Trust and verify: Managing the cloud abroad and at home

 

Connecting state and local government leaders

Trusted computing can help agencies manage geographically dispersed servers and emerging OpenStack deployments.

Federal IT professionals used to be able to depend on keeping their information safe in secure on-premise data centers, but times have changed. Traditional data centers could be depended upon for consistent control, visibility and security, but today’s cloud-based centers offer new variants of those capabilities – a fact that IT administrators struggle with every day.

This is particularly problematic for those managing two adjuncts of today’s cloud-driven environment: geographically dispersed servers and emerging OpenStack deployments. Both pose their own unique challenges, including the need for assurance that systems are adhering to location-specific laws and security concerns in general.

Employing trusted computing can help overcome these challenges. Through trusted computing, administrators can verify the trust of the virtual infrastructure, identify the location of servers and audit for compliance with federal mandates. They can also gain better visibility into and understanding of their OpenStack deployments.

The process starts with what’s known as the “hardware root of trust,” a unique measurement that allows managers to be able to tell if the platform has been modified and where a particular cloud server is located, allowing them to enforce location-based restrictions. In the words of the National Cybersecurity Center of Excellence, the hardware root of trust “determines the integrity of the compute hardware and restricts the workload to cloud servers within a location.” It’s the foundation for the National Institute of Standards and Technology’s “Trusted Geolocation in the Cloud” proof-of-concept implementation.

Trust in the cloud   

Clouds know no boundaries and are variably smart and efficient. But different governments have specific laws pertaining to security and application management in the cloud.  The Federal Information Security Management Act, for example, requires that applications be run only within the United States. As a result, compliance can be challenging.

Security challenges occur because data and workloads can migrate from system to system, as well as across cloud deployments that span country boundaries. It is critical these environments be correctly managed. Users of the cloud need to assess the possible solutions that can help them manage their security, risk and compliance requirements while maintaining the efficiencies that the cloud provides.

Trusted Geolocation in the Cloud allows administrators to identify the location of a particular server, verify its trustworthiness and set configuration management and policy enforcement parameters to ensure the server is adhering to geographic restrictions. Periodic audits can be performed – automatically, minimizing the need for human intervention – to ensure that the server remains trustworthy and continues to adhere to regulations.

Additionally, Trusted Geolocation in the Cloud is a highly efficient and necessary means of verifying trusted servers, regardless of where they are located. It’s an ideal solution for federal managers dealing with highly distributed workloads.

The OpenStack challenge

The benefits of trusted computing are not just relegated to geography, however. Trusted computing can also help federal IT professionals gain insight into and control over their on-premise or cloud OpenStack deployments.

The U.S. government’s adoption of OpenStack as a cloud platform has gained significant traction over the last few years, but many users remain concerned with being able to verify their virtualization stacks. Trusted computing minimizes that problem by allowing managers to integrate secure controls and workload management protocols into their OpenStack environments.

The hardware root of trust provides the foundation for machines running OpenStack. It enables the machines to attest that they are running the correct version of the infrastructure and virtualization software and that the software hasn’t been tampered with or changed.

As an acknowledgement of OpenStack’s growing popularity, many vendors are now actively supporting the software through their trusted computing solutions. Given that, it’s becoming increasingly easy for federal IT managers to identify products to help them verify their OpenStack deployments.

Two steps forward

All of this may sound complex, but, in truth, there are really only two key steps toward implementing trusted computing. The first step is likely obvious: managers must acquire and procure systems that support trusted computing technologies.

The second step involves a slight shift in workplace culture. IT professionals must work with their security teams to clearly understand and delineate the policies that should be put in place. Verification can then coalesce with these specific policies. This should be done in the very beginning and serve as part of the foundation of a trusted computing initiative.

There’s a reason why NIST and the National Cybersecurity Center of Excellence have been pushing trusted computing as of late. As government agencies continue to move to the cloud, federal IT professionals need to do everything they can to ensure that their infrastructure, and the data it houses, remains secure. Trusted computing does that, making it a solution that every federal IT manager should take into consideration.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.