Security Automation - IAC - Defense Technical Information Center

More documents

Recommendations

Info

A s k t h e E x p e r t Cloud Assurance Still Missing by Allan Carey As with virtualization, organizations are flocking to cloud computing by the allure of lower costs. Instead of investing to purchase infrastructure and software, organizations and agencies are attracted by the idea of getting infrastructure, platforms, and software as a “pay per use” service. Along with lower fixed costs, however, use of cloud computing brings with it a loss of control and an exposure to various risks, particularly security risks. Practitioners are advised to— ff ff ff ff Understand exactly what cloud computing means, which includes understanding the taxonomy and layers Assess where cloud computing might make sense and which model of cloud computing, public vs. private, is the most appropriate Understand the risks faced, conduct a gap analysis, and develop plans to address the risks. Often these plans entail focusing on the basics by matching the business and security requirements against the most appropriate cloud models. Take actions such as classifying data and assets, conducting a risk assessment, evaluating vendors, educating their organization, and participating in the evolution of cloud computing. When people refer to “the cloud,” they are typically talking about the SPI model, which includes software (S), platform (P), and infrastructure (I) as a service. The following taxonomy describes the components and layers of these services. These different services and their many layers mean that organizations can pick and choose the different pieces of the SPI model that meet their needs— 1. Infrastructure as a service (IaaS)— This includes the physical facilities, the hardware, an abstraction layer, a core connectivity and delivery layer, and application program interfaces. Vendors in this space include Amazon EC2, GoGrid, and FlexiScale. 2. Platform as a service (PaaS)—This is the middleware that integrates the infrastructure and the resources that sit on top of it. It can include identity and access management, databases, and authentication. PaaS vendors are Force.com, Google AppEngine, and Coghead. 3. Software as a service (SaaS)—This is the data and the applications. Examples of SaaS vendors are Salesforce.com, GoogleApps, and Oracle on Demand. There are many similarities between cloud computing and virtualization. Virtualization is an enabler of cloud computing, as the new de facto atomic unit of the digital infrastructure is now a virtual machine. A reality of virtualization is that organizations have rushed to adopt it without solving many of its attendant security, privacy, and management challenges. And now, without having solved the problems associated with virtualization—problems that are within an organization’s own control— organizations are moving to the cloud, where they have even less control. The security problems that organizations face related to cloud computing are the same as those related to virtualization—but even more so. The abstraction of infrastructure points to the need for information centricity and, consequently, information assurance. Steps that security practitioners should take to decrease the risks associated with cloud computing involve common sense. Information assurance practitioners already have most of what is needed to make an informed set of decisions about cloud computing. The challenge is to match the organization’s business and security requirements against the various cloud “service” (aaS) models. Among the requirements: not being a speed bump to business operations and achieving and maintaining compliance. Activities that practitioners should engage in include conducting a cloud computing risk assessment and a gap analysis. An organization can assess security for each layer in the cloud and can identify any shortcomings. Some additional resources include the Cloud Security Alliance, cloud computing Google groups, and attending a local CloudCamp. n 34 IAnewsletter Vol 13 No 1 Winter 2010 • http://iac.dtic.mil/iatac
FREE Products Order Form Instructions: All IATAC LIMITED DISTRIBUTION reports are distributed through DTIC. If you are not a registered DTIC user, you must do so prior to ordering any IATAC products (unless you are DoD or Government personnel). To register online: http://www.dtic.mil/dtic/registration. The IAnewsletter is UNLIMITED DISTRIBUTION and may be requested directly from IATAC. Name______________________________________________________________________ Organization_ _______________________________________________________________ Address____________________________________________________________________ __________________________________________________________________________ __________________________________________________________________________ DTIC User Code_______________________________ Ofc. Symbol_ _________________________________ Phone_______________________________________ Email_______________________________________ Fax_________________________________________ Please check one: n USA n USMC n USN n USAF n DoD n Industry n Academia n Government n Other Please list the Government Program(s)/Project(s) that the product(s) will be used to support: ______________________________________________ ________________________________________________________________________________________________________________________ LIMITED DISTRIBUTION IA Tools Reports n Firewalls n Intrusion Detection n Vulnerability Analysis n Malware (softcopy only) Critical Review n Biometrics (soft copy only) n Configuration Management (soft copy only) n Defense in Depth (soft copy only) and Technology n Data Mining (soft copy only) n IA Metrics (soft copy only) n Network Centric Warfare (soft copy only) Assessment (CR/TA) n Wireless Wide Area Network (WWAN) Security n Exploring Biotechnology (soft copy only) Reports n Computer Forensics (soft copy only. DTIC user code MUST be supplied before these reports will be shipped) State-of-the-Art n Measuring Cyber Security and Information Assurance n IO/IA Visualization Technologies (soft copy only) Reports (SOARs) n The Insider Threat to Information Systems (soft copy only. DTIC n Modeling & Simulation for IA (soft copy only) user code MUST be supplied before these reports will be shipped) n Malicious Code (soft copy only) n Software Security Assurance n Data Embedding for IA (soft copy only) n A Comprehensive Review of Common Needs and Capability Gaps UNLIMITED DISTRIBUTION IAnewsletters hardcopies are available to order. Softcopy back issues are available for download at http://iac.dtic.mil/iatac/IA_newsletter.html Volumes 11 n No. 1 n No. 2 n No. 3 n No. 4 Volumes 12 n No. 1 n No. 2 n No. 3 n No. 4 Volumes 13 n No. 1 SOFTCOPY DISTRIBUTION The following are available by email distribution:: n IADigest n IA/IO Scheduler n Research Update Fax completed form to IATAC at 703/984-0773 IAnewsletter Vol 13 No 1 Winter 2010 • http://iac.dtic.mil/iatac 35
Page 1 and 2: 13/1 Volume 13 Number 1 • Winter
Page 3 and 4: IATAC Chat Gene Tyler, IATAC Direct
Page 5 and 6: S u b j e c t M a t t e r E x p e r
Page 7 and 8: Security Content Automation Protoco
Page 9 and 10: XCCDF System Under Test Rules State
Page 11 and 12: I A T A C S p o t l i g h t o n a U
Page 13 and 14: At its core, the timeline allows fo
Page 15 and 16: Test Requirements. When testing is
Page 17 and 18: The DoD IA Policy Chart by John Dit
Page 19 and 20: te a Trusted GIG ormation Assurance
Page 21 and 22: ff ff ff time-consuming task of det
Page 23 and 24: wings Tail outline head shield wing
Page 25 and 26: NIST SCAP data standards to create
Page 27 and 28: The result will be faster incident
Page 29 and 30: DoDTechipedia Happenings by Rogelio
Page 31 and 32: that, but it is really a good idea.
Page 33: ff status of information technology

Security Automation - IAC - Defense Technical Information Center

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?