3 Problems Cloud Security Certification Can Solve Arrow to Content

May 17, 2010 | 2 Comments

By Jim Reavis

What if there were widely accepted standards for cloud security and, better yet, a universally recognized designation for “trusted” cloud providers?

The basic promise of cloud computing is undeniably appealing: Increase efficiency and reduce cost by taking advantage of flexibly pooled computing resources managed by somebody else.

Indeed, as Bill Brenner of CSO put it, “Given how expensive it is to maintain in-house hardware and software, the idea of putting one’s IT infrastructure in the cloud sounds downright heavenly.”

Unfortunately, this “heavenly” scenario is marred by real concerns about security – concerns which can range from network security basics like data integrity and identity management to abstruse questions of “local law and jurisdiction where data is held.”

Yes, cloud computing is changing everything from data center architecture to entire business eco-systems. However, as a new paradigm the many complex questions it poses, particularly when it comes to issues of security, governance, and compliance, are effectively preventing (or at least slowing) its widespread adoption.

So how would a Cloud Security Certification, such as that being proposed by the Cloud Security Alliance (CSA) help matters?

1. One standard cloud-specific definition for “secure”

“Security controls in cloud computing are, for the most part, no different than security controls in any IT environment,” the CSA writes in their recently released security guidance document for cloud computing.

“However,” the document continues, “because of the cloud service models employed, the operational models, and the technologies used to enable cloud services, cloud computing may present different risks to an organization than traditional IT solutions.”

A common, standardized definition of what properly belongs to cloud security would ensure that cloud providers and their clients operate with a shared, comprehensive view of the cloud security landscape and clear expectations of how it should be managed.

2. Streamline process for evaluating providers

The complexity of the cloud security equation and the fact that every provider addresses this complexity in its own unique way makes the process of mapping the security requirements of the enterprise to the capabilities of the vendor both difficult and time-consuming.

By allowing cloud providers to display a “visible seal of trust”, insists Novell’s Jim Ebzery, certification like this will give organizations “a simple way to assure their specific corporate security policies and regulatory concerns will be enforced in the cloud.”

3. Overcome security fears to Cloud adoption

Cloud technology can solve real problems faced by organizations and enterprises today and will play a major role in the evolution of IT infrastructure going forward. The continuing growth of this field will benefit everyone.

Nevertheless, the speed of this evolution, and the rate of innovation fostered by the cloud more generally, will absolutely be determined by the rate of cloud adoption.

The emergence of a generally accepted cloud security “seal of approval” should allay many of the concerns that stand in the way of this adoption and, ultimately, open the door to a future of practically unlimited opportunity.

What are your thoughts on a logo or certification program for the cloud?

Related CSA Resources Arrow to Content

Comments:

  1. CloudNinja
    05.26.10

    This is a great article and great resources. Certification would definately help although I’m sure would raise other issues as well.

    IMHO, when considering security, 2 items need to be addressed:
    1) Physical security of the hardware 2) Security of the Data – here are some resources to help as guidelines when considering the cloud:

    to help companies address those 2 points of concern – here are some resoucres I have found:
    Physical security:
    http://www.globalfoundationservices.com/security/index.html
    http://www.globalfoundationservices.com/security/documents/SecuringtheMSCloudMay09.pdf

    Data Security:
    http://www.research.microsoft.com/en-us/projects/cryptocloud/
    http://www.research.microsoft.com/en-us/projects/secpal/

    thoughts?

    hope that helps
    -cn

  2. Braulio J. Cabral
    07.22.10

    A certification process for cloud providers is definitely something that adds value to the cloud computing industry and also helps minimize security concerns stopping users from adopting cloud technology, however, it depends on many factors such as; who is the certifying authority? certification criteria, etc. The Federal Risk and Authorization Management Program (http://www.cio.gov/pages.cfm/page/Federal-Risk-and-Authorization-Management-Program-FedRAMP) is an initiative that is looking to provide cloud certification within the federal government. This is a good start, this initiative looks to certify those cloud components that are out of the control of the consumer, such as platform, servers, systems, etc. and allow agencies to continue with the traditional certification and accreditation process for the applications they deploy on the certified cloud. There are entities in the private sector who can learn from this initiative and instantiate similar certification authorities for cloud computing. I like the FedRAMP approach because it does not assume that the cloud provider will own the entire responsibility for the certification process, but the user will have to certify the part of the environment that they control.

    Braulio J. Cabral

Leave a Comment




Page Dividing Line