Magellan Final Report - Office of Science - U.S. Department of Energy

Magellan Final Report
The set of controls set out in the FedRAMP document are designated for low and medium baselines. For
the current control baseline, we have a low impact cloud system. Since the focus of the FedRAMP document
was on consumers of cloud resources rather than producers, we needed to digest the contents of the document
from an alternate perspective. As well, since institutional responses to individual control entities are driven
by local requirements, needs, and philosophy, any sort of detailed response is well outside the scope of this
document. However, at a minimum, the following steps should be taken.
1. A “user” should be a uniquely identifiable entity (such as a user account) where a complete Access
Control, Audit and Accountability process can take place, and who then is granted the right to launch
a VM within their own system context.
2. For pre-vetted instances (where the user is not granted root access), site security controls must be
applied for sections Access Controls (AC), Audit and Accountability (AU), and Identification and
Authentication (IA ) from the NIST 800-53 publication.
3. For non-vetted images, or where the users will be granted root access, active scanning and analysis is
required.
In the same way that the technical aspects of computer security are evolving for cloud computing
providers, identifying how this new technology will fit into the current sets of security controls remains
an area for exploration.
8.3 Recommended Further Work
There are a number of areas that we feel should be addressed to advance the state of security on a cloudbased
system like Magellan. While many tools and techniques used with typical large multiuser systems can
be applied to cloud-based systems, these tools and techniques would evolve more rapidly through tighter
integration into the cloud-stack software.
Further Security Control Automation. Some work was done during the project to integrate the cloud
software with automated security systems. Additional work is required in this area. With the dynamic nature
of cloud systems, the security controls must evolve to be similarly dynamic and flexible. The integration of
security policy tools directly into the cloud control software would be ideal, as it would allow enforcement of a
site’s security policies while the user worked instead of being applied after the fact by systems that monitor
for changes. This would also enhance the responsiveness of the system. Security setting modifications
could be requested by the user, checked against a site’s policies, and implemented or denied, all in a single
integrated operation.
Enhanced Forensic Capabilities. Due to the ephemeral nature of cloud resources, performing forensic
analysis on these virtualized systems is fraught with many challenges, both technical and legal. When
there is a need to analyze a physical system involved in a security incident or crime, the system is usually
taken into evidence. Its storage devices are copied and verified, and those files are then analyzed. The
practice of computer forensics is well established, and evidence produced through this analysis is accepted
in courts worldwide. Virtualized systems provide a new twist for computer investigators. Should the need
arise to collect evidence from a virtualized system, the methods and practices are not as clear-cut. Can
the investigator capture an image of the virtual disk associated with a given resource, or must they analyze
the physical hardware that underlies the infrastructure Depending on the size of the cloud itself and the
underlying software, the answer to this question could have widespread effects on the cloud system. If a
portion of the physical system must be removed for processing, the resources of the cloud could be diminished
significantly. On the other hand, if an investigator captures and analyzes only the virtual disk associated
with a given virtual system, will that satisfy the court Or will the opposing attorneys be able to raise
enough doubt about the evidence in the judge or jury that it may be thrown out
42