Page 40 - FCW, July30, 2016

ExecTech
firmed vulnerabilities almost daily,
there have been virtually no reported or confirmed breaches of hypervisors since the use of commercial clouds became widespread.
2. Transparency
Remember the time someone set up a server and forgot to add it to the inventory? That scenario, which can create a security nightmare, does not — in fact, cannot — happen in a commercial cloud environment. With cloud, there is total transparency. You cannot hide, forget about or lose track of servers, workstations, firewalls or any device in a cloud environment.
Further, the entire underlying network and security fabric is fully accessible and available. Because everything is completely visible at all times, your agency’s security posture is dramatically enhanced.
There is so much transparency of your comprehensive inventory and configuration information in the cloud that a new problem is created: using the right tools to collect and manage all the data. But that is easily solvable with your cloud partner.
3. Configuration management
Configuration management is one of the key elements of a highly secure environment, and it’s much easier to do in the cloud. Consider this sce- nario: You spin up a new server, con- figure it and harden it (lock it down, from a security perspective). In a tra- ditional or legacy environment, that could take hours and usually involves some sort of previous image disk. And then even minor changes by the hard- ware vendor can cause problems.
A cloud environment lets you eas- ily and quickly package up and rep- licate that configuration, either as part of the machine image itself or, better yet, as an automated part of the machine provisioning process. In other words, you can repeatedly (and infinitely) create new instanc-
es that you’re 100 percent sure are configured and hardened to the most current state because the process is fully automated and can be actively confirmed.
4. FISMA and FedRAMP
The Federal Information Security Management Act defines a compre- hensive security framework for fed- eral agencies to follow when deploy- ing systems and services. The Federal Risk and Authorization Management Program provides a standardized approach to FISMA for cloud pro- viders. FedRAMP primarily focuses on FISMA Moderate (although it also covers FISMA Low and has a new effort focused on FISMA High) and adds a number of controls specific to operating in the cloud.
All cloud offerings must meet or exceed the FedRAMP controls. What does that mean for someone who wants to use the cloud? It means you’re getting a big jump-start on your security controls because someone else has done significant validation and testing of the FISMA require- ments for your cloud infrastructure.
And perhaps most important, it means you can trust your FedRAMP- authorized cloud provider not just when things are working well but when there are issues.
As the customer, you still must review and sign off on the cloud provider’s FedRAMP security assess- ments and controls, but having a sin- gle, comprehensive security package that has been certified by FedRAMP can reduce your overall authority-to- operate process significantly, some- times by 50 percent or more.
Shared responsibility
As the above examples make clear, the cloud provider becomes your part- ner in enhancing your agency’s secu- rity. Nevertheless, security is still a shared responsibility. The IaaS cloud provider is responsible for the infra-
structure up through the hypervisor; the agency is responsible for the oper- ating system and the applications that run on top of that hypervisor.
As the customer, you control access to what you put in the cloud. Applications, data, authentication and authorization, for example, are your responsibility. To ensure a strong security posture, among other things, you must encrypt your data at rest and in transit; you must manage data, including personally identifiable infor- mation and protected health informa- tion, in the right ways; and you must implement consistent and secure access controls. But you had to do all that before the cloud.
Therein lay the beauty and sim- plicity of security in an IaaS cloud environment. The provider secures the infrastructure, which is no easy task, so that you can spend your time focusing on application security and securing the things that are unique to your environment. And that’s exactly where agencies should be focusing their security efforts.
What about PaaS and SaaS?
An IaaS provider only has access to the physical infrastructure and the software below the hypervisor, while platform-as-a-service and software- as-a-service providers have access to much more — often your systems and data. That means many of the application-level security controls that are clearly your responsibility when working with an IaaS cloud provider are now at least in part the responsibility of the PaaS or SaaS cloud provider.
That means you might need to make sure you can control which of the vendors’ employees have access to your data, or you might even need to ensure that their employees have the appropriate security clearances. n
Mark Pietrasanta is chief technology officer at Aquilent.
32 July 30, 2016 FCW.COM