Is Compliance in the Cloud Possible
There is no doubt that cloud computing is dominating today's IT conversation among C-level security executives. Whether it's due to the compelling cost saving possibilities in a tough economy, or because of perceived advantages in provisioning flexibility, auto-scaling, and on-demand computing, CSOs are probing the capabilities, costs and restrictions of the cloud. At the same time, security and compliance concerns are at the forefront of issues potentially holding large enterprises back from capitalizing on the benefits that cloud computing has to offer.
Wed, January 06, 2010
CSO — There is no doubt that cloud computing is dominating today's IT conversation among C-level security executives. Whether it's due to the compelling cost saving possibilities in a tough economy, or because of perceived advantages in provisioning flexibility, auto-scaling, and on-demand computing, CSOs are probing the capabilities, costs and restrictions of the cloud. At the same time, security and compliance concerns are at the forefront of issues potentially holding large enterprises back from capitalizing on the benefits that cloud computing has to offer.
Cloud Computing Definitions and Solutions
Some of the most frequently asked questions among CSOs today about the cloud include: "Is using cloud computing services advisable for applications and data that are subject to compliance requirements? Is compliance in the cloud even possible? And what standards are in place already to avoid the stormier implications of cloud?"
A Guide to Practical PCI Compliance
Not surprisingly, any answer to these questions right now has to start with "It depends...."
Also see Ira Winkler's The Real Problem with Cloud Computing
Coming to a meaningful answer requires an understanding of the context in which the question is asked. The kind of cloud service under consideration -- public or private? IaaS, PaaS, or SaaS? - matters greatly in meeting compliance requirements. The individual compliance regulations and specific requirements are also key to understanding whether compliance can be achieved in a cloud computing deployment. This article examines the closely related compliance challenges that organizations face when contemplating cloud computing.
"The Cloud"
Blanket statements regarding compliance and cloud computing aren't possible, because there is no such thing as "the cloud". There are a number of different types of cloud computing services, and there are varying types of cloud infrastructures that can be created for single enterprises, and for groups of similar organizations. A recent NIST paper recognizes three service models: Infrastructure as a Service (IAAS); Platform as a Service (PAAS); and Software as a Service (SAAS). Under this, NIST further describes four different deployment models. These include private cloud, community cloud, public cloud and hybrid cloud.
The different service models and deployment models allow varying degrees of customer control, and place different obligations and responsibilities upon both customers and service providers with respect to security and compliance. In private clouds, for example, the organization building them is free to apply whatever set of controls they see fit. In public, community, or hybrid clouds, the customer or user organization does not typically have this degree of control. In addition, the degree of control flexibility afforded the user organization for an IaaS service will generally be a lot higher as compared to a SaaS service. With the higher degree of flexibility offered to the customer organization by an IaaS service comes a higher degree of responsibility for security and compliance for the customer as well.
