NIST sets security approach for cloud computing

The National Institute of Standards and Technology has issued "Guidelines on Security and Privacy in Public Cloud Computing," Special Publication 800-144, which provides an overview of the security and privacy challenges facing public cloud computing. It marks the first set of principles for managing cloud security, NIST officials said.

The publication also presents recommendations that organizations should consider when outsourcing data, applications and infrastructure to a public cloud environment. The document provides insights on threats, technology risks and safeguards related to public cloud environments to help organizations make informed decisions about this use of this technology.

"Guidelines on Security and Privacy in Public Cloud Computing" was first issued as a draft for public comment in February 2011.

"Public cloud computing and the other deployment models are a viable choice for many applications and services,” said publication co-author Tim Grance. “However, accountability for security and privacy in public cloud deployments cannot be delegated to a cloud provider and remains an obligation for the organization to fulfill."

The key guidelines include:

  • Carefully plan the security and privacy aspects of cloud computing solutions before implementing them.
  • Understand the public cloud computing environment offered by the cloud provider.
  • Ensure that a cloud computing solution — both cloud resources and cloud-based applications — satisfies organizational security and privacy requirements.
  • Maintain accountability over the privacy and security of data and applications implemented and deployed in public cloud computing environments.

SP 800-144 is geared toward system managers, executives and CIOs making decisions about cloud computing initiatives; security professional responsible for IT security; IT program managers concerned with security and privacy measures for cloud computing; system and network administrators; and users of public cloud computing services, NIST officials said.

The publication also offers a detailed list of Federal Information Processing Standards and NIST special publications that provide materials particularly relevant to cloud computing and are recommended to be used in conjunction with SP 800-144.

It won't be the last word from NIST on cloud security, said Donna Dodson, NIST's division chief of the computer security division and the deputy cyber security advisor.

Speaking on January 18 at an event co-sponsored by Federal Computer Week and ImmixGroup, she said NIST is working on revisions to another circular, SP 800-53, with a close look at cloud and mobile guidelines, according to ImmixGroup vice president of marketing Allan Rubin. SP 800-53 is titled "Recommended Security Controls for Federal Information Systems and Organizations."

About the Author

Rutrell Yasin is is a freelance technology writer for GCN.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group