Key Message: Depending on the service model, cloud providers and customers can monitor and implement controls to better protect their sensitive information.
Executive Summary
The general characteristics of cloud computing’s three service models include on-demand self service, broad network access, pooling of resources, rapid elasticity of provisioning resources, and service or resource monitoring. A cloud can be modeled in seven layers with controls at each layer. The responsibility for monitoring and implementing controls falls to either the cloud service provider or the cloud customer based on the service model. Such controls can help ensure, through auditing and monitoring, that sensitive information in the cloud is adequately protected. The contract or service level agreement between the customer and the provider is the keystone for building a strong trust relationship and ensuring reasonable interactions.
In this podcast, Jonathan Spring, a member of CERT’s Network Situational Awareness team, discusses how cloud service users can better ensure that their sensitive information is as secure as possible.
A Short Definition of Cloud Computing
According to the U. S. National Institute of Standards and Technology report DRAFT Guidelines on Security and Privacy in Public Cloud Computing, cloud computing is composed of five essential characteristics:
and three service models:
Rapid Elasticity of Provisioning Resources
This is one of the key characteristics of using services in the cloud. For example, if a user wants to increase their CPU cycles from 1 billion to 10 billion, this can be done in a matter of seconds. This is possible due to the available resources owned and offered by the cloud provider. In other words, such resources are elastic given they are shared across many customers.
Customer demand for resources can grow or shrink as needed. Being able to access this capability via a cloud service can be much more desirable than an organization having to acquire and maintain these resources in house.
Considerations When Using Any Cloud Service
Regardless of service model, customers of cloud services need to consider the following before contracting for such services:
Some of the controls described below will help mitigate this risk.
Cloud computing comes down to a strong trust relationship between the customer and the service provider, supported by contracts and service level agreements (SLAs).
Customers need to ensure that they include adequate auditing and monitoring powers in their SLAs.
Seven Layers of a Cloud Service
Based on the Cloud Security Alliance’s work, a cloud is modeled in seven layers:
The party responsible for implementing the controls listed below (service provider or customer) depends on the service model. All service provider controls should be explicitly called out in SLAs.
Based on providers dominating the market, customers likely have limited ability to assess or audit a provider’s controls.
All of these controls (and others) are described in more detail in resources [1] and [2].
Controls at the Facility Layer
These are implemented by the service provider as the provider is responsible for the facility layer in all service models. Controls include:
Controls at the Network Layer
These are implemented by the service provider as the provider is responsible for the network layer in all service models. Controls include:
Controls at the Hardware Layer
These are implemented by the service provider as the provider is responsible for the hardware layer in all service models. Controls include:
Controls at the Virtualization and Operating System Layer
These may be implemented by either the service provider or the customer based on the service model. Controls include:
Controls at the Middleware Layer
Middleware is hard to pin down. It may range from virtualization management tools and data format conversion to enforcing access controls. Middleware does include security functions, which are often a target.
These may be implemented by either the service provider or the customer based on the service model. For example, if the customer is only purchasing infrastructure as a service, the customer is responsible for these controls. Controls include:
Controls at the Application Layer
These may be implemented by either the service provider or the customer based on the service models. Controls include:
Controls at the User Layer
These may be implemented by either the service provider or the customer based on the service model. Controls include:
The SLA is the keystone for ensuring reasonable interactions with your service provider.
Resources
[1] Spring, Jonathan. “Monitoring Cloud Computing by Layer, Part 1.” IEEE Security & Privacy Magazine, IEEE Computer and Reliability Societies, IEEE, March/April 2011.
[2] Spring, Jonathan. “Monitoring Cloud Computing by Layer, Part 2.” IEEE Security & Privacy Magazine, IEEE Computer and Reliability Societies, IEEE, May/June 2011.
Cloud Security Alliance guidelines
Jansen, Wayne & Grance, Timothy. DRAFT Guidelines on Security and Privacy in Public Cloud Computing. Draft Special Publication 800-144. National Institute of Standards and Technology, January 2011.
ENISA (European Network and Information Security Agency) Cloud Computing Risk Assessment
Google Apps Messaging and Collaboration Products, Google Security Whitepaper, 2011.
CERT Podcast: The Upside and Downside of Security in the Cloud, June 16, 2009.