Tue, May 19, 2009 — CSO — The dramatic change in the rate of adoption and the amount of discussion taking place regarding cloud computing demands that this technology, or rather a set of related technologies, continue to evolve utilizing a security-sensitive design.

Cloud Security Alliance Formed

We approach quickly the point in which the amount of data and of processing in the cloud will be not only unmanageable but also pose a security and related privacy risk to the users of the data, and to people who the data concerns. [Related: Cloud Computing: Making the Right Choices] Cisco CEO: Cloud Computing a 'Security Nightmare']

In this series of articles, I do not intend to solve the problem of security in the cloud. My intent is to define the problem and propose several salient ways to address it. As always, comments are welcome. [Related: Cloud Computing: Making the Right Choices]

TerminologyWhile the term "cloud computing" may be new, the idea certainly is not. Just look at the greatly varying definitions I found while researching this article. These include all of the following technologies:

• 1. The grid
• 2. VMWare and Xen-type virtual machines
• 3. IBM-type mainframes
• 4. Amazon-type flexible storage
• 5. Intel VTX-type hypervisors
• 6. Page files
• And many, many others

Instead of focusing on a specific technology, I propose we define the salient characteristics of cloud computing. For the purposes of this article series, I will define cloud computing as the technology having the characteristics of:

"Service-based data processing and storage capability which is flexible, extensible and virtual"

Some may add the following:

"and available via the Internet"

I will treat the second part of the definition as optional, for the purpose of discussing security. I find that the connectivity method here is secondary to the basic tenets of security, and thus am able to include locally virtualized machines in the discussion.

Generally, the purpose of cloud computing is to avoid the expense involved in building or acquiring the infrastructure. Similarly, when deploying virtual machines, one does not buy multiple servers or separate processors. I find the computing slice concept -- which includes storage, processing power, etc. -- to be a compelling one. In the near future, I predict that we will not even CARE whether the computing slice resides locally or across the world. As long as the computing service is provided in a timely and efficient manner, we will be satisfied.

When dealing with cloud-based delivery, the problem with security grows. Instead of having direct control over our concept of "defense in depth," we now have marginal control at best. Many times, such as with Amazon's EC2 service we have virtually no control, no pun intended. We sometimes do not have even the basic notification of something about to go wrong or something that has.