations should take when outsourcing data, applications and infrastructure to a public cloud.

Bringing government cloud security into line with federal security requirements, including those in the Federal Information Security Management Act, will require changes both in government regulation and security auditing practices to include third-party, multitenant environments, CloudPassage’s Sweet said.

The NIST definition and security guidelines are a good start, he said, and industry groups such as the Cloud Security Alliance are working to map industry security practices to FISMA requirements. But “it’s still early in that process. That’s a bit of a drag on cloud in general.”

Although cloud computing is intended to simplify management for the user, the underlying infrastructure can add complexity, and complexity generally means increased risk, VeriSign’s McPherson said. “The more dispersed your data is, the more elements involved in gaining access, the higher the probability that there will be an incident,” he said.

Because cloud platforms generally have multiple tenants, sometimes on a single server, this can increase the chances that an agency will become a victim of collateral damage, McPherson said. If a neighbor is hit by a denial-of-service attack, you could be taken offline as well. And if security tools used to isolate resources are not optimized for use in a virtual environment, a breach of one tenant could endanger other untargeted tenants.

Cloud security gains 

All of this does not mean that the cloud represents a net loss in security. A cloud can consolidate IT resources across multiple agencies and offices, each of which has historically handled its own security with limited resources. This shift could ease burdens and improve security.

“Securing perimeters and information security deployment can get dramatically easier in the cloud” because resources are being pooled, Dietz said. This could make it easier to cost effectively deploy more sophisticated security. “In the long run, if it is done properly, we can see where clouds will give better security, better trust and better controls,” Dietz said.

Ultimately, whether the benefits of cloud computing outweigh the risks are “100 percent application-specific,” McPherson said. There are some mission-critical national security functions that should probably never move to the cloud. Just where the dividing line between risk and benefit is, “the entire industry is struggling with that now.”