I was happy to read a very measured viewpoint about Cloud Security in the first couple of articles of Nov/Dec issue of IEEE Security and Privacy. The introduction sets a very constructive tone. I really appreciate the measured tone because I’ve been dealing with a lot of “knee jerk reactions” within our client-base around Cloud Security. Some of the concern is FUD and some of it is real, but there’s no dark magic. The solutions are just engineering and a bunch more “lawyering.”
The “Cloud Computing Roundtable” hits this “lawyering” topic pretty well. As long as you read the discussion with the “these guys mostly represent the perspective of service providers,” you’ll get good understanding of the macro issues involved: lack of technological sophistication of regulations, cross-border/jurisdiction regulation, and standards are still evolving to catch up. These are my macro takeaways. One perspective that I have had and was glad to have “confirmed” was Eric Grosse’s comment on the insider threat, “We [Google] have zero tolerance for the insiders abusing that trust…”. I’ve felt that for a XaaS vendor, they have a lot riding on protecting against the insider threat in their data centers.
Mom wanted me to be a lawyer, but I became an engineer, so I’m more interested in some of the more technical aspects that we not talked about. These interests have been keeping me too busy to write about them. But here are some of the perspectives that are a bit more technical in nature. Each probably deserves a longer discussion. I guess that should be my first 2011 resolution.
- Cloud Security is more than worrying about your XaaS platform. See points 2 and 4. Many times Cloud = AWS and it’s the mere mention of AWS that sends chills up and down peoples’ spines.
- Application architectures are using Cloud as a component in an overall solution.
- The security problems from other parts of the application are often just as bad (if not worse) the ones in the Cloud components.
- The potential problems of “finger pointing” between the multiple organizations scares me more than the technical vulnerabilities.
- The application architectures are starting to be Cloud+Mobile and not Cloud and/or Mobile.
- The integration of “Security from Cloud” (SaaS security services) creates new security challenges – they are not “plug and play” for their traditional counterparts in all cases. One example is that cloud-based intermediaries necessitate the need to implement WS-SecureConversation rather than just WS-Security alone.