Cloud security: Learning to trust the facts

For many agencies, cloud computing is the answer to a range of long-standing challenges, including scalability and true elasticity, barriers to entry, technology refreshes and cost savings. Yet cloud computing can introduce its own challenges, particularly in terms of security -- not necessarily in the capabilities of the cloud but in the perceptions that surround cloud because of its abstract nature.

The facts, however, tell a different story: Security in the cloud can equal, and often exceed, the security of an on-premises or legacy data center.

Why the disparity between perception and reality? Unlike on-premises and legacy data centers, cloud technology cannot be seen or touched. Federal IT teams have to put their trust in cloud providers, and that can understandably create questions and concerns.

It can also be uncomfortable for an agency to know it is potentially sharing the underlying physical hardware, which is mostly abstracted in the cloud, with other organizations. That discomfort often manifests in the form of security concerns.

To help dispel those concerns, let's look at four of the reasons an infrastructure-as-a-service (IaaS) cloud environment is, and can remain, highly secure.

1. Hypervisors

The hypervisor is the core software that allows multiple virtual machine instances to run on the same physical hardware. Its main job is to abstract the hardware and securely separate each of the virtual machine "tenants."

A key benefit of this simplicity is that the hypervisor has a minimal attack surface, helping it be very secure and prevent any exposure of the virtual machine instances via the hypervisor.

Hypervisors have been around for decades, and constant testing and hardening over time have further strengthened their security. Unlike operating systems that have confirmed vulnerabilities almost daily, there have been virtually no reported or confirmed breaches of hypervisors since the use of commercial clouds became widespread.

2. Transparency

Remember the time someone set up a server and forgot to add it to the inventory? That scenario, which can create a security nightmare, does not -- in fact, cannot -- happen in a commercial cloud environment. With cloud, there is total transparency. You cannot hide, forget about or lose track of servers, workstations, firewalls or any device in a cloud environment.

Further, the entire underlying network and security fabric is fully accessible and available. Because everything is completely visible at all times, your agency's security posture is dramatically enhanced.

There is so much transparency of your comprehensive inventory and configuration information in the cloud that a new problem is created: using the right tools to collect and manage all the data. But that is easily solvable with your cloud partner.

3. Configuration management

Configuration management is one of the key elements of a highly secure environment, and it's much easier to do in the cloud. Consider this scenario: You spin up a new server, configure it and harden it (lock it down, from a security perspective). In a traditional or legacy environment, that could take hours and usually involves some sort of previous image disk. And then even minor changes by the hardware vendor can cause problems.

A cloud environment lets you easily and quickly package up and replicate that configuration, either as part of the machine image itself or, better yet, as an automated part of the machine provisioning process. In other words, you can repeatedly (and infinitely) create new instances that you're 100 percent sure are configured and hardened to the most current state because the process is fully automated and can be actively confirmed.

4. FISMA and FedRAMP

The Federal Information Security Management Act defines a comprehensive security framework for federal agencies to follow when deploying systems and services. The Federal Risk and Authorization Management Program provides a standardized approach to FISMA for cloud providers. FedRAMP primarily focuses on FISMA Moderate (although it also covers FISMA Low and has a new effort focused on FISMA High) and adds a number of controls specific to operating in the cloud.

All cloud offerings must meet or exceed the FedRAMP controls. What does that mean for someone who wants to use the cloud? It means you're getting a big jump-start on your security controls because someone else has done significant validation and testing of the FISMA requirements for your cloud infrastructure.

And perhaps most important, it means you can trust your FedRAMP-authorized cloud provider not just when things are working well, but when there are issues.

As the customer, you still must review and sign off on the cloud provider's FedRAMP security assessments and controls, but having a single, comprehensive security package that has been certified by FedRAMP can reduce your overall authority-to-operate process significantly, sometimes by 50 percent or more.

Shared responsibility

As the above examples make clear, the cloud provider becomes your partner in enhancing your agency's security. Nevertheless, security is still a shared responsibility. The IaaS cloud provider is responsible for the infrastructure up through the hypervisor; the agency is responsible for the operating system and the applications that run on top of that hypervisor.

As the customer, you control access to what you put in the cloud. Applications, data, authentication and authorization, for example, are your responsibility. To ensure a strong security posture, among other things, you must encrypt your data at rest and in transit; you must manage data, including personally identifiable information and protected health information, in the right ways; and you must implement consistent and secure access controls. But you had to do all that before the cloud.

Therein lies the beauty and simplicity of security in an IaaS cloud environment. The provider secures the infrastructure, which is no easy task, so that you can spend your time focusing on application security and securing the things that are unique to your environment. And that's exactly where agencies should be focusing their security efforts.

What about PaaS and SaaS?

An IaaS provider only has access to the physical infrastructure and the software below the hypervisor, while platform-as-a-service and software-as-a-service providers have access to much more -- often your systems and data. That means many of the application-level security controls that are clearly your responsibility when working with an IaaS cloud provider are now at least in part the responsibility of the PaaS or SaaS cloud provider.

That means you might need to make sure you can control which of the vendors' employees have access to your data, or you might even need to ensure that their employees have the appropriate security clearances.