Cloud Computing Security Pattern

Cloud Computing Security Pattern

Legend:

Services provided by the Cloud Computing environment are not under direct control and therefore a few control families become more significant. Controls in the CA series increase in importance to ensure oversight and assurance given that the operations are being "outsourced" to another provider. SA-1/4/5 are crucial to ensure that acquisition of services are managed correctly. CP-1 helps ensure a clear understanding of how to respond in the event of interruptions to service delivery. The RA controls are very important to understand the risks associated with the service in a business context, but may be challenging to implement, depending on the supplier and the degree of visibility into their operations.

Availability

These concerns center on critical applications and data being available. Well-publicized incidents of cloud outages include Gmail (one-day outage in mid-October 2008), Amazon S3 (over seven-hour downtime on July 20, 2008), and FlexiScale (18-hour outage on October 31, 2008).

Availability Threat #1. Uptime

  As with the Traditional Security concerns, cloud providers argue that their server uptime compares well with the availability of the cloud user’s own data centers.

Uptime

Besides just services and applications being down, this includes the concern that a third-party cloud would not scale well enough to handle certain applications. SAP’s CEO, Leo Apotheker said: “There are certain things that you cannot run in the cloud because the cloud would collapse…Don't believe that any utility company is going to run its billing for 50 million consumers in the cloud.”

Traditional Security

These concerns involve computer and network intrusions or attacks that will be made possible or at least easier by moving to the cloud. Cloud providers respond to these concerns by arguing that their security measures and processes are more mature and tested than those of the average company.  Another argument, made by the Jericho Forum is:  "It could be easier to lock down information if it's administered by a third party rather than in-house, if companies are worried about insider threats… In addition, it may be easier to enforce security via contracts with online services providers than via internal controls".

Concerns in this category include:

Traditional security Threat #1. VM-level attacks

VM-Level Attacks

 Potential vulnerabilities in the hypervisor or VM technology used by cloud vendors are a potential problem in multi-tenant architectures.  Vulnerabilities have appeared in VMWare, Xen, and Microsoft’s Virtual PC and Virtual Server. Vendors such as Third Brigade mitigate potential VM-level vulnerabilities through monitoring and firewalls.

Fear of Security in Clouds

Organizations are rapidly turning to the Cloud to reduce costs, provide greater flexibility and quickly ramp up support of business needs. But as more data, applications and infrastructure move to the Cloud, security remains a top concern. In fact, according to the Cloud Security Alliance, security is cited as the number one barrier to adoption of Cloud services among organizations.

Organizations use the Cloud in a variety of different service models (SaaS, PaaS, IaaS) and deployment models (Private, Public, Hybrid). Regardless of how your organization leverages the Cloud, Cloud Security Threats can help your organization manage the security, risk and compliance concerns.

Cloud computing will reach mainstream adoption in the enterprise market by 2015

Cloud computing will reach mainstream adoption in the enterprise market by 2015 when key issues such as security, service availability and data sovereignty are expected to be ironed out.

Secured Cloud Computing

According to Simon Piff, associate vice president for enterprise infrastructure research at IDC Asia-Pacific, businesses today are still hesitant in utilizing cloud computing for much of their IT needs due to concerns over security, service reliability, data location and sovereignty, as well as vendor support.

Cloud Computing - An Introduction

Cloud Computing:

 Cloud Computing is a technology, which provides computation, software, data access and storage services, without requiring the client/end-user knowledge of the physical location and configuration of the system that delivers the service.

Types of cloud computing:

  Cloud Computing can be classified into 4 types based on hosting.